Observations made in Search Console specifically during the security incident recovery period (see Website Recovery Timeline).
- Noticeable differences between cached and live pages – Google’s cached version sometimes still reflected the hacked state after the live site had been cleaned.
- Delayed removal of hacked URLs from the index – flagging and removing compromised URLs was not instant, even after cleanup.
- Distinct re-indexing behaviour – the site’s crawl and re-indexing pattern during recovery differed from normal operation.
- Patience was required before judging SEO performance – ranking or traffic figures observed during this window could not be trusted as a reflection of genuine SEO health, since they were still affected by recovery, not by any current SEO decision.
This is the technical basis for the “Security Before SEO” Decision.