Suspected backdoor hack: 2,345 fake bot accounts inside the site
Bots have already created 2,345 fake "Customer" accounts via what looks like a known plugin vulnerability (likely one of 17 unpatched plugins). This points to a suspected open backdoor — every day it stays open the site is at risk of full compromise, Google blacklisting, and customer data leaks. This work begins on Day 1 of every package below, before anything else is touched.
worksafeireland.WordPress.2026-05-25.xml — 438 items cross-checked.We parsed WorkSafe's WordPress export and confirmed what the site really looks like today. The headline: only the homepage has any SEO set, every course page is invisible to Google, the shop is mispricing every product at one cent, and there are over 2,000 fake bot accounts sitting inside the site. Nothing here is hypothetical — it's all verified from the export file.
Critical findings
Dark Red39 of 40 pages missing SEO
Zero AIOSEO title or description configured across the site.
2,345 fake 'Customer' bot accounts
Likely bot registration via a plugin CVE — open backdoor risk.
17 unpatched WordPress plugins
Open security vulnerabilities sitting on the live site.
0 blog posts published
No content strategy in place — zero authority signal.
Urgent fixes
Red€0.01 price bug on 25 products
Every live WooCommerce course product is mispriced at one cent.
URL/title mismatch
'First Aid Refresher' page lives at /lead-workers-representative/.
Wrong brand on Contact page
Contact Us page title still contains 'Pulse Medical' — showing in Google.
3 duplicate Courses pages indexed
courses-archive, courses-archive-elementor, courses-archive-gutenberg all live.
Live Semrush scan — worksafe.ie
Scanned 26 May 2026We ran worksafe.ie through Semrush (the industry-standard SEO tool). The numbers confirm what the WordPress audit suggested — and they are worse than expected. Google can see only a handful of your pages, your authority score is 8 out of 100 (new sites usually start around 15), and 700 of your 755 backlinks are spam links from Telegram link-farms and Russian blogspot domains. The good news: your direct competitors are also small. Beating them is realistic in 6–12 months with the right work.
≈ 30% of anchor text is Telegram spam / link-farm anchors. Top anchors include "tg @bhs_links - best seo links" and "join our telegram" — classic negative-SEO link-farm signatures.
700 of 755 backlinks are nofollow spam. The €129 Disavow Bundle handles this directly.
Peak was Mar 2018 (≈ 92 visits/mo) — site has been in decline ever since. Down ~55% from 2018 peak; down ~93% from 2020 peak of 60+ visits/mo.
The decline tracks exactly with when on-page SEO stopped being maintained and the spam backlinks started arriving.
Top 5 keywords you already rank for
| Keyword | Google pos. | Searches/mo | Ranking URL | Our take |
|---|---|---|---|---|
| solas safe pass | 9 | 90 | /solas-safe-pass/ | Page 1 already — easiest win to push into top 3 |
| solas safe pass | 17 | 90 | /solas-safe-pass/ | Second ranking URL — cannibalisation issue |
| safe pass ireland | 19 | 110 | / | Page 2 — strong commercial intent, fixable |
| safe pass and manual handling dublin | 24 | 110 | / | Page 3 — needs dedicated landing page |
| fire warden training dublin | 95 | 110 | /fire-warden/ | Off the map — page has zero on-page SEO |
Your direct competitors (per Semrush)
| Competitor | Keywords | Est. visits/mo | Notes |
|---|---|---|---|
| solas.ie | 246 | 209 | Government body — authority benchmark, not direct competitor |
| irelandtt.com | 142 | 44 | Direct competitor — outranking you 3× on keywords |
| safetech.ie | 109 | 21 | Direct competitor — wider keyword footprint |
| constructionqualifications.com | 95 | 24 | Direct competitor — beats you on Safe Pass terms |
| niso.ie | 63 | 50 | Authority competitor — strong on H&S consultancy terms |
| mustdotraining.ie | 38 | 2 | Closest peer — similar size, beatable |
Indexation fix plan — getting all 40 pages into Google
~15% indexed todayRight now Google only knows about a handful of your pages — your own estimate of 15% indexed lines up with what Semrush is seeing (it only finds 6 ranking URLs out of 40). This isn't because the pages are bad — it's because Google has been given no map of the site, no metadata, no schema, and a robots.txt that doesn't help. The 12 fixes below are the exact technical changes that turn an unindexed WordPress site into a fully crawlable one. All 12 are included in Package 1 (Site Rescue) and above.
