How to Clean Up a Casino Spam Hack in Google: A WordPress SEO Recovery Guide

Aya Saleh · October 23, 2026 · 4 min read

While reviewing a client's Search Console, I found queries no school should ever rank for: casino brands, slot games and betting sites. A UAE education group's WordPress site had been hacked months earlier, and Google still had about 400 spam URLs in its index. One real page was even ranking for a gambling term.

Removing the malware is a security job. Removing the damage from Google is an SEO job. This is the process I used to remove hacked spam URLs from Google search, and it works the same way for casino spam, pharma spam and the Japanese keyword hack.

Step 1: Confirm which spam pages Google has indexed

Start in Search Console, not on the website. In Performance, filter queries containing words like casino, slot, bet or 777. Then switch to the Pages tab with the same filter to see which URLs are getting those impressions.

You will usually find two groups:

Spam pages that never belonged to the site.
Real pages that picked up spam queries because spam links point to them.

A site:yourdomain.com casino search in Google is a quick second check, but Search Console is the source of truth.

Step 2: Build the full list of spam URLs

The Search Console interface caps exports, so pull the full list from three places:

The Search Console API: every page with impressions for spam queries.
The site itself: in WordPress, the REST API lists every real post and page. Anything Google has indexed that is not on that list is a candidate.
Old sitemaps, if the hack injected its own.

For this site the final list was about 400 URLs. Keep them in one sheet with a status column.

Step 3: Return the right status code (410 vs 404 for SEO)

This is where most cleanups go wrong.

Option	Use it?
410 Gone	Yes. Tells Google the page was removed on purpose. Usually dropped faster than a 404.
404 Not Found	Acceptable, but slower.
301 to the homepage	No. It passes spam signals to your homepage and Google may treat it as a soft 404.
Noindex	No. The page has to keep loading for Google to see the tag.

On WordPress with Rank Math, you can create 410 rules in Redirections, using regex for URL patterns so you do not add 400 rules by hand.

Step 4: Watch out for the CDN

Some spam URLs ended in .php. On this site the CDN intercepted those requests before WordPress could answer, so the 410 rules never fired. Google kept seeing the old response.

Two fixes:

Use the Removals tool in Search Console for those URL prefixes. This hides them for about six months, buying time.
Ask the developer to return 410 for the pattern at server or CDN level, which is the permanent fix.

Step 5: Check real pages that picked up spam queries

A real page ranking for a gambling term usually means spam sites are linking to it, or it still contains injected text. Inspect it with the URL Inspection tool and look at the rendered HTML, not just the visible page.

For this cleanup I ran URL Inspection on 89 live URLs through the API to confirm their index status and catch any page Google still saw with spam content.

Step 6: Resubmit and monitor

Submit a clean sitemap that lists only real pages. If you need one fast, see my free SEO tools.
Watch the spam query filter in Search Console every week.
Track the spam URL list until every row shows as removed or not indexed.

Expect weeks, not days. Google needs to recrawl each URL to see the 410.

Step 7: Make sure it does not happen again

The SEO cleanup only holds if the site is secure. This kind of recovery is part of my technical SEO service:

Update WordPress, the theme and every plugin, and delete unused ones.
Remove admin users you do not recognize and reset all passwords.
Turn on file-change monitoring and a security plugin.
Keep off-site backups.

Checklist

Filter Search Console for spam queries and pages.
Build the full spam URL list from the API, the REST API and old sitemaps.
Return 410 for every spam URL, never a homepage redirect.
Handle CDN-blocked URLs with Removals and a server-side 410.
Inspect real pages that picked up spam queries.
Resubmit a clean sitemap and monitor weekly.
Harden the site so it stays clean.

A hacked site can recover fully. The key is treating Google's index as its own cleanup project, with a list, the right status codes and patience. Once the index is clean, the next step is getting real pages back to the top: see how I keep pages from competing in a keyword cannibalization audit.

AEO & GEO