The cleanup is finished. The spam generator is gone, the scanner is quiet, and the host has lifted its warning. Yet when you search for your business, Google still shows results on your domain with titles about pills, slot games or lines of Japanese text. Clicking them now leads nowhere, but customers do not know that, and it looks bad.
That lag is normal. Google’s index is a record of what its crawler found on earlier visits, and each URL is updated only when the crawler comes back to check it. On a site where the attacker created thousands of pages, that can take a long while. The work described here is about making sure every return visit from Google gets the right answer, and speeding things up where Google’s tools allow. If the site is not clean yet, that comes first, through our hacked website repair work or the dedicated SEO spam cleanup service.
Step one: confirm nothing is still producing spam
Asking Google to forget URLs that your server is still generating is wasted effort. Before any index work, we check that the pages really are gone for every kind of visitor. Spam on hacked sites is often cloaked: it shows to Googlebot but not to a person in a browser, or only to visitors arriving from a search result. The URL Inspection tool in Search Console, with its live test, shows what Google’s crawler receives from a given address today, and that is the view that counts here.
If any spam URL still returns a page of junk to Googlebot, the job goes back to cleanup. Fresh spam URLs appearing in Search Console after the cleanup date tell the same story.
Step two: understand what Google has on file
Hacked spam usually follows patterns: a folder name, a file extension, a run of random characters, or a query string bolted onto real pages. Working out those patterns turns an unmanageable list into a few rules. We gather samples from a site: search, from the Page indexing report, and from the Performance report in Search Console, where spam pages that drew impressions show up as queries and pages you never wrote. The Japanese keyword hack is the best-known example of this kind of pattern, but pharma and casino spam behave in much the same way.
This step also separates two kinds of damage. Some URLs are pure spam and should disappear. Others are your real pages whose titles and descriptions in Google were replaced with spam while the site was infected. Those need to be recrawled, not removed, and they are handled differently.
Step three: give every spam URL a clear answer
Each spam pattern needs a server response that says, without ambiguity, that the page does not exist. On most hosts that means a few lines in the server configuration or the .htaccess file, so that whole patterns answer with a 410 status instead of WordPress loading a theme page for each one. We then test a sample of URLs from each pattern with a header checker, such as our own redirect and status code checker, to confirm what comes back.
Real pages with spam query strings attached need a different fix. The page must serve its normal content whatever parameters are added, ideally with a canonical tag pointing at the clean address, so Google folds those variants back into the genuine page.
We also look for anything that would stop Google seeing the new answers. A robots.txt rule added during a panicked cleanup, a security plugin that blocks unfamiliar crawlers, or a firewall challenge page served to Googlebot can all hide the 410 from the one crawler that needs to see it.
Step four: take back Search Console
Attackers who run SEO spam often verify themselves as owners of the site in Search Console, so they can submit their own sitemaps and watch how their spam performs. This is easy to miss, because it happens through a small file or a meta tag on your site that looks harmless.
We go through Users and permissions, compare each owner with the people you actually know, and trace any stranger to the verification method they used. Their token comes off the site and their access comes off the property. Then the Sitemaps report: sitemaps you did not create are removed, robots.txt is checked for sitemap lines the attacker slipped in, and a fresh sitemap listing only your real pages is submitted. For a fuller walk through the security side of Search Console, see our guide to the Security Issues report and Manual Actions.
If Google has flagged the site with a security warning, that has its own review process, covered on the Google warning removal page. Removing spam URLs and clearing a security flag are related jobs, but they are separate, and finishing one does not finish the other.
Step five: use the Removals tool where it counts
The Removals tool is useful but limited. Its effect is temporary, it hides results rather than changing what Google has indexed, and it works on specific URLs or URL prefixes rather than thousands of scattered addresses. We use it on the results that do real harm: the ones that appear when people search for your business name, your products or your town, plus any prefix that captures a whole spam folder in one request. Everything else is left to the status codes and recrawling, which is the lasting fix.
Step six: watch it fade
Progress shows up in the Page indexing report as spam URLs leave the indexed count and move into “Not found (404)” or a similar group. That move is good news, not an error to fix. A site: search for the spam patterns gives a rough second view, though its result counts are only estimates. We track both and tell you how the numbers move.
Expect this phase to take a while. Pages that Google rarely revisits can linger long after the busier ones have gone. If a spam URL that had dropped out comes back, or a new pattern appears, we look at the server again before doing anything more in Search Console.
Subdomains and other corners Google can see
Spam does not always live on your main address. Attackers sometimes plant it on a forgotten subdomain, an old staging copy, or a second WordPress install in a subfolder that nobody remembers. If your Search Console property only covers the main https address, those corners can stay invisible to you while Google indexes them happily.
A Domain property, verified through DNS, covers every subdomain and both http and https in one view, which makes it the better choice for this kind of work. Setting one up, if you do not already have it, often reveals spam URLs that the URL-prefix property never showed. Each subdomain then gets the same treatment as the main site: confirm it is clean, set the right status codes, and check its sitemaps.
Why mass redirects and deletion requests backfire
Owners in a hurry often reach for the biggest lever available. Pointing every spam address at the home page, or submitting hundreds of single removal requests, feels productive. In practice it tends to muddy the signals Google relies on, and it leaves you with no clear way to tell whether progress is real. A small number of well-tested server rules, a clean sitemap and a handful of targeted removal requests usually get further, more quietly.
What you can do in the meantime
- Avoid changing your genuine page addresses right now. Moving real URLs while Google is re-reading the site makes it much harder to tell old spam from relocated pages.
- Keep a short list of the spam searches that worry you most, such as your brand name next to “casino”. That list is what gets targeted first.
- If you run search ads, check any notices in the ad account, since a hacked landing page can cause ads to be paused.
- Give us user access to Search Console rather than sharing your Google password.
Getting traffic and rankings back once the index is clean is its own topic. Our post on getting search traffic back after a hack explains what to look at once the spam is out of the way.
Handing it over
Send us the site address, two or three of the spam searches that bother you, and Search Console access if you can add us as a user. If spam is still appearing, treat it as live and open your WhatsApp message with the word HACKED. Server rules are only changed after a backup, and we give you an honest view of what Google is holding and when we can begin, then keep you updated on WhatsApp as the spam drops out. Any underlying cleanup that is still needed runs through our WordPress malware removal service.