FreeSearch Console + your hostAbout 60 min

Clean Up After a Hack or Spam Links

Sometimes a site gets hacked pages, or spam links point at it that you never built. Both are fixable if you stay calm and follow an order.

By Anthony Limpert, founder of Clickflame

Why This Matters

A swept set of old URLs on our domain held hacked spam pages. We let them stay 404 and had no penalty, and our brand still ranks first. The worst move would have been to redirect all of that junk to our home page.

✓ How To Do It

Find the damage. In Search Console, open Pages and look for URLs you do not recognize. Search your own domain on Google with the site operator and look for odd titles.
Close the door first. Change every password, remove unknown users, update the site software and delete plugins you do not use.
Delete the spam pages from the server. Check the files and the database, because hackers hide in both.
Let the dead URLs return 404 or 410. Do not redirect them to your home page, because you would be sending junk to something good.
Make sure the real error shows. A page that says Not Found but returns 200 is a soft 404, and Google treats it as an error anyway.
Request a review in Search Console if it shows a security issue or manual action. Say plainly what you found and what you fixed.
Check your backlinks for spam you never built. Look in Search Console under Links and watch for one pattern, like hundreds of links from the same odd domains.
Try to get bad links removed first. If you cannot, and there is a clear pattern, make a disavow file with one entry per line and the word domain and a colon in front of whole sites.
Upload it with the disavow tool. We have sent disavow files, and only after finding a clear pattern. Do not disavow because a tool shows a scary score.
Write down what happened, the dates and the fix. Watch Search Console weekly for a month.

Done WhenThe spam URLs return 404, passwords are changed, and a dated incident note lists what was found and what was done.

Reference List

Sources

Tips & Pitfalls

Google says most sites never need to disavow. Use it only for many spammy links that caused or will cause a manual action.
The disavow tool does not work on a Domain property in Search Console. You need a URL prefix property for it.
Do not redirect old dead pages in bulk. Redirect only pages that have a real new home.

Done with this step? Mark it complete to track your campaign progress.