Since site reviews aren't allowed this is section we'll keep the advice on a more general level so it's useful to everyone :)

Look at the search queries in Google search console to see what was driving traffic and what has now dropped. Then manually look at the serps. It could an issue of YMYL or new ads/oneboxes pushing your listing below the fold so it no longer generates clicks. Since its a skin care site pay extra attention to YMYL - might not be the issue today but its definitely the future and a very important topic to fully understand and address.

PS Google also doesn't like excessive SEO meddling. You might have wanted to make the site more appealing to Google but when Google sees title tags, links etc being meddled with on a massive scale they might think you are trying to manipulate rankings and apply a temporary penalty. They filed a patent on this many years ago.

I think the most important thing you did in your list that might have caused your issue is nofollowed all affiliate links. While the other stuff is a good idea it IMO wouldn't be responsible for such a fall.

Other things you may want to consider to do/check:
- Check Search Console for any bad incoming links. If you have a lot of them this might be part of the problem
- Search for your content and see if others have cloned your website creating a duplicate content issue.
- You use canonical links?
- Double check what Googlebot actually sees. Maybe you have sort of script on your site from a hacker that may be injecting content into your page that Google doesn't like

Also remember sometimes when you fix something it is not reflected until the next major Core update.

It sounds like a case of too many changes in a short time. Upgrading hosting and PHP, going with a new theme would generally be beneficial but if at the same time there are changes with so many other parts of your site, it will take time for those changes to be digested and sorted to see the net result of those changes.

- De-indexed anything that could be considered thin content (tag pages)
- Removed pop-ups (Leadpages newsletter sign-ups)

- IMHO these are things that should have been done in the planning stage, should have not been an issue. Neither Google nor visitors would appreciate those.

Clearly this is a WP site, you should only have a sitemap for posts and pages, not archives, tags, etc. which are just another way to find the same content. Useful for visitors and internal search, not good for sitemaps and serps because Google may choose the "wrong" version to index when given multiple choices (they won't index them all).

The question is: will his site be able to recover over time, or does he need to go with another domain?

Given the similarity of this report to the MANY OTHERS posted at WW over the last year, recovery (if at all) will be slow, and never rise to original numbers. The SE's are also being more selective of what gets listed in the serps ... some niche groups do not fare well, either an abundance of caution or more likely addressing long time abuse/thin content, or the niche is no longer favored.

However, any changes in the pursuit of recovery should be logical, reasonable, and given time to take effect ... and that might take 6 weeks to 6 months.

What is evident is the loses can come quick and sudden and be large, but recovery takes time---and is incremental in nature.

Thank you everyone for your time and feedback. I really appreciate it.

What I gather is I need to give it more time to recover, if it recovers at all. I have a friend that has a website in similar niche that lost 85% of his traffic back in Feb 2018 and only started seeing small recovery September 2019. Unfortunately that's a long time to wait.

I've been advised to start completely over on a new domain. But maybe it's too soon? And because I don't know what caused the issue in the first place, I'm afraid it's going to repeat itself all over again, or just never take off.

My website does fall under the category of YMYL.

I also posted about my traffic loss on Google Search Console forum, and one responder did bring up that my business doesn't have a knowledge bar in the SERPs and not registered in Google My Business, and therefore it's considered an unidentified publisher and business. He gave me a bunch of links with guidelines of what to fix, which would improve brand trustworthiness. I've since registered with Google My Business and in the process of adding my tax numbers and business registration numbers to my website footer, about page, and contact. I will also link copies of my degree and certificates. I believe there is some sort of database i can register all that too. I was unaware of all this, so perhaps this can help? Definitely worth trying!

As for some of your questions:

@goodroi - Since the beginning of June, all the keywords I was ranking position 1-3 fell to position 50-150+, some disappeared completely off the serps.

