After a hacked website: the rebuild, the redirects, and getting the spam out of Google.
The first hour is about stopping the bleeding. The next six weeks are about getting your name back. This is the order the work has to happen in, written from a physician website we rebuilt and relaunched in September 2026.
About eight minutes
Owners of a hacked WordPress site whose name now shows spam in Google
Shaun Wilson
September 20, 2026
Cleaning the files is not the same as cleaning your name.
A compromised WordPress site usually leaves two messes. One is on the server: injected files, rogue admin users, a database full of fake pages. The other is in Google, where thousands of spam URLs under your domain have been indexed and are still being crawled long after the files are gone.
Most advice stops at the first mess. This guide is about the second one, and about the decision that comes before either: whether to clean what you have or rebuild. We covered the immediate steps in what to do in the first hour. This is what comes after.
The examples come from Dr. Stephanie Moore’s website, a physician whose old site was compromised and whose name was carrying gambling and shopping spam in search results.
What to do, in the order it works.
Six decisions, in the order a recovery actually runs.
Decide: clean it, or rebuild it
If the site was old, built by someone who is gone, or you did not like it anyway, a rebuild is often cheaper than a forensic cleanup and gives you a site you actually want. Keep the domain. Replace everything behind it.
Find out what Google thinks you are
Open Search Console and search site:yourdomain.com. Write down the URL patterns the hack created: fake product pages, query-string spam on the homepage, foreign-language directories. Those patterns are your cleanup list.
Answer the junk with 410, not 404
A 404 says “not found, try again later.” A 410 says “gone, stop asking.” For hacked URL patterns, including homepage requests carrying spam query strings, a real 410 is what tells Google to drop them.
Redirect the real pages
Your legitimate old URLs, the ones people linked to and bookmarked, get a permanent 301 to their new home. Not to the homepage. To the page that replaces them.
Launch on a clean host with the doors locked
A fresh account, current PHP, the login limited to the edge network, feeds and comments off if you do not use them, a scheduled backup you have watched run, and a firewall in front of it all.
Submit, request, then wait weeks
Submit the new sitemap, request indexing for the real pages, and check Security Issues and Manual Actions. Then expect the spam count to fall over weeks, not days. Google recrawls tens of thousands of dead URLs on its own schedule.
The spam leaves when the server tells Google it is gone. Not before.
Removal requests are temporary. Correct server responses are permanent.
Rebuild, then inventory the damage.
Dr. Moore’s old site had been compromised badly enough that a rebuild was the honest recommendation. The domain stayed. Everything behind it was replaced: a new host, a new WordPress install, a new identity, and seven pages written for the work she does now.
Before launch we read Search Console and the live search results and wrote down every spam pattern under her name: fake shopping pages, gambling directories, and single-letter query strings on the homepage that the hack had used to serve different content to different crawlers. Tens of thousands of URLs, in a handful of patterns.
410 for the junk. 301 for the real pages.
A small must-use plugin on the new site answers every known spam pattern with a 410 Gone, including homepage requests that carry the spam query strings. The old site’s real pages, the ones a colleague might have linked to, redirect permanently to their replacements.
That split matters. Redirecting spam to the homepage teaches Google that the spam URLs are alive and point somewhere. A 410 teaches it the opposite.
Lock the doors, then let Google work.
The new site launched behind an edge network with the login page only answering to that network, a managed challenge on the login form, feeds and comments switched off, file execution blocked in the uploads folder, and a backup schedule we re-checked after launch because the first one had silently never run.
Then the sitemap went in, indexing was requested for the seven real pages, and Security Issues and Manual Actions both read clean. The indexing report still showed tens of thousands of old hacked URLs three days after launch. That is expected. They fall away as Google recrawls the 410s, and the job is to keep checking weekly for at least six weeks.
410
the response code that tells Google a spam URL is gone for good
301
the redirect for legitimate old pages, to their replacement, not the homepage
6
weeks of weekly monitoring after launch, at minimum
1
domain kept: yours
Before you decide what to do with a hacked site.
Should I just get a new domain?
Almost never. Your domain carries your name, your links and your history. The spam is attached to URLs, not to the domain itself, and correct 410 responses clear it. A new domain starts you from zero and leaves the old one spamming in your name.
Will Google penalize me for the hack?
Google flags hacked sites in Security Issues and can add a warning in results. Once the site is clean and the spam URLs return 410, you request a review and the flag comes off. Dr. Moore’s site showed no issues after relaunch.
How long until the spam results disappear?
Weeks. Google recrawls dead URLs on its own schedule, and a site with tens of thousands of them takes time to work through. Temporary removal requests hide a URL for about six months but do not replace the 410.
Can you do this on my existing host?
Sometimes. If the host is current and the account was not the way in, yes. If the site was compromised through an old PHP version or a shared account, we move it. The case study above moved to a fresh account.
What the recovery produced.
Read the full Dr. Stephanie Moore case study, or start with WordPress repair and recovery if your site is the one that is down right now.
Tell me what Google is showing under your name.
One conversation, one builder, a clear plan for the server and for the search results. The person you brief is the person who does the work.
