In today’s digital world, it is more important than ever to maintain a clean and reputable online presence. However, cyber threats like content cloaking hacks can make this difficult. These hacks can lead to an influx of spam pages infiltrating Google Search results, which can damage your website’s reputation and drive away legitimate traffic
If you’ve been hacked and your website is now infested with spam pages, don’t panic. There are steps you can take to remove them from Google Search. In this blog post, we’ll walk you through a systematic approach to removing injected spam pages from Google Search.
What are injected spam pages?
Injected spam pages are pages that have been added to your website without your knowledge or permission. They are often created by hackers who use content cloaking techniques to inject malicious code into your website. You will usually see tons of Japanese keywords or illegal pharmaceuticals on the search results when searching for your website. This code can then be used to redirect visitors to spam websites, steal personal information, or even spread malware.
Understanding Google Search Console
Google Search Console is a free tool that helps website owners monitor and optimize their website’s presence in Google Search results. It’s an essential tool for any website owner, but it’s especially important if you’ve been hacked and your website is now infested with spam pages.
Conducting an Initial Audit on Search Console
The first step is to assess the authenticity of authorized site owners. Spammers often verify themselves as site owners in Google Search Console in order to submit sitemaps of injected spam content. This allows them to get their spam pages indexed by Google and appear in search results.
- Verify all authorized users in Google Search Console. This will ensure that only legitimate users have access to your sitemaps.
- Remove any unauthorized entities that may have gained access to your Google Search Console account.
- Monitor your sitemaps for suspicious activity. If you see any sudden changes in the number of pages in your sitemap, or if you see pages that you do not recognize, it is a good idea to investigate further. And remove any recently added unknown sitemaps as well. Only the latest, fresh, and legit sitemap should be there.
Google Search Console Removal Tool
Google webmaster guidelines recommend submitting a sitemap of pages to drop when dealing with a large influx of injected spam pages. This initiates a process where, during the subsequent crawl, Google’s crawler detects a 404 status and gradually removes the pages from search results. This method can take weeks to months for complete removal, it may not always be the most efficient approach, especially for extensive instances involving thousands of pages. If waiting isn’t an option, a more proactive manual removal technique is imperative.
The Google Search Console Removal Tool allows you to quickly and easily drop individual spam pages or in bulk if the pages start with specific keywords or paths. The tool offers two types of removals:
Temporary Removal
This option will drop the specified URL(s) from Google Search results for about six months. It also clears the current snippet and cached version of the page. It takes only 4-6 hours to drop the URL from search results.
Clear Cached URL
This option refreshes a legitimate URL that has been compromised by displaying spam content due to content cloaking. It temporarily removes the indexed content description until the next crawl. The URL(s) will remain in Google Search results, but the current snippet and cached version will be cleared until the next crawl.
To use the Google Search Console Removal Tool, follow these steps:
- Go to the Removals tab in Google Search Console.
- Select the type of removal you want to perform.
- Enter the URL(s) of the pages you want to remove.
- Click Submit.
If you want to find indexed spam pages to remove, type site:your-website.com in the Google Search box. If you notice patterns in the URLs, like all of them starting with the same keywords or path for example:
https://your-website/index.php?rthrsdb.html
https://your-website/index.php?tyhrtdsdb.html
https://your-website/index.php?eyusdb.html,
In this example, they all start with /index.php?, you can remove them together.
Just type https://your-website/index.php? in the input box and select “Remove all URLs with this prefix.” This way, all those pages will be dropped at once.
Make the Removal Permanent
Now that you’ve submitted removal requests for the injected spam pages using Google Search Console, there’s a step ahead. Some pages might still have the status “Crawled, not indexed,” which means they could be indexed soon, even in the next crawl. The complete list of these pages might not be available yet to submit a removal request in advance.
To ensure a permanent removal and prevent upcoming pages from being indexed, it’s important to block their URLs. Once your affected website is cleaned and secured, injected spam pages will display a 404 not found status for both visitors and search crawlers. However, a 410 Gone status is even better than a 404 or a 301 Redirect status. This signals to Google Search Crawler that the page is gone for good and shouldn’t be crawled or indexed anymore.
We recommend utilizing a plugin or adding a regex rule in your .htaccess file to set a 410 Gone status for injected spam pages. This proactive approach guarantees that these pages remain blocked from Google Search results, preventing them from being indexed again.
Dealing with injected spam pages requires a smart and hands-on approach. Google Search Console’s removal tools can help you swiftly clean up your website. For an extra layer of security, use the SecureWP Online Security Checker tool to make sure your website is safe and your WordPress is secure. Remember, keeping your website free from spam isn’t just about reputation – it’s about building trust with your visitors. Get started on your spam-free journey now.
