My website is dropping in Google search, need some advice

Hi, I'm dealing with some SEO issues I've never had before with one of my websites, and I am hoping to find some help. Any information anyone can provide is greatly appreciated.

(I know this is really long, but I am trying to be as thorough as possible)

For nearly 6 years one of my websites has done really, really well and ranked 1 - 4 for some pretty popular keywords in Google. I built this website by hand form scratch. I didn't use Wordpress, or any plugins, or any kind of software, it's all hand-coded html, css, php, and javascript.

This site is a small site, meaning there are only 4 static pages indexed by Google. However, there is a lot of content on the homepage.

Beginning in the middle of February 2017, I noticed that my traffic began to decline. Here is a timeline that will hopefully explain everything:


Early October 2016 - Backlinks to my site began to climb. It went from around 25 referring pages (from 2013 - 10/2017 there were 25 on average) to 106 on 03/02/2017. Now there are 104 as of 03/10/2017. On average 1 or 2 backlinks were being added each day beginning in October 2016. Most of these backlinks are from pretty spammy looking sites like dvduck.com, for example. Websites I've never heard of.

Note: I wasn't aware of these new backlinks and this activity until around late February 2017.


01-23-2017 - I made a complete backup of my site on my own hard drive. There was a strange php file (gjtlrit.php) on my website's server, BUT I didn't see this file until later.


01-27-2017 - I uploaded 120 new files (pages) to my site with new original content created by me. All of these files are noindex, nofollow, noarchive. When I first saw my rankings slipping, I thought maybe it was because I had uploaded so many noindex, nofollow, noarchive files.

Note: I've also been slightly changing my index.php (homepage) a few times over the past couple of months, maybe starting in December. I was just trying some different things out to get my bounce rate down, because my bounce rate for this site has always been around 90%. The homepage is the main page that ranks in Google, and 99% of visitors go to that page through organic search. I've always been so paranoid about changing any of the content on the site or even adding new content because I've always been afraid that it would cause my position in Google to change, so these were very small changes, usually just a few sentences here and there.


Late January/Early February 2017 - I started to receive strange emails that made no sense (skjfjhskhffskh@slkrlkjkhsljkd.com - for example). I was getting 3 - 6 of these strange emails each day, and the 'normal' emails almost completely stopped coming (usually I would get 3 - 6 of the normal emails a day).

My site had a simple form with a name field and email field. When a user would enter their name and email, an email server would send the user an email and it would also send an email to MY email address, letting me know someone had used the form. This form was written in php by me, and might be one of the problems. I no longer use that mail form and am now using a third-party email marketing service and their forms.


Mid-February - I started to really get concerned, because my traffic was dropping. I was going from 200 - 250 visitors a day to 100 - 130 a day. Almost all of the traffic to this website is from Google organic search. I called my hosting company and they told me there had been no changes to the server my site is hosted on.


02/17/2017 - I went on the server and looked through all of the files. That's when I noticed the strange gjtlrit.php file. I downloaded it, opened it in my code editor, and saw that it was some kind of obfuscation code. Probably something involving malware. I deleted the file from the server. I then checked my last backup, which was the one from 01-23-2017 and the file was also there at that time. I had another backup from September, and the file wasn't there. I don't know exactly when the file was uploaded to my server, but obviously it was sometime between September and late January.

I looked at the access logs and noticed a bot hitting the same pages over and over, but only a couple of times a day. I blocked the ip address of the bot. The bot is still going to my site even now a few times a day, but now it is served a 403.

I changed the login info for my hosting. I used Google Safe Site and it didn't report anything.


02/19/2017 - I called my hosting company again and asked them to take a look at the email server(s). They told me that recently certain email providers like yahoo and hotmail had been blocking some of the emails from my email server (because of the strange emails that were being sent - that's my guess). I did update the php version on my server from php 5 to php 5.4.


02/19/2017 - Now - I've been doing a LOT of research to try and figure this out. Right now my traffic is holding steady at around 100 visitors a day, but I've dropped pretty far down for quite a few keywords. My head is spinning which is why I decided to reach out.

To be honest, I haven't monitored this site as well as I probably should have. BUT I've always checked it from time-to-time, usually a couple of times a week. I would also check Google Analytics and Webmaster Tools a couple times a week. There was never anything strange for all these years, so I became complacent I guess.

Even though I didn't check it every day, I am pretty sure there were never any warnings (malware, spam, hacked, etc.) in Google's search results because of that strange file or anything. I KNOW there wasn't anything ever wrong with the site itself, no warnings or anything. I never saw and STILL haven't seen any manual actions in Webmasters. (Even during all of this, the site is still producing sales, just not as many because of less visitors.)

Around late February I DID see that there was a URL error in Webmasters because Google was saying 2 pages of my site were missing: m.faq.php and mobile.faq.php - problem is, those pages never existed in the first place, so I don't know what this error was all about. I marked it as fixed and now Webmasters shows no errors.

Note: on 03/08/17 there was one server connectivity error reported in Webmasters (Site Errors section). I haven't ever seen any other errors in this section.

I have been monitoring the site every few minutes every single day, TRYING to figure out what to do.

I deleted all of those no index files that I had uploaded on 01-27-2017 just as a precaution in case that affected something in Google.

There haven't been any site speed issues. One day in early March it was reported as being reeaaally slow (51 second load time), but other than that it usually loads within 3-4 seconds.

I've ran the site through nearly every malware and virus scanner I could find, and I've also probably ran it through every tool Google offers. Nothing ever comes up. It's always clean and clear. My ratings for mobile and desktop according to Google's score is 100/100, 75/100, and 74/100, so nothing strange there. I've also manually looked through every file on my server and found nothing.

On 03/07/2017 I uploaded a completely new version of the site. The site is basically exactly the same, I just added a few pieces of content on 2 of the pages and changed the page titles and descriptions because they were the same for each page - it has been like that for around 6 years. The site still has the same 4 indexed pages. The main reason I uploaded a new version is because over the years a lot of files (like test pages and stuff like that) had been added to the site and there was a lot of clutter on the server. I went from maybe 130 files to maybe 40. This way I can monitor the files more easily. I also cleaned up the html and css on each page a bit.

I signed up for ahrefs.com on 02/27/2017 and that's when I saw all of the backlink activity, and also saw my site dropping for most keywords.

That's basically all of the information I have. I really appreciate anyone who took the time to read all of this, and I'm sorry for such a long post. Again, I was just trying to be thorough.

If you have any questions, please ask, and again I really appreciate any help or advice.

Thanks,

Dan