Spammy pages on a hacked website: what to do

If Google lists pages on your domain about online casinos, cheap pills, loans or products written in Japanese, someone has added them to your site to borrow its good name. You need to do three things: close the hole they came in through, delete every page they created, and help Google forget those addresses. This guide is about that last part as much as the first two, because that is where owners usually get stuck.

How these spam pages get there

This kind of hack is often called URL injection or a keyword hack. An automated tool breaks into the site, usually through an outdated plugin, theme or admin password, and creates hundreds or thousands of new pages. Each page is stuffed with words for something people search for, plus links to the spammer's own sites. Your domain has years of history with Google, so the spammer hopes his pages will be found faster on your address than on a brand new one.

The pages are often built to stay out of your sight:

They are not in your menu and not linked from your real pages.
Some only show the spam to Google's crawler and show visitors a normal page or an error.
Some redirect visitors who arrive from Google to another site, while you, typing the address, see nothing odd.
They may live in a folder with a dull name, or be generated on the fly from a few lines of code hidden in a real file.

So "I looked at my site and it is fine" does not settle it. Google's view is what counts here.

Finding every spam page

Start with Google itself. In the search box, type site:yourdomain.com followed by a word the spam uses, for example site:yourdomain.com casino or site:yourdomain.com viagra. Then try just site:yourdomain.com and scroll through the results page by page. Write down the patterns you see: a folder name, a style of address, a language.

Then use Search Console, Google's free tool for site owners:

Pages (under Indexing) shows how many of your pages Google knows about. A five-page business site with several thousand indexed pages is a clear sign.
Sitemaps shows which sitemap files Google has received. Hackers sometimes submit their own sitemap listing the spam pages. Remove any you did not add.
URL Inspection lets you paste one spam address and click Test live URL, then View tested page. That shows what Google receives, which may differ from what your browser shows.
Settings, then Users and permissions. Some hacks add the spammer as an owner of your Search Console property so they can manage "their" pages. Remove anyone you do not know, and also remove their verification (often a small file or a tag they added to your site), or they can come straight back.

If you have not set Search Console up yet, how to check if Google has your website explains the basics.

Removing the pages

First close the way in: change the passwords for hosting, the site admin and the email they reset to; update the site's software; delete unused plugins and themes; remove unknown admin users. If you skip this, deleting the pages is wasted effort because they return.

Then remove the spam itself. A clean backup from before the hack is usually the fastest route. If you clean by hand or a host does it for you, the important thing is what a spam address returns afterwards.

What the spam addresses should return

This is where well-meant cleanups go wrong. After the cleanup, every spam address should answer with "404 Not Found" or, better, "410 Gone". Both tell Google the page no longer exists, and Google drops it over time.

What you should not do:

Do not forward the spam addresses to your home page. It looks tidy, but Google can treat it as a soft error and keep the address around longer, and it ties your home page to the spam.
Do not block the spam folder in robots.txt. That stops Google from visiting the addresses, so it never sees they are gone and can keep them listed for a long time.
Do not leave them returning a normal page that says "not found" with a "200 OK" status underneath. Google sees a working page. You can check the status in URL Inspection.

If your site runs on a builder or hosting you do not control directly, ask the support team to confirm that the old spam addresses now return 404 or 410.

Getting them out of Google faster

Google will drop the dead addresses on its own as it revisits them, which can take weeks for a large batch. Two things help:

The Removals tool in Search Console hides addresses from search results for about six months. You can enter a single address or a folder prefix, which is ideal when all the spam sits under one folder. It does not delete anything, it only hides, so the pages must be gone for real underneath.
A request for review, if Search Console shows a hacked-site issue under Security issues. Explain what you found, what you removed and how you closed the way in.

Do not submit the spam addresses to Google for indexing to "make it notice". Let it find the 404s at its own pace and use Removals for the ones that show up in searches for your name.

When the old hack keeps showing up in reports

Months later you may still see the odd spam address in Search Console, listed as "Not found (404)". That is normal: Google remembers addresses it once saw and checks them now and then. A 404 for a page you never meant to have does no harm. It is a problem only if those addresses start returning content again.

The same goes for any website change. If you move to a new site later, there is no reason to forward the old spam addresses. Forward your real old pages, and let the spam ones stay dead. Old page addresses and why forwarding them matters explains how to keep the addresses that earned you customers.

When repairing stops being worth it

If the site has been hacked more than once, runs on software that nobody updates, or was built by someone you cannot reach, each cleanup buys only a few months. At that point a fresh site on a simpler setup is often cheaper than another round of repairs. The words and photos on your real pages can be carried over, while the hacked software is left behind.

What to do this week

Search site:yourdomain.com plus a spam word and see what Google has.
In Search Console, check Pages, Sitemaps and Users and permissions for anything you did not add.
Change your hosting and admin passwords and update or remove every plugin.
After the cleanup, test a few spam addresses and make sure they return 404 or 410.
Use Removals for spam that appears when people search your name.
If you would rather leave the hacked site behind, you can see your site rebuilt from its real pages before you decide anything.