@ JesterMagic - Thanks for the suggestions. How would I check what Googlebot sees incase there is injected code? In the beginning of the year my website was hacked. I caught it before my host did. I never received any security warning from Google either, so I'm not sure they picked up on it. I had the website professionally cleaned, plus added security put on. In the beginning of June when I lost 80% of my traffic overnight, I immediately thought it was malware again and contacted the security company. They conducted extra scans and said no. All the SEOs I've spoken to about this say since I lost my traffic right when the June Core Update rolled out, that the traffic loss is coming from the algorithm and not a malware issue. But I have a friend who specializes in DOS attacks, and he says those malware security scans don't pick up on everything and the only way to be sure all the malware is fully removed is by rebuilding the website on a completely fresh wordpress, new theme and new plugins. Unfortunately I wasn't aware of installing fresh wordpress when I installed the new theme a few months ago. And as everyone has pointed out, I may of done too much fixing and upgrading on my website causing further penalty. I'm not sure at this point if it's worthwhile to rebuild the website on fresh wordpress and theme just in case there is a hidden malware issue, or if I'd be digging my own grave. Any feedback on this would be greatly appreciated.

You don't mention examining your site's access logs which can give you real insight into any of several kinds of problems. Knowing your traffic, understanding visitor paths as well has just how many visits are human vs. bot traffic can help you spot things that need attention.

PS - I do not think that "starting over" will help much if at all.

Second the "don't start over" ... though a bare bones WP configuration could be quite helpful in sorting things out. Don't add plugins unless there is a real and compelling reason to do so!

Check your site logs. If this has not been a usual practice, make it so! These logs will reveal more information than anything g reports to you. IMMENSELY VALUABLE! If you don't know it, learn it!

Also take proactive steps in your .htaccess (or whatever configuration your web/host requires) and nuke the bad actors ... and they are MANY ... with 403s. This helps define humans, good bots, and kills off the rubbish referer links, etc.

Meanwhile, take a deep breath, let it out, relax, and get over the panic attack. THE WORST HAS ALREADY HAPPENED ... just make sure you don't take steps that will make it worse. Whew!

Wishing all best luck in sorting this out!

Agree with others. Don't start over.

Scanning cannot catch everything. Googlebot usually only catches the obvious hacks.

Google Chrome Dev Console allows you to overwrite the user agent to simulate Googlebot (see for instructions [developers.google.com...]

Check out some of your high performing pages while using the Googlebot agent and check the source of those pages to see if anything is being injected into your content or code that shouldn't be there.

Depending on how you got hacked and what the hackers had access to it can be very difficult to find and clean as they can hide their code not only by modifying your files but also by adding new files or modifying the contents of your database. The only guarantee way of removing a hack is to delete all files on your server and restore them from a backup before the hack (or by completely rebuilding the files by installing everything again). You then also have to delete all tables in your database and restore a backup from before a hack. Obviously this happened a while ago so it may not be realistic for you to do this now so I would double check things by using the Googlebot user agent.

@JesterMagic thanks for the tip about simulating Googlebot in Chrome. The link provided doesn't do a great job of explaining it, but with a bit of clicking around I figured it out. Here is a link to the various Google User-Agents. [support.google.com...] I used the smartphone UA, and then browsed some of the spammy links reported in my GSC. It is truly amazing, to see how nice and proper these links look when you are viewing them as Googlebot (LOL).

Yeah it does not explain it very well. It use to be more accessible (right from the network tab) but they hid it for some reason.

For those using this on hacked sites, still need to remember while this simulates Googlebot it does not simulate GoogleBots proper IP address so if a hackers script checks for the proper IP addresses the malicious content may still be hidden from you. (though I find this not very likely)

Not enough info, are you're previously well ranking pages indexed or did you just lose rankings?

The same thing happened with my site last year and it has still not recovered. All the keywords that were ranking on first page were pushed to 5th, 6th or 9th page. And let me tell you, almost all my articles were on the first page. So you can imagine the loss. I'm still ranking high on bing, yahoo, DDG and every other search engine. And I don't cover medical or sensitive topic that can trigger Google. The same happened with another site in my niche and it recovered in 2 months. Sometimes I feel it's just random.

And yes, the same thing happened to another forum member, and his site recoveres in just 10 days. So there's always hope.