First, I wish you all a pleasant weekend.
I have a unique situation. My client's website was hacked before working with me, and now I'm trying to fix it to the best of my abilities.
We started working on 19th August 2023. The site was hacked around 15th June 2023, I believe. At least, that's what the data says.
The site is using WordPress. They used an unlicensed (you know what I mean) SEO plugin, and the hacker managed to create random files ending with .htm and .do, and submitted (somehow) 316,000 fake URLs to Google. I think they changed/edited the sitemap; that's how this must have happened.
Not only that, but the hacker managed to change the canonical URL of entire pages. There are like 50,000 errors on GSC right now.
Now, I have fixed everything I can think of. The site is clean right now. Our next problem is to remove these submitted unreal/fake URLs. They are killing the entire SEO process, the site went from 400-500 hits a day to 50s... Most of the ranks are lost and most of the pages are gone from the results. The funny thing is Google indexed these fake URLs and allowed this. I can't share the website name because owner asked me not to.
It was 125,000 URLs added and 200,000 not added at first. I tried redirecting everything ending with a .htm and .do with a 301 to the homepage. This didn't do anything. As mentioned, it went up to 316,000 ULS in time.
The next step was disallowing .htm and .do files from the robots.txt file. And this didn't do anything either. Google was still indexing these fake/false pages.
The next step was another approach. I removed disallows from robots.txt and removed the 301 redirecting. I let crawlers get to those fake .htm and .do pages, resulting in a 404 page. Because they are fake, not present. The site contains only 475 real URLs. I also made .htm, and .do pages signal a 410 content deleted header.
Currently, all of the canonical problem is fixed. Google currently reads all of the real/existing URLs correctly. They were broken, too...
But fake URLs ending in .htm and .do are still at 312,000. I'm glad 4,000 got deleted after the 410 header, but what else can I do? Can you guide me here, guys?
Note: I deleted the unlicensed theme and all plugins, and did a full virus scan from cPanel and Imunify360. Also cleaned the database. I also didn't forget to check and clean the root folder. We have bought licensed theme and plugins. I even changed the server (hosting). Fixed all titles/headers/descriptions, and technical SEO aspects as well. Currently, I'm fixing the content one by one. I even fixed keyword canib. and duplicate content issues.
I asked some friends about this situation, but they told me to change the domain or start from scratch.
What else can I do? This is the first time I have seen this...