A few months ago I got an email about needing to approve some comments on my WordPress blog.
Those comments turned out to be spam. When I took a look at my blog posts themselves, I discovered about a thousand posts that were not published by me and I felt panicked.
I was on my phone at the time so it was pretty difficult to do bulk deletion through the mobile interface but I finally cleared them all out. These had been backposted from 2016 to 2013 and I wish I’d caught them sooner. No idea how this has affected my web traffic.
Lesson is to make sure your site security is up to date I guess.