WordPress Website Recovery After a Large-Scale SEO Spam Attack

93.7% reduction in indexed URLs during the measured recovery period

Client Website's previous WordPress website had been severely compromised by a large-scale SEO spam attack that generated hundreds of thousands of illegitimate URLs. 

By the time the extent of the issue became clear, Google had already discovered and indexed a significant number of these URLs. On June 30, 2026, Google Search Console reported 491,528 indexed URLs — dramatically higher than the legitimate footprint of the website. 

The challenge was no longer simply removing malicious files or fixing the compromised WordPress installation. 

Google had already discovered a massive network of spam URLs, meaning the recovery required both a clean website rebuild and a carefully managed technical SEO recovery strategy.

The Challenge: A Compromised WordPress Website With a Massive Search Footprint

The previous WordPress website had been attacked in a way that allowed large numbers of automatically generated spam URLs to be created. 

The malicious URLs appeared across several structures, including paths and query parameters such as:

• /onlines/41694061914
• /onlines/41633817289?t=41633817503
• /?t=51198610843
• /?w=20260602044116

There were also long encoded query-string variations designed to create additional crawlable URLs. 

Even after the malicious content was removed, Google still knew about these URLs from previous crawls.

That meant replacing or cleaning the WordPress installation alone would not immediately remove the attack footprint from Google.

The recovery had to address both sides of the problem:

the compromised website infrastructure and the historical URLs already discovered by search engines.

Rebuilding the WordPress Website on a Clean Foundation

Rather than continuing to build on top of the compromised environment, the website was rebuilt on a clean implementation. 

The objective was to ensure that the new website had a controlled and legitimate URL structure while isolating it from the historical URL patterns created during the attack.

As part of Anglara's custom WordPress development work, the recovery focused on both the user-facing website and the technical behavior search engines encountered when revisiting historical malicious URLs. 

Legitimate pages continued to work normally, while known malicious URL patterns were handled as permanently removed resources.

The Technical SEO Recovery Strategy

The recovery strategy was based on giving Google clear and consistent signals. 

Rather than redirecting hundreds of thousands of malicious URLs to the homepage, known spam URL patterns were configured to return:

HTTP 410 Gone

A 410 Gone response indicates that the requested resource has been permanently removed.

This allowed Google to continue revisiting URLs discovered during the attack while receiving an explicit signal that those resources were no longer part of the WordPress website

The implementation covered multiple attack patterns, including:

• /onlines/*
• /onlines/*?t=*
• /?t=*
• /?w=*
• /?items_images_*

The compromised URLs were also excluded from the current sitemap and internal linking structure.

Validating the Recovery at Server Level

We did not rely solely on Search Console. 

Known malicious URLs were tested directly against the live server to confirm the production website was returning the intended status.

Tests included attack patterns such as:

• /?t=...
• /?w=...
• /?items_images_...
• /onlines/.... 

The server consistently returned:

HTTP/2 410

This validation was critical: 

A WordPress site may appear completely clean to a visitor while still returning incorrect responses for historical hacked URLs being requested by search engines. 

Direct server-level testing confirmed the cleanup rules were operating as intended.

Analysing the Spam URL Footprint

We also analysed Google Search Console’s exported URL sample to understand how the attack
had been structured.

Among 1,000 example URLs exported from GSC:

999 out of 1,000
matched the two dominant spam URL families:

This concentration helped confirm that the enormous URL footprint was overwhelmingly associated with repeatable spam patterns rather than legitimate WordPress content

Google Began Removing the Compromised URLs

The strongest evidence of recovery came from the Google Search Console indexing data. 

On June 30, 2026, Search Console reported 491,528 indexed URLs. By September 21, 2026, that number had fallen to 30,801 indexed URLs — meaning 460,727 URLs moved out of Google's indexed set during the measured recovery period, a 93.7% reduction in indexed URL count.

93.7% Reduction in Indexed URLs

Why "Not Indexed" Increased During the Recovery

During the recovery process, Search Console also showed a large increase in URLs
categorized as non-indexed.

On June 30:
1,023,468 URLs were reported as not indexed.

By September 21:
1,859,583 URLs were reported as not indexed.

In the context of this recovery, the increase reflected Google progressively processing a very large historical URL inventory created during the attack.

The intended transition was:

Previously Discovered spam URL → Google recrawls the URL → WordPress website returns HTTP 410 → URL leaves Google's active index → URL may remain temporarily in historical GSC reporting.

The key recovery indicator was therefore whether malicious URLs were moving out of Google's active indexed set 

The data showed a substantial reduction.

93.7% Reduction in indexed URL count

The historical spam footprint has not yet disappeared from every Search Console report.
For an attack involving URLs at this scale, Google's cleanup process is naturally gradual.
However, Google’s active indexed URL count has already changed dramatically.

More Than a WordPress Website Rebuild

Recovering a compromised WordPress website does not end when the malicious files disappear.

When search engines have already discovered hundreds of thousands of attacker-generated
URLs, the domain can carry that history long after the visible compromise has been removed.

For Client Website, recovery required a combination of a clean WordPress rebuild, controlled URL handling, HTTP-level verification, Google Search Console analysis and ongoing monitoring while Google progressively reprocessed the historical footprint.

The strongest result is already visible in the data:

491,528 → 30,801 Indexed URLs

A 93.7% reduction in the indexed URL count during the measured recovery period.

The website is operating on a clean foundation while Google's historical record of the attack continues to be progressively processe