93.7% reduction in indexed URLs during the measured recovery period
Navya Entertainment's previous WordPress website had been severely compromised by a large-scale SEO spam attack that generated hundreds of thousands of illegitimate URLs.
By the time the extent of the issue became clear, Google had already discovered and indexed a significant number of these URLs. On June 30, 2026, Google Search Console reported 491,528 indexed URLs — dramatically higher than the legitimate footprint of the website.
The challenge was no longer simply removing malicious files or fixing the compromised WordPress installation.
Google had already discovered a massive network of spam URLs, meaning the recovery required both a clean website rebuild and a carefully managed technical SEO recovery strategy.
The Challenge: A Compromised WordPress Website With a Massive Search Footprint
The previous WordPress website had been attacked in a way that allowed large numbers of automatically generated spam URLs to be created.
The malicious URLs appeared across several structures, including paths and query parameters such as:
- /onlines/41694061914
- /onlines/41633817289?t=41633817503
- /?t=51198610843
- /?w=20260602044116
There were also long encoded query-string variations designed to create additional crawlable URLs.
Even after the malicious content was removed, Google still knew about these URLs from previous crawls.
That meant replacing or cleaning the WordPress installation alone would not immediately remove the attack footprint from Google.
The recovery had to address both sides of the problem:
the compromised website infrastructure and the historical URLs already discovered by search engines.
Rebuilding the WordPress Website on a Clean Foundation
Rather than continuing to build on top of the compromised environment, the website was rebuilt on a clean implementation.
The objective was to ensure that the new website had a controlled and legitimate URL structure while isolating it from the historical URL patterns created during the attack.
As part of Anglara's custom WordPress development work, the recovery focused on both the user-facing website and the technical behavior search engines encountered when revisiting historical malicious URLs.
Legitimate pages continued to work normally, while known malicious URL patterns were handled as permanently removed resources.
The Technical SEO Recovery Strategy
The recovery strategy was based on giving Google clear and consistent signals.
Rather than redirecting hundreds of thousands of malicious URLs to the homepage, known spam URL patterns were configured to return:
HTTP 410 Gone
A 410 Gone response indicates that the requested resource has been permanently removed.
This allowed Google to continue revisiting URLs discovered during the attack while receiving an explicit signal that those resources were no longer part of the WordPress website
The implementation covered multiple attack patterns, including:
- /onlines/*
- /onlines/*?t=*
- /?t=*
- /?w=*
- /?items_images_*
The compromised URLs were also excluded from the current sitemap and internal linking structure.
Validating the Recovery at Server Level
We did not rely solely on Search Console.
Known malicious URLs were tested directly against the live server to confirm the production website was returning the intended status.
Tests included attack patterns such as:
- /?t=...
- /?w=...
- /?items_images_...
- /onlines/....
The server consistently returned:
HTTP/2 410
This validation was critical:
A WordPress site may appear completely clean to a visitor while still returning incorrect responses for historical hacked URLs being requested by search engines.
Direct server-level testing confirmed the cleanup rules were operating as intended.
Analysing the Spam URL Footprint
We also analysed Google Search Console’s exported URL sample to understand how the attack
had been structured.
Among 1,000 example URLs exported from GSC:
999 out of 1,000
matched the two dominant spam URL families:
The sample contained:
522
Root-level query-string spam URLs
477
/onlines/ spam URLs
1
URL outside the two dominant patterns
This concentration helped confirm that the enormous URL footprint was overwhelmingly associated with repeatable spam patterns rather than legitimate WordPress content
Google Began Removing the Compromised URLs
The strongest evidence of recovery came from the Google Search Console indexing data.
On June 30, 2026, Search Console reported 491,528 indexed URLs. By September 21, 2026, that number had fallen to 30,801 indexed URLs — meaning 460,727 URLs moved out of Google's indexed set during the measured recovery period, a 93.7% reduction in indexed URL count.
93.7% Reduction in Indexed URLs
Why "Not Indexed" Increased During the Recovery
During the recovery process, Search Console also showed a large increase in URLs
categorized as non-indexed.
On June 30:
1,023,468 URLs were reported as not indexed.
By September 21:
1,859,583 URLs were reported as not indexed.
In the context of this recovery, the increase reflected Google progressively processing a very large historical URL inventory created during the attack.
The intended transition was:
Previously Discovered spam URL → Google recrawls the URL → WordPress website returns HTTP 410 → URL leaves Google's active index → URL may remain temporarily in historical GSC reporting.
The key recovery indicator was therefore whether malicious URLs were moving out of Google's active indexed set
The data showed a substantial reduction.
WordPress SEO Recovery Progress
491,528
June 30, 2026
30,801
September 21, 2026
460,727
Fewer indexed URLs
93.7% Reduction in indexed URL count
The historical spam footprint has not yet disappeared from every Search Console report.
For an attack involving URLs at this scale, Google's cleanup process is naturally gradual.
However, Google’s active indexed URL count has already changed dramatically.
Recovery Results
| Metric | Before | After |
|---|---|---|
| Indexed URLs | 491,528 | 30,801 |
| Not Indexed URLs | 1,023,468 | 1,859,583 |
| URLs moved out of indexed set | — | 460,727 |
| Reduction in indexed URLs | — | 93.7% |
Key Outcomes
491,528 → 30,801
Indexed URLs
460,727
URLs moved out of Google's indexed set
93.7%
Reduction in indexed URL count
388K+
Historical unavailable URLs reported by GSC during recovery
HTTP 410
Verified response for identified malicious URL patterns
999 / 1,000
Sampled GSC URLs matched the two dominant attack patterns
More Than a WordPress Website Rebuild
Recovering a compromised WordPress website does not end when the malicious files disappear.
When search engines have already discovered hundreds of thousands of attacker-generated
URLs, the domain can carry that history long after the visible compromise has been removed.
For Navya Entertainment, recovery required a combination of a clean WordPress rebuild, controlled URL handling, HTTP-level verification, Google Search Console analysis and ongoing monitoring while Google progressively reprocessed the historical footprint.
The strongest result is already visible in the data:
491,528 → 30,801 Indexed URLs
A 93.7% reduction in the indexed URL count during the measured recovery period.
The website is operating on a clean foundation while Google's historical record of the attack continues to be progressively processe
