Confidential
Ref: KZK‑2026‑0803
Website Audit & Risk Assessment
Subject: kizuki.com — Kizuki Ramen & Izakaya
Urgent: the site appears compromised
Hidden, off‑screen markup is injecting adult‑content and paid backlinks that only search engines see — the signature of a hacked WordPress install or a rogue SEO vendor. This is a live Google‑policy violation and should be remediated before anything cosmetic.
Scorecard
Four axes assessed against current best practice for a multi‑location restaurant brand.
The instinct that it "looks outdated" is correct — but the priority isn't a redesign. The site needs a malware cleanup and security pass first, then modernization.
1 · The Compromise
Confirmed in the live DOM, not merely the page source — meaning it is served to Google's crawler on every request.
Hidden SEO‑spam link injection
A block positioned off‑screen (position:fixed; top:-600px) hides a list of adult‑site backlinks from human visitors while remaining fully visible to search engines. Two further hidden links — a paid "kitchen cabinets" link and a Turkish SEO‑agency credit — are injected via display:none. A family restaurant is unknowingly passing its domain authority to porn and link‑farm sites.
2 · Security · D‑
Back‑level, high‑risk plugins
Slider Revolution 6.6.8, WPBakery 6.1, and Ultimate VC Addons 3.19.4 are all outdated. Slider Revolution in particular has a long history of critical remote‑code and file‑access vulnerabilities and is the most likely entry point for the injection above.
No security headers
Missing Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Only X-Content-Type-Options is set.
Insecurely‑scoped session cookie
PHPSESSID is issued with no HttpOnly, Secure, or SameSite flags — and on a public marketing page that shouldn't set a session at all. That's an avoidable session‑theft exposure.
Version & path disclosure
WordPress version is advertised in a generator tag, readme.html is publicly reachable, and full plugin paths are exposed — all of which help an attacker fingerprint known exploits.
Solid hosting foundation
Runs on Kinsta behind Cloudflare with fast edge caching; xmlrpc.php is blocked and wp-admin redirects to login. The infrastructure is sound — the site contents are what's been tampered with.
3 · SEO · D+
No H1 on the homepage
The page ships zero <h1> elements and jumps straight into a stack of <h2>s — including the spam one. Search engines have no clear primary topic signal.
Thin structured data for a 20‑location brand
Yoast emits only generic WebPage/WebSite schema — no Restaurant/LocalBusiness, no per‑location address, geo, or hours, no menu schema. This is the single biggest missed local‑SEO and rich‑result opportunity.
Weak title tag & stale content
The title reads Home - Kizuki Ramen- … near me — leading with "Home‑", inconsistent casing, keyword‑stuffed. Footer still reads "© 2019," and typos are baked into URLs (/califonia/) and copy ("recipie").
Image alt‑text problems
Several images carry alt="null" or empty alts, and the same "west seattle ramen" alt is reused across unrelated locations.
4 · User Experience · C
Fast server response
Time‑to‑first‑byte ~0.14s with a warm edge cache. The back end is quick.
Page‑builder bloat
~38 JavaScript files load on the homepage — including ~15 booking‑system scripts the page never uses — plus Slider Revolution and multiple addon frameworks. That undercuts the fast server on real mobile devices.
Pinch‑zoom disabled
The viewport is locked with user-scalable=0, maximum-scale=1, an accessibility failure for low‑vision users.
Confusing navigation & wrong data
The "Menu" and "Locations" dropdowns list overlapping‑but‑different states; a location card shows a mismatched city/address. Small errors that erode trust for someone deciding where to eat.
5 · Aesthetic · C‑
A capable but dated template
Built on the The7 theme + WPBakery + a full‑width slider — a competent 2016‑era look (page created 2016, footer says 2019). Nothing is visibly broken, but it reads a decade old, which is exactly the first impression that prompted this review. It's the least urgent item on the list.
Recommended Remediation
Clean the hack Today
Remove the injected blocks, scan for a backdoor, rotate all WordPress/host/DB credentials, revoke any outside "SEO" access, then request a Google review if rankings dropped.
Patch the entry point This week
Update or replace Slider Revolution, WPBakery, and Ultimate Addons; update all remaining plugins, themes, and core.
Harden the server
Add the missing security headers, set
HttpOnly/Secure/SameSiteon cookies, hide the version, and blockreadme.html.Fix the SEO fundamentals
Add a real H1, deploy
Restaurant+ per‑location schema, rewrite the title, and correct the © year and typos.Modernize
Only after the above — refresh the design and put the front end on a diet. A rebuilt flagship page is provided alongside this report.