1. XML Sitemap
CriticalProblem
No sitemap.xml submitted to Google Search Console — Google has to discover every page by crawling links, and the internal linking is poor.
Fix
Install Rank Math, auto-generate sitemap.xml at /sitemap_index.xml, submit to Google Search Console + Bing Webmaster Tools. Verifies in 24 hours.
2. Robots.txt
CriticalProblem
Default WordPress robots.txt — not pointing to a sitemap, not blocking the duplicate /courses-archive-elementor/ and /courses-archive-gutenberg/ pages.
Fix
Write a clean robots.txt: allow everything important, disallow the 3 duplicate archives, point to sitemap_index.xml.
3. Google Search Console
CriticalProblem
No GSC verification on the current site — we have zero visibility into what Google actually sees, indexes, or rejects.
Fix
Verify domain via DNS, submit sitemap, file 'Request Indexing' for the 25 priority pages individually, monitor Coverage report weekly.
4. Missing meta titles / descriptions
CriticalProblem
39 of 40 pages have no <title> or <meta description> set. Google often refuses to index pages that look 'empty' from a metadata perspective.
Fix
Use Rank Math to write a unique title (50–60 chars) and description (140–160 chars) for every indexable page. Done in Weeks 2–4 of any package.
5. Duplicate / thin pages eating crawl budget
UrgentProblem
9 near-empty pages (checkout-2, courses-page, user-account, wishlist, events-list-style etc.) make the site look low quality. Google's crawler bails before reaching the real pages.
Fix
Set noindex on duplicates, delete empty pages, 301-redirect any that have inbound links. Cleans the crawl trail in one pass.
6. Internal linking
UrgentProblem
Course pages don't link to each other. From the homepage, Google can only reach about 8 pages within 2 clicks — the rest look orphaned.
Fix
Add a 'Related Courses' block at the bottom of every course page (3–5 cross-links). Add HTML sitemap page at /sitemap/.
7. Canonical tags
UrgentProblem
Three Courses Archive pages all claim to be the original — Google sees 3 duplicates and may index none of them.
Fix
Set rel=canonical on courses-archive-elementor and courses-archive-gutenberg pointing to /courses-archive/. Apply across the site via Rank Math.
8. Page indexability signals (noindex)
UrgentProblem
Some pages may have accidental noindex tags from old plugins. We won't know until we crawl with Screaming Frog.
Fix
Run full Screaming Frog crawl in Week 1, list every page with noindex, decide keep/remove case by case.
9. Schema markup (structured data)
ImportantProblem
Zero schema on any page. Google uses schema to understand 'this is a course', 'this is a local business', 'this is a review'. Without it, your rich snippets are blank.
Fix
Add Course schema to all 25 course pages, LocalBusiness schema to Home + Contact, Organization schema sitewide. Rank Math handles this with 3 clicks.
10. Page speed / Core Web Vitals
ImportantProblem
Slow pages get crawled less often. Heavy Elementor build is likely tanking LCP scores — confirmed by stats showing 220 images without ALT and no lazy-load.
Fix
Install WP Rocket or LiteSpeed Cache, convert images to WebP, lazy-load below-fold images, defer non-critical JS. Target LCP < 2.5s.
11. URL hygiene
ImportantProblem
'First Aid Refresher' page lives at /lead-workers-representative/. Google indexes the URL, not the content — so it's filed under the wrong topic.
Fix
Change slug to /first-aid-refresher/, set 301 redirect from the old URL, update all internal links and the menu.
12. Toxic backlinks blocking trust
ImportantProblem
700 of 755 backlinks are spam (Telegram link-farms, Russian blogspots). Google may be discounting the whole domain.
Fix
This is exactly what the €129 Disavow Bundle handles — Mon→Fri timeline already scoped.
