From a compromised WordPress to No. 1 on Google for «aceite de oliva Écija»

The starting point

CAPI is the Sociedad Cooperativa Andaluza Agro-Pecuaria Industrial of Écija, founded in 1952. It mills its members’ olives in its own mill and sells its extra virgin olive oil, Molino de la Merced, in its shop and online. It also runs a petrol station, publishes the mill price for olives and provides services to its members. Product and local roots, in abundance.

Its site was a compromised WordPress install: it served casino spam that nobody at the cooperative had published. To a search engine, that makes a domain suspect; to a customer, it’s simply a bad sign. The outcome was predictable: search for «aceite de oliva Écija» and the cooperative that produces it was nowhere to be found.

What we did

First, for security, we deleted the spam. Then, rather than patching the WordPress, we retired it. We migrated the site and rebuilt it from scratch as a static build in Astro and Tailwind CSS, with no database or content management system exposed on the public server. What doesn’t exist can’t be compromised: the route the spam came in by disappears with the change of architecture, not with a patch.

Interactivity was kept for the pieces that genuinely need it —the home carousel, the forms, the petrol station prices— as isolated islands; everything else is served as pre-built HTML. The cooperative needed to keep updating its site, so we gave it just enough to do so without reintroducing the risk:

• Its own panels. One for publishing on the blog and another for updating fuel prices. Access is by a one-time code emailed to a closed list of authorised addresses: no passwords to steal and no /wp-admin to attack.
• Live prices without a server. The petrol station prices live in a spreadsheet the cooperative edits itself; the site reads and publishes them.

On that foundation we worked visibility across the three surfaces where people look for a local product today:

• Organic. Titles, descriptions and the structure of each page written around what people actually search for, with a clean sitemap.
• Local. We worked on the cooperative’s Google Business Profile, and every page of the site declares the same address and phone number as that listing, so the two signals reinforce rather than contradict each other.
• Generative (GEO). JSON-LD markup for the organisation —legal name, founding year, address and linked online shop— so search engines and assistants read who the cooperative is declared, rather than having to infer it.

The outcome

For «aceite de oliva Écija», CAPI now holds first place on all three of Google’s surfaces at once: capi-ecija.es is the first organic result, ahead of the price-comparison sites; the cooperative is the first business on the map, rated 4.6 from 120 reviews; and Google’s AI Mode recommends it first among the town’s cooperatives and mills, naming Molino de la Merced.

It’s a leap from zero, not from page two: the starting point was a domain the search engine associated with spam, on which the cooperative didn’t appear for its own search.

As with all our cases, the figures should be read with a cool head. Rankings vary by location, device and day: the screenshots were taken from Écija and are dated so they can be checked. And an AI recommendation is a sampled indicator, not a census: there is no exact metric today for appearances in generated answers.