Waking up to a website that speaks a language you never taught it.
Somewhere around two in the morning on October the 13th, something moved into my website. I did not invite it. I did not install it. I did not even know its name. But by the time I sat down with my coffee the next morning, my store, vitaladge.com, had quietly grown a second personality. Every single post I had ever written, all 336 of them, now existed in a version of my site that ended in /es/. Spanish. Three hundred and thirty-six Spanish mirrors of a website built in English by one man in Carletonville.
I want to write this one down carefully, because it scared me in a very specific way. Not the way a hack scares you, with panic and changed passwords. This was worse in some ways. It was quiet. It looked, at first glance, like growth.
The discovery: a report I almost dismissed
It started with a routine morning briefing from my AI assistant. He runs checks on my sites while I sleep, and that morning the report contained a line I did not expect: the store was serving Spanish-language mirrors at URLs like vitaladge.com/es/..., and every page was declaring itself, in its code, as Spanish content. The assistant flagged it as urgent. My first reaction was honestly confusion. I have one blog in English. I write in English. I think in English. I have never once considered a Spanish version of anything.
But the URLs were real. I opened one myself and there it was: my own post, my own words, under a Spanish URL, with a tag in the page telling Google and every browser that this content was written for Spanish speakers. Except the content was not translated at all. It was my English text, untouched, wearing a Spanish name tag.
A plugin had activated itself. A tool called Universally, a language translation plugin, had switched itself on overnight. The timestamps in the system said the change had landed at about a quarter to two in the morning. I was asleep in Khutsong. Nobody in my business was awake, because I am the entire staff. For a few hours, my website made a decision without me.
The five minutes where I thought it was a good thing
I will be honest about this part, because a diary that only records the right decisions is not a diary, it is a brochure. For about five minutes, I looked at those 336 Spanish URLs and thought: maybe this is not a problem. Maybe this is reach. Spanish is one of the most spoken languages on earth. Three hundred and thirty-six new pages overnight. Who would not want that?
Then I remembered something I have learned the hard way this year, writing this diary: Google does not reward pages that exist. It rewards pages that are honest. And these pages were lying. They told search engines, in the hreflang tags that map languages to pages, that here was Spanish content for Spanish speakers. Then they served English paragraphs. To Google, that is not expansion. That is 336 pieces of duplicate content, all fighting with my real pages, all mislabeled, all shouting the wrong language into a machine that keeps score.
Every lesson I had written down in this diary over months said the same thing. When the Instagram shadowban hit, the lesson was that platforms punish shortcuts. When AdSense said insufficient content, the lesson was that there are no tricks, only substance. And here was a shortcut, installed by a machine, dressed up as growth. The decision made itself the moment I stopped being flattered by it.
The rollback: how you undo 336 pages you never built
Here is where having an AI assistant earned its keep. I did not have to spend a week figuring out the rollback. The plan was simple and surgical: switch the plugin off, confirm the Spanish URLs stop being real pages, and make sure Google gets pointed back to the originals. The assistant handled it through the site's code interface, and within the hour the damage was reversing. The /es/ addresses now redirect to the proper English pages. The fake Spanish homepage returns a clean "not found" instead of a live page. The language declarations were stripped from every page. The plugin itself stays installed but switched off, sitting there like an unplugged appliance, and we now check regularly that it does not switch itself back on, because that is apparently a thing that can happen.
The part that still sits oddly with me is how it got there. I still do not know exactly how that plugin activated itself overnight. I have my suspicions. A routine update, an accidental toggle, something in a settings screen I clicked through too quickly. When you run a business alone at 2AM, you are also running it at 2AM, if you understand me. The mistakes you make when you are tired do not wait for business hours.
What 336 mirrors actually means in rands
Let me make this concrete, because "duplicate content" sounds like a technical problem until you turn it into money. My store does not earn from ads yet. It earns, when it earns, from people landing on my pages, reading something honest, and clicking through to a product I genuinely recommend. Every one of those clicks begins with a search result. If Google starts distrusting my domain because a third of its pages are mislabeled copies, it does not hand me a fine. It just quietly stops sending people. No email. No warning. The traffic graph just lies down one week and you spend a month wondering why.
