The common advice says hacked spam pages drop out of Google fast once you delete them, and that a 410 code clears them faster than a 404. Google's own crawler docs say all 4xx errors except 429 are treated the same. On one of my own sites, the cleanup still took weeks, and the spam had been earning most of the clicks the whole time.
Someone added 239 casino and gambling pages to the old WordPress install of a locksmith marketing site I own. Over 16 months of Search Console data, those pages took 174 of the site's 209 Google clicks. That is 83 percent. Every one of the 239 showed up in Google results at least once. After we cut them off with a 410, the last of them stopped showing on October 29, 2026.
- 239 injected spam URLs, and all 239 drew impressions in Google.
- They earned 83 percent of the site's clicks from July 2025 to November 2026.
- In August 2025 alone they took 79 of the site's 85 clicks.
- Five spam pages earned every one of those clicks. One page drew 3,228 impressions by itself.
- We retired the URLs in three passes. Each pass found more.
- From October 30 through November 10, 2026, the spam drew zero impressions.
What Was on the Site
The site sells marketing to locksmiths. It ran on WordPress until August 2026, when we rebuilt it from a clean backup as plain static pages. The rebuild had none of the spam in it.
The spam was not subtle once you looked. Page names offered no deposit bonus codes, free spins, the best slots sites in the United Kingdom and roulette tips. None of it had anything to do with locks or marketing. Google's spam policy calls this page injection, where an attacker adds new pages to a site while the old pages look normal.
That last part is why owners miss it. The home page looked fine. The service pages looked fine. The damage sat at addresses nobody on the team ever typed.
This report doesn't cover how the attacker got in. The old install is gone, so we can't trace it now. What we can show is what the spam did in Google, because Search Console kept the record.
The Spam Was the Site's Best Traffic
I pulled every page and every day from the site's Search Console property, from July 22, 2025 through November 10, 2026. Then I matched the pages against our list of 239 spam addresses.
Where the Site's Google Clicks Went, July 2025 to November 2026
Source, our own Search Console data for the site. 209 clicks in total.
Read that again from the owner's side. If you open the Performance report and see clicks climbing, you feel good. On this site, most of those clicks went to pages that sold gambling to strangers.
Impressions told a smaller story. The spam drew 5,024 of the site's 44,074 impressions, about 11 percent. Clicks are where it won, because a searcher looking for a bonus code clicks the page that promises one.
It also lasted. In August 2025 the spam took 79 of 85 clicks. A year later it was still there. The spam pages drew 234 impressions in August 2026, 273 in September and 262 in October.
How the Cleanup Actually Went
A 410 tells a crawler the page is gone on purpose. We set the spam addresses to answer 410 in three passes, because each time we looked we found more.
| Pass | URLs Set to 410 | Impressions After |
|---|---|---|
| Oct 4, 2026 | 9 | 51, last on Oct 27 |
| Oct 12, 2026 | 142 more | 59, last on Oct 27 |
| Nov 5, 2026 | 88 more | 0 |
Two things in that table matter.
First, the 410 was not instant. The first nine addresses kept drawing impressions for 23 days after their 410. The second batch kept going for 15 days.
Second, the last 88 addresses went quiet before we ever set them to 410. They were already answering a plain 404 on the rebuilt site, and their last impression came on October 29. That fits what Google says. A 404 and a 410 both tell its indexing pipeline to drop a page it had indexed. The code matters less than Google coming back to crawl the address.
So the 410 wasn't magic. It was a clear signal, sent late. The real gain came from finding every address and making sure each one answered as gone.
How to Tell If This Is Happening to You
- Open Search Console, then Performance, then Pages. Sort by clicks. Read every address in the top 50. If you didn't write it, find out who did.
- Search your own domain with site in front of it. Google's guide to the Japanese keyword hack suggests the same check. Casino, pharma and foreign language pages are the usual cargo.
- Check the Security Issues report. It's in the same Search Console menu. An empty report doesn't prove you're clean, but a flag there settles it.
- Look at your users in Search Console. Google's hack guide warns that attackers often add themselves as owners. Remove anyone you don't know, and their verification file.
- Ask why traffic looks better than business. If clicks rose and calls didn't, the clicks may not be yours.
What to Do About It
- Clean the site first. Back it up, reinstall the core files, remove what you don't recognize, and change every password. Google's hack cleanup guide walks through it step by step.
- Build the full list before you act. Export the spam pages from Search Console and keep adding as new ones show up. Our three passes cost us weeks.
- Make every spam address answer 404 or 410. Pick either. Google treats them the same. Don't send them to your home page with a redirect, which keeps the address alive.
- Keep them out of your sitemap. A sitemap that still lists spam asks Google to come back for it.
- Use the Removals tool only for the worst few. Google says a removal lasts only about six months. The 404 or 410 is what makes it stick. Google also says not to use robots.txt to hide pages you want gone.
- Watch the Pages report weekly until it reads zero. On our site that took until October 30.
If something like this has hit a site you run, the desk wants to hear it. Send us a tip, or read the other reports on the hacked sites beat and the link farm that hid its pages from Google.
What We Got Wrong
We rebuilt the site in August and assumed the spam left with the old install. It didn't. Google kept showing those addresses for another two and a half months, and we didn't list them until October.
We also retired them in pieces. Nine, then 142, then 88. One full export on day one would likely have caught them all in a single pass.
Common Worries
Will hacked spam pages hurt my real rankings?
Google lists hacked content as a spam policy issue, and it can flag a site in Search Console. On our site the real money pages ranked poorly while the spam was live. We can't prove the spam caused that, so treat it as a risk to clear, not a known penalty.
Is a 410 better than a 404 for hacked pages?
Google says all 4xx codes except 429 are treated the same, and both remove an indexed page. On our site, pages left at 404 dropped out before their 410 arrived. Use whichever your server makes easy.
How long do spam pages stay in Google after cleanup?
On our site, 15 to 23 days after a 410, and longer when nobody had listed them yet. It depends on how often Google comes back to crawl each address.
Should I use the Removals tool for every spam URL?
No. A removal hides a page for about six months and then ends. The lasting fix is the page answering 404 or 410. Save the tool for the few pages that hurt the most.
Records Behind This Report
The click, impression and date figures are ours, from the site's Search Console property, July 22, 2025 through November 10, 2026, and from our change log of the three 410 passes.
Go to the Source
- Google Search Central, How HTTP status codes, and network and DNS errors affect Google Search, accessed November 2026.
- Google Search Central, Spam policies for Google web search, the section on hacked content, accessed November 2026.
- Search Console Help, Removals and SafeSearch reports tool, accessed November 2026.
- web.dev, Fix the Japanese keyword hack, accessed November 2026.