Page inventory — all 40 pages
| Page | URL | Size | Priority | Title | Desc | Action needed |
|---|---|---|---|---|---|---|
| Home | / | 13,526 | High | ✅ | ✅ | Review & improve |
| SOLAS Safe Pass | /solas-safe-pass/ | 11,699 | 🔥 Critical | ❌ | ❌ | SEO immediately |
| Manual Handling | /manual-handling/ | 11,805 | 🔥 Critical | ❌ | ❌ | SEO immediately |
| IOSH Managing Safely | /iosh-managing-safely/ | 10,391 | 🔥 Critical | ❌ | ❌ | SEO immediately |
| Fire Warden | /fire-warden/ | 9,601 | 🔥 Critical | ❌ | ❌ | SEO immediately |
| First Aid Responder | /first-aid-responder/ | 11,051 | 🔥 Critical | ❌ | ❌ | SEO immediately |
| School Caretaker H&S | /school-caretakers/ | 11,865 | 🔥 Critical | ❌ | ❌ | SEO immediately |
| Consultancy Services | /consultancy-services/ | 14,796 | 🔥 Critical | ❌ | ❌ | Largest page — no SEO |
| Fork Lift Truck Refresher | /fork-lift-truck-driver-refresher/ | 10,756 | High | ❌ | ❌ | SEO Month 1 |
| Mobile Elevated Work Plat. | /mobile-elevated-working-platform/ | 9,343 | High | ❌ | ❌ | SEO Month 1 |
| Fire Extinguisher Use | /fire-extinguisher-use/ | 8,789 | High | ❌ | ❌ | SEO Month 1 |
| Ladder Safety | /ladder-safety/ | 9,607 | High | ❌ | ❌ | SEO Month 1 |
| First Aid Refresher | /lead-workers-representative/ | 11,387 | High | ❌ | ❌ | ⚠️ FIX URL FIRST |
| e-Learning Portal | /e-learning/ | 11,083 | High | ❌ | ❌ | SEO Month 1 |
| Safe Pass & MH Bundle | /safe-pass-manual-handling-bundle/ | 2,201 | High | ❌ | ❌ | SEO Month 1 |
| About Us | /about/ | 12,713 | High | ❌ | ❌ | SEO Month 1 |
| Contact Us | /contact/ | 7,062 | High | ❌ | ❌ | Fix Pulse Medical title |
| WorkSafe Facilities | /worksafe-facilities/ | 11,084 | Med | ❌ | ❌ | SEO Month 2 |
| Testimonials | /testimonials/ | 9,877 | Med | ❌ | ❌ | SEO Month 2 |
| Upcoming Courses | /upcoming-courses/ | 5,847 | Med | ❌ | ❌ | SEO Month 2 |
| Make A Payment | /make-a-payment/ | 7,484 | Med | ❌ | ❌ | SEO Month 2 |
| Courses Archive | /courses-archive/ | 4,043 | Low | ❌ | ❌ | Merge or noindex |
| Courses (Elementor) | /courses-archive-elementor/ | 8,415 | Low | ❌ | ❌ | Noindex |
| Courses (Gutenberg) | /courses-archive-gutenberg/ | 22,296 | Low | ❌ | ❌ | Noindex |
| Privacy Policy | /privacy-policy/ | 6,645 | Low | ❌ | ❌ | Noindex |
| Terms & Conditions | /terms-and-conditions/ | 9,595 | Low | ❌ | ❌ | Low priority |
| Shop | /shop/ | 0 | Low | ❌ | ❌ | Noindex — empty |
| Cart | /cart/ | 3,988 | Low | ❌ | ❌ | Noindex |
| Checkout | /checkout/ | 67 | Low | ❌ | ❌ | Noindex |
| Checkout 2 | /checkout-2/ | 4,216 | Low | ❌ | ❌ | Delete — duplicate |
| My Account | /my-account/ | 67 | Low | ❌ | ❌ | Noindex |
| User Account | /user-account/ | 0 | Low | ❌ | ❌ | Empty — delete |
| Wishlist | /wishlist/ | 0 | Low | ❌ | ❌ | Empty |
| Instructor Public Account | /instructor-public-account/ | 0 | Low | ❌ | ❌ | Empty |
| Student Public Account | /student-public-account/ | 0 | Low | ❌ | ❌ | Empty |
| Courses Page | /courses-page/ | 0 | Low | ❌ | ❌ | Empty — delete |
| Events List Style | /events-list-style/ | 52 | Low | ❌ | ❌ | Near-empty |
| Events Grid Style | /events-grid-style/ | 51 | Low | ❌ | ❌ | Near-empty |
| Events List w/ Search | /events-list-style-with-search-box/ | 41 | Low | ❌ | ❌ | Near-empty |
| Refund & Returns | /?page_id=53565 | 5,345 | Low | ❌ | ❌ | Draft — assign slug |