Last week a site I help administer was compromised. A confluence of events (move to new hosting, brand new web application released, etc.) makes it difficult to track down why it happened, but essentially an index1.php file was uploaded to the root of the site's shared hosting. We noticed a lot of spam-like traffic coming in looking like the following:
We deleted the php script, locked down our hosting, disabled PHP (which wasn't necessary in the first place), changed all passwords and performed a thorough security review to ensure this doesn't happen in the future.
Google indexed the site subsequent to the file being uploaded and a site that should have a few hundred indexed pages now has 65K. I need to get these removed to stop visits to these spam links and did the following:
- Updated application to return a 410 in case index1.php is requested
- Added a disallow: /index1.php line to our robots.txt
- Began requesting url removals from google.
Google has been crawling our site but steps 1 and 2 don't appear to have made a difference. The 3rd step (url removal) can be automated to an extent but has a daily limit of ~1000 urls and it would obviously take ~2 months to complete. To add to this, I haven't found a straightforward way to export a list of all indexed URLs and it is a manual and tedious process to actually find these URLs to begin with.
Does anyone have any other suggestions for removing these spam links?
Thank you in advance, JP