Spam URLs Still in Google After Cleanup: What to Do Next

Last reviewed: May 18, 2026

One of the most frustrating post-cleanup moments is seeing hacked or spam URLs still showing in Google even after the pages are gone from the live site. That does not automatically mean the cleanup failed. It often means Google has not fully recrawled the affected URLs yet, or that the removal signal being returned is weaker than site owners think.

This guide explains what to do next when spam URLs are still visible after a cleanup and how to avoid the most common removal mistakes.

Start with the live HTTP response

If the hacked URL no longer exists, the live response should usually be a real 404 or 410. Google’s removal guidance is clear on this point: cleanup at the source matters first. A temporary removal request without source cleanup does not solve the indexing problem long term.

What to inspect first

• Live response code. Make sure the spam URL is truly gone and not soft-redirecting somewhere generic.
• Residual route patterns. Some hacked URLs still resolve through catch-all routing.
• Cached internal links or sitemaps. Do not keep feeding bad paths back to crawlers.
• Search Console removal requests. Use them as an accelerator, not as the whole fix.
• Broader compromise scope. If new spam URLs keep appearing, the incident is not actually closed.

Do not use URL removals as a substitute for cleanup

Google’s guidance has been consistent for years: removal requests are useful after the source problem is fixed, especially for hacked URLs you want hidden quickly, but they do not replace real remediation. If the page is still accessible or keeps reappearing, it can return to search results.

Common mistakes

• Removing only the visible symptom. The route or injected content may still exist elsewhere.
• Returning a soft redirect instead of a true missing response. That weakens the cleanup signal.
• Submitting removals before fixing the source. The bad URLs can come back.
• Treating one cleaned page as proof the whole incident is closed. Re-check the wider URL pattern.

Production checklist

• Confirm hacked URLs return a clean 404 or 410.
• Check for catch-all routes that still make spam paths resolve.
• Remove any internal references or sitemap traces of the bad URLs.
• Use Search Console removals only after source cleanup is complete.
• Verify that no new spam URL families are still being generated.

References and further reading

• Google Search Central: Remove your site information from Google
• Google Search Central Blog: URL removal explained, Part IV