Quick answer
To remove hacked spam pages from Google: clean the infection so the pages return 404 or 410, remove the spam URLs from your sitemap, submit the correct sitemap in Search Console, and use the Removals tool for urgent cases. Google drops the pages as it recrawls the now-missing URLs — but only after the site is genuinely clean.
Key takeaways
- Clean the hack first — removing listings while the pages still exist won't stick.
- Serving 404/410 on the spam URLs tells Google to drop them.
- The Removals tool is a temporary speed-up, not a substitute for cleaning.
One of the most visible effects of an SEO-spam hack is Google filling with pages you never created — often thousands of them, under your domain. Getting them out of search takes the right order of operations.
Clean the site first
Removing listings while the spam pages still exist is pointless — Google will just re-index them. Remove the injected pages and the backdoor generating them before anything else.
Make the URLs return 404 or 410
Once the spam is gone, those URLs should return a 404 (not found) or 410 (gone). That's the signal Google uses to drop them from the index as it recrawls.
Fix your sitemap
Regenerate a clean sitemap containing only your real URLs and submit it in Google Search Console. Remove the poisoned sitemap the hack may have created.
Use the Removals tool for urgent cases
Search Console's Removals tool temporarily hides URLs while Google recrawls. It's a speed-up for urgent situations, not a permanent fix — the cleanup is what makes it stick.
Monitor recovery
Watch the indexed-pages count in Search Console over the following weeks. It should fall back to your real page count as the spam drops out and your genuine pages return.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
Clean the site so those URLs no longer exist (returning 404 or 410), submit an updated sitemap, and use Search Console's Removals tool for temporary urgent hiding while Google recrawls.
Keep reading
How to Detect and Remove a Credit-Card Skimmer in WooCommerce
A card skimmer quietly steals customer payment details at checkout. Here's how to detect and remove one from WooCommerce.
Website Suspended by Your Host? How to Get It Back Online
If your host suspended your account for malware, here's how to clean the site to their standard and get it reactivated.
How to Request a Google Security Review After a Hack
Cleaned the hack but Google still warns visitors? Here's how to request a security review and get the warning lifted — the right way.