Rebuilding a hacked store without bringing the hack with it

The situation

The store had been running on Joomla 3, which is no longer supported, with a page builder and a Joomla shopping cart. It was hacked. The owners did not want a clean-up of the same old stack; they wanted to move to WooCommerce, with their own staff re-entering content where that made sense, and without losing the search rankings the store had built up.

Recovering only what was clean

We restored the most recent backup into an isolated, password-protected sandbox and checked it before trusting anything in it. It turned out to predate the hack: none of the injected menu items or fake sign-in pop-ups were present. That made it the source of truth for the rebuild.

From it we exported everything the new store needed: products, articles, every URL, customers, the SEO titles and descriptions, product tags and image alt text. Counting properly corrected the owners' own estimates: 75 products, 35 real articles (one more was placeholder text), and 167 URLs that needed a home, where they had expected fewer than 150.

Keeping Google on side during the downtime

Joomla's offline mode answers with a normal "200 OK", which tells search engines the empty holding page is the real site. We replaced it with a small holding page that returns a proper 503 "back soon" status, so search engines wait rather than re-index, and added an enquiry form so the business could still take leads.

The new store

• A custom WooCommerce theme, with product tabs, range landing pages and a "professional use only" badge the staff can set per product.
• Every SEO title and description loaded from the client's sheet, and 228 sandbox links rewritten to their final addresses.
• Shipping by order value across seven UK bands with VAT on shipping, each band edge tested. Testing also found that very large orders fell outside every band; that gap was closed before launch.
• Stripe and PayPal live, tested with a real paid and refunded order.
• The DNS cutover left the domain's business email untouched, and an outdated IPv6 record that was breaking the security certificate was removed.

Testing also found that new order emails were failing the sender check and being quarantined by Microsoft 365. We fixed the SPF record before customers ever noticed.

Where it landed

• The store moved off an unsupported, compromised platform onto WooCommerce, rebuilt from a backup proven clean.
• Every old URL mapped, and search engines told to wait rather than drop the site while it was down.
• Shipping, payments and order email all tested end to end before launch.

The new store went live in early October 2026. Post-launch polish, mainly on older mobile devices, continued in the first weeks, as it does on most launches.

This was a security incident, so the client, the site and anything that could identify them are withheld. Details are taken from the project record.