1

I keep getting hacked url's index by google when i type site:mydomain.com.au

enter image description here

My site was hacked previously (was using wordpress). Now it uses JavaScript (React/Node) and built from scratch and hosted in a new server.

Only link between old site and new one is the domain name.

My site is doing great in bing search probably because bing does not have indexed all these hacked links under my domain name.

New site has been running for more than 4 month now. None of these hacked url take anyone anywhere except 404 page.

And google wont remove it from its indexing? It's shocking.

None of these links takes to actual page. They all take users to 404 page. Recently i realized that some of these hacked page links were already submitted to remove using remove url tool. They are showing removed but keep appearing in google when i type site:mydomain.com.au

I have heard that page that does not exist is removed from google index automatically in 3 months but thats not true in my case.

I manually click (sometimes use bulk url removal tool) to collect these url and submit to url removal tool. The next few hours or maximum a day It looks clean showing only the valid url's when i type site:mydomain.com.au But then again it starts to appear...

What choice do i have? What's going on and what do i do moving forward?

I have been submitting to remove url for months now. In the new search console it shows that i have removed nearly a million links already..

enter image description here

Why such invalid links are indexed and why they keep re-appearing? Please share your thoughts, experience and possible solutions. Thanks!

Improve this question
5
  • I have no experience with removing any URL via Googles removal tool, however, I do know that a 404 for these pages will keep these URLs in the index to test over and over again until Google finally gives up. This can take more than a year for some. We always recommend issuing a 410 error in these cases if it is even possible. With so many URLs, that may be a difficult or impossible task. Who knows? This is the path I would take. That and patience. Google is notoriously slow. Cheers!!
    – closetnoc
    Oct 9, 2019 at 1:04
  • @closetnoc I had some valid pages but later Changed the URL so they end up returning 404. Those pages didn’t last more than 2 days in google index. But all those hacked urls are indexed forever. How do you explain that?
    – Ryan Dhungel
    Oct 9, 2019 at 2:15
  • 404s generally do not go away quickly. The reason is that 404 are "The requested resource could not be found but may be available in the future. Subsequent requests by the client are permissible." (From: en.wikipedia.org/wiki/List_of_HTTP_status_codes) Google will retry them a number of times as often as the page would normally be crawled. Eventually the pages will be dropped. A 410 "Indicates that the resource requested is no longer available and will not be available again." Google will not retry these pages. A 410 should be used over a 404 when a page is gone.
    – closetnoc
    Oct 9, 2019 at 3:46
  • I cannot explain what you are seeing, I can explain what we experience here. Why Google is not removing your pages may be because of the 404. If it is possible to issue a 410 for these pages, I would certainly do that. I have used 410s for millions of pages before without issue. In my case, it was an easy task since the pages I removed were my own pages from a database. Cheers!!
    – closetnoc
    Oct 9, 2019 at 3:49
  • I will give 410 a try. Thx!
    – Ryan Dhungel
    Oct 9, 2019 at 4:22

2 Answers 2

Reset to default
1

As Jonh Mueller said last year:

From our point of view, in the mid term/long term, a 404 is the same as a 410 for us. So in both of these cases, we drop those URLs from our index.

We generally reduce crawling a little bit of those URLs so that we don’t spend too much time crawling things that we know don’t exist.

If they delayed the crawling to your 404's pages, it might explain why it's taking so much time to be dropped from Google's index.

That happens on sites with thousands of URLs and it could take months in order to let Google crawl and delete all of them. You've been told to use 410 instead of 404 and that's something I've recommended in the past but I believe that, in this scenario, it'll not make any difference:

The subtle difference here is that a 410 will sometimes fall out a little bit faster than a 404. But usually, we’re talking on the order of a couple days or so.

So if you’re just removing content naturally, then that’s perfectly fine to use either one. If you’ve already removed this content long ago, then it’s already not indexed so it doesn’t matter for us if you use a 404 or 410

I'll put my money on applying a 301 redirect cause, on my experience, they are usually faster than 410 but, rather than that, you should be patient.

Update: As those pages are hacked URL's, a 301 redirect will not be recommended.

Improve this answer
3
  • I’m suffering of hacked urls so adding 301 redirect will be bad right? That would make those hacked urls valid which is something I don’t want.
    – Ryan Dhungel
    Oct 10, 2019 at 8:29
  • Good point. In that case, there is nothing else coming to my mind that you could do.
    – Emirodgar
    Oct 10, 2019 at 10:31
  • Make sure you are not redirecting (30X) to your 404 page. That can cause a delay in removal from the index. Also not that a site: search can show URLs that would not normally be shown. It's best to try real world searches to see if they are turelly still being "indexed".
    – Tony McCreath
    Oct 10, 2019 at 23:13
0

One of my websites was recently hacked through WordPress, and to be exact, the malware came through WooCommerce installation. Google blocked my site as harmful. The Google indexing was showing similar as yours.

How you go about:

  1. Thoroughly clean your site. That is, I have a number of domains in my server and this malicious program had reproduced in all my domains some extra error.shtml pages alongside some other file that I did not put in there and that was consistently spread. So find the pattern and clean.

  2. Then, log into Google Search Console. If you have not done so earlier, add your domain address through "+ Add Property". To verify ownership of your site, enter your domain address into the "Prefix" popup. Place the file into your domain. Run the test.

  3. Now you need to write to Google from inside the console, so Google staff will check through the verification file on your site. You will receive an email from them.

  4. As additional precaution you may check some websites to find out if you are black listed.

  5. Prepare a robot.txt file for all the pages that are indexed but do not exist. This will also clean up Google indexing.

In my case, website and indexing was cleaned up between 3-4 days after I vigorously followed up procedures. You need to contact Google.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.