Permai Polyclinics
42 clinics, one website — hacked, cleaned, and back to the busiest search traffic we manage.

Who they are

Malaysia’s largest clinic network, by their own count

Permai Polyclinics Group runs 42 clinics from its headquarters at Jalan Pantai, Kota Kinabalu, with branches from Tuaran and Keningau to Sandakan, Lahad Datu, Kunak and Tawau — more than 500 staff, more than 70 doctors and 18 branches open 24 hours, and, by the group’s own description, the largest clinic network nationwide.

Bingo built the website in late 2023.

What was broken

An unmaintained site, taken over

After the first year’s maintenance cover lapsed, the site sat on an out-of-date server with plugins that were never updated. In May 2026 the group reported it hacked.

The attackers had planted 6,703 hidden gambling-spam posts, added their own back doors, and registered themselves as owners of the site in Google’s Search Console so they could steer what Google showed. One of those spam pages was ranking on Google under Permai’s name.

The site itself was also in poor shape: the branch map showed “0 clinics”, 113 buttons were invisible, the homepage took 9–16 seconds to load, and the database had swollen to 761 MB.

What we did

Clean, rebuild, harden — then close the door on Google

1. 1

   Cleaned and rebuilt the site (June 2026)

   Every malicious file removed, WordPress and the theme reinstalled from clean copies, the 6,703 spam posts purged, every password and key changed, the server moved off an end-of-life PHP version, and the attacker accounts ejected from Search Console. Google’s security panel then showed no issues.

2. 2

   Fixed what the hack had left broken

   Branch map restored, invisible buttons fixed, database cut from 761 MB to 78 MB, 58 oversized photos resized, caching added. Repeat visits went from 9–16 seconds to 0.4 seconds.

3. 3

   Tidied the site for search

   Branch pages given proper titles and descriptions, a working sitemap submitted, dead pages redirected to the live branch directory.

4. 4

   Contained a second break-in the same day it was diagnosed (August 2026)

   Two rogue administrator accounts and 1,824 spam pages removed with the site live throughout; login rate-limiting and a file-edit lock added — nothing had guarded the login page through either incident.

5. 5

   Closed the door on the spam pages (September 2026)

   Every leftover casino address now tells Google the page is deliberately gone, and the most visible were submitted for removal. Every branch page now carries structured clinic data (address, hours, map position).

What changed

The spam is gone and the traffic held

• The gambling page that Google had been showing under Permai’s name has had zero impressions since 15 August 2026.
• 39,345 clicks from Google in the 12 months to 20 September 2026 on 1.56 million impressions — the highest search traffic of any site Bingo looks after.
• Unpaid Google visits in August 2026 were up 2.2% on August 2025, with June and July up 11.1% and 6.3% — the traffic held through both incidents.
• Visits from AI assistants such as ChatGPT rose from 34 in May to 83 in August 2026.
• Repeat page loads 9–16 s → 0.4 s; page weight down 41%.

Figures: Google Search Console and Analytics for permaipolyclinics.com, pulled 4, 5 and 23 Sep 2026; speed benchmarks June 2026. Website and traffic data only; nothing here describes clinical services or results.