Spam Pages in Google Under Your Domain? How to Find and Remove Ghost URLs (2026)

If Google Search Console shows pages on your domain that you never created, such as product pages for drain cleaners, garden plants or spare parts, first check whether they still open. If they return a 404 error for every visitor, your site is most likely clean and Google is remembering old spam URLs. Answer them with a “410 Gone” status, check for hidden signs of a hack, and use the Removals tool for the worst ones. If they open, or redirect somewhere, your site is hacked and needs cleaning before anything else.

This guide is written by Kolchi In One (KIO), a digital agency that builds and maintains websites, CRMs and AI agents for clients in the Middle East, Europe, Asia and North Africa. We wrote it after finding exactly this problem in a Search Console account we manage, our own.

What we found

When we reviewed kolchiinone.com in Google Search Console, the list of pages Google showed in search results looked strange. Next to our home page were 77 URLs that had nothing to do with us, with names like /Dredging-Agent-Powerful-Drain-Cleaner-For-Kitchen-Sinks-1149064/ or /Banner-Flag-2x2-Ft-Music-Poster-934574/. Most of the “search queries” were for unrelated products. Over the previous two months, these ghost pages drew more clicks than our real pages.

That is a problem even if nobody can see the pages: your reports become useless, your traffic numbers look higher than they are, and a visitor who clicks lands on an error page under your brand.

Step 1: Do the spam pages still open?

This single check decides what kind of problem you have. Open three or four of the URLs:

• In a normal browser window, and in a private window.
• From a Google search result, because some hacks only show spam to visitors who arrive from Google.
• As Googlebot: in Search Console, paste the URL into URL Inspection and click Test live URL. Some hacks show spam only to Google’s crawler (“cloaking”).

If every test gives your normal “page not found” page, the pages are gone. If any test shows a product page, a redirect to another site or a strange language, your site is hacked now. In that case, skip to the section on active hacks below.

In our case, every test returned a 404 error. The pages did not exist on the site.

Step 2: Check for hidden signs of a hack anyway

A 404 is good news, but it does not prove the site is clean. Spend fifteen minutes on these checks:

1. Users: in WordPress, Users. Delete any administrator you do not recognise.
2. Plugins and themes: anything you did not install, or a plugin with an odd name, is a red flag.
3. Uploads folder: in your hosting file manager, wp-content/uploads should hold images and documents, never .php files.
4. The .htaccess file and the web root: look for rules that redirect visitors or files you cannot explain.
5. Sitemaps: open yoursite.com/sitemap_index.xml (or sitemap.xml) and check that only your real pages are listed.
6. Database: search your posts and pages for the spam words. Hidden posts are a common trick.
7. Search Console, Security and Manual actions: Google tells you there if it detected hacked content. See the Manual actions report help.

On our site all seven checks were clean. The most likely explanation is that these URLs date from before our current site, or were pushed to Google by spammers who link to random domains, and Google kept them in its records.

Step 3: Tell Google the pages are gone for good

A 404 means “not found”. A 410 means “gone, and not coming back”. Google’s documentation on how HTTP status codes affect its crawlers explains that pages returning these errors are dropped from the index; a 410 states the intent clearly, so it is the right answer for URLs you know will never exist.

The safe way is to return 410 only for URLs that match the spam pattern and are already 404. Our spam URLs all had capital letters and ended in a number, while real WordPress addresses are lower case. So we added a small rule: if a page is not found, and its address has a capital letter and ends in a dash and digits, answer 410. Real pages never match, and the rule can be removed by deleting one file. A developer can do this in a few minutes on WordPress, or with a rule in your server configuration.

Do not do this the other way round, for example by redirecting all spam URLs to your home page. Google treats mass redirects to the home page as “soft 404s”, and visitors are confused.

Step 4: Speed up the cleanup

• Removals tool: in Search Console, the Removals tool hides a URL or a whole URL prefix from Google results for about six months while the 410 does its permanent work. Use it for the URLs that still get impressions.
• Do not block the spam URLs in robots.txt. It sounds logical, but if Google cannot crawl them, it cannot see the 410, and they stay listed longer.
• Resubmit your real sitemap so Google spends its time on the pages that matter.
• Filter your reports: until the ghosts disappear, filter them out in Search Console (Page, exclude the pattern) so you can see your real performance.

If the spam pages do open: an active hack

This is the classic “Japanese keyword hack” or “pharma hack”: thousands of auto-generated pages added to a site to sell products, often shown only to Google. Google’s partner site web.dev has a full guide on fixing the Japanese keyword hack. In short:

1. Take a full backup of files and database before you change anything.
2. Change every password: hosting, WordPress admins, database, FTP, and turn on two-factor login.
3. Remove the injected files and database entries, then reinstall WordPress core and every plugin from clean copies.
4. Update PHP, WordPress, the theme and all plugins. Many of these hacks enter through an old plugin; our PHP2Shell website check covers the most recent flaw.
5. Return 410 for the spam URLs, then request a review in Search Console if Google flagged the site.

What this taught us about reading analytics

At first glance, our Search Console said traffic had collapsed over two months. Once we removed the ghost pages, the picture was different: our real home page had grown from about 280 to 450 impressions per 28 days, at an average position near 5.7, while the spam URLs were the ones fading away. Always split real pages from noise before deciding whether you are doing better or worse.

If your Search Console looks wrong, or your site was built by someone you can no longer reach, this is the kind of maintenance we do. See our services, or read how to choose a digital agency first.

Frequently asked questions

Do spam URLs in Search Console mean my site is hacked?

Not always. If every URL returns a 404 for normal visitors and for Googlebot, and your files, users and database are clean, it is usually old spam that Google still remembers. If the URLs open or redirect, the site is hacked.

Should I use 404 or 410 for spam pages?

Both lead Google to drop the pages. A 410 says clearly that the page is gone for good, which is why we use it for spam URLs, and only for URLs that match the spam pattern.

How long until the spam URLs disappear from Search Console?

It depends on how often Google re-crawls them. Expect a few weeks for most, longer for rarely crawled ones. The Removals tool hides them from results in the meantime.

Will these ghost pages hurt my rankings?

Pages that return 404 or 410 do not count against your real pages. The real risk is an active hack, which can get the whole site flagged.

Can KIO check my website and Search Console?

Yes. We test the URLs as a visitor and as Googlebot, check files, users, database and sitemaps, set up the 410 rule when it is safe, and explain what we found in plain words. Write to us on WhatsApp at +212 688 445 399 or through the contact page for a free 15-minute call.