That is the entire scheme of this thing. Not a break-in. A slow leak. And a slow leak is worse, because it never gives you a good day to notice it.
So when people ask me whether running an online business from a township in Gauteng is risky, this is the answer I give now. The risks are not the dramatic ones. Nobody is hacking me in any way that would make the news. The real risk is that a website is a machine with hundreds of moving parts, and the machine does not care that its only engineer was tired.
The lesson under the lesson
Everybody says "move fast." Every YouTube video about online business repeats it like a prayer. And there is truth in it. If I had waited until I felt ready, I would still be planning my first website instead of running two of them. But this incident gave me the other half of that sentence, the half nobody puts in a video: moving fast means you sometimes leave doors open behind you. A plugin here, a setting there, a box you ticked in July and forgot by August. Speed builds the business. Attention keeps it standing.
The correction I have made since is small but real. Once a week, I now ask my assistant one question: what changed on my sites that I did not change myself? It takes him minutes, because he keeps a better memory of my websites than I do, and I will write more about that soon, because it is a strange thing to make peace with. The answer should always be "nothing." The day it is not, I want to know before Google does.
Was anything actually lost? Probably not, and that is the honest accounting. The mirrors lived for hours, not weeks. The redirects now pass visitors and search engines back to the real pages. But "probably fine" is not a business plan, it is a hope. I did not build this thing on hope. I built it on Friday nights and public holidays, one post at a time, and I am not letting a silent plugin renegotiate what I made.
What I would tell the person scrolling past this
If you run a website, go and check two things today. First, whether any plugin on your site has activated itself recently, because they can. Second, whether your pages declare languages they do not actually speak. Both checks take ten minutes. Both are the kind of ten minutes that save you the week I have just had.
And if you are building alone like me, write down what happened when something went wrong, even if you fixed it by lunchtime. The story of the night my site spoke Spanish is worth more to me than the fix itself, because it is now part of the record of how this business actually gets built. Slowly, at night, by a human, with machines that need watching.
That is the entry. The store speaks one language again. Its owner is listening more closely now.
Related entries from the journey
If this story about silent plugins and duplicate pages got your attention, I have written about these invisible website fights before. I documented the robots.txt war, when I had to fight bots to protect my server, and the night bots tried to take my site down through pingbacks. For the bigger picture on why honest content beats tricks, read how I learned to write for Google instead of myself.
What I check now, months later
I went back through this after the mirror incident and audited the thing that actually caused the damage, which was never the translation itself. It was the volume. Hundreds of near duplicate pages appeared under URLs I did not plan, and a crawler that finds hundreds of duplicates on a young domain learns to spend its budget there instead of on the pages I wanted ranked.
So here is the sweep I run now. First, the sitemap. Mine holds 61 entries today and every single one is on the canonical www host, which I verified by pulling the file and grouping the URLs by domain rather than trusting that it looked right. Second, the status of each entry. All 61 answer with a 200, checked one by one, because a redirect chain in the middle of a sitemap is a signal to a crawler that the file is unreliable. Third, duplicate surfaces: the translation mirrors, the feed endpoints, and anything that generates a second URL for the same paragraph. Feed endpoints will never be indexed, and a report that counts them as missing content inflates the problem.
The wider point is that the Spanish night was not a weird one off. It was the first time a machine changed my site while I slept. Since then I have had an assistant publish posts, submit apps and place bids for me, all of which is useful and all of which is the same category of risk. The fix is not to stop automating. The fix is to know, at any moment, exactly how many URLs I own and whether each one answers correctly.
That number, 61, is now something I can produce on demand. In July I could not have told you whether my site had fifty pages or five hundred.
If there is one habit worth copying from this, it is keeping a count. One number, the exact total of URLs you own, plus the status of each. Everything else in this diary is opinions about that number.
Count your URLs before you count your readers. The order matters more than it sounds.
The mirrors are gone from the sitemap but the habit stayed, and the habit has already caught two problems that would otherwise have sat there quietly costing me visits I never knew I was losing.
Newest entries from the diary
Written by Justice Manyika — Johannesburg, South Africa. This diary records my real journey, in my own words.
If this helped, follow the journey — drop your email in the box below and every new entry lands in your inbox. No spam, unsubscribe anytime.
Comments
Post a Comment