How Can I Fix Duplicate Pages and Indexing Issues in Google Search Console After a Malware Attack?

My wordpress website experienced a malware attack, which resulted in the creation of millions of duplicate pages. These duplicate pages are also showing up as referring pages in the "Links" section of Google Search Console.

To address this issue, I temporarily removed my website from Google Search using the Search Console's removal tool and also unpublished the site. I have now migrated my website to the Ghost platform and set up a new Search Console property. However, this hasn't resolved the issue. Google Search Console still shows 1.33 million pages not indexed and 15,000 pages indexed, even though my website only has 8 pages.

What I have done to fix the issue:

1. Updated the robots.txt file (checked multiple times; no errors found).
2. Updated the sitemap.xml (checked multiple times; no errors found).
3. Cleared the website cache.
4. Removed the old Search Console property and set up a new one.
5. Resubmitted the new sitemap to Google.

Despite these efforts, the issue persists, and Search Console has not updated the indexed page data since June 25, 2024. Additionally, the "Validate Fix" option is not available for this property in Search Console.

What should I do now to fix this issue?

That's something I don't understand either, there are many people who claim to be Wordpress developers for installing themes and plugins, ironically these types of issues usually they say that cannot be fixed because the only solution is to reset the site.

Personally, I'm not an expert, I don't even work with Wordpress, but I can tell you that there must be any solution other than restoring your site.

Anyway, I'm going to try to solve this problem for you. I have seen that you have talked about everything except the plugins, have you installed any plugins recently? Or any theme?

Nulled, especially?

Use GSC to manually inspect a few of the URLs that shouldn't exist. Sometimes, this can give you more specific errors or issues that aren't visible otherwise.

Well, that will take some relatively long time for sure,
Not only you want to remove these pages from the SERPs/GSC,
But you need to get your website out of the radar or/and possible penalties,

If the domain does not have a decent link profile, it's not worth it,
Move on with a different domain/website, it will be faster, easier and more guaranteed to deal with,
Especially in your case with over a million of spam pages created,

If you want to keep and reuse the domain,
You have to make sure everything is cleared up & clean and let google revaluate it (if it does),
You might want to change the website hosting IP as well as it might be flagged,
Then you simply wait, google will take some time to recrawl all of the old pages

Funiki said:

That's something I don't understand either, there are many people who claim to be Wordpress developers for installing themes and plugins, ironically these types of issues usually they say that cannot be fixed because the only solution is to reset the site.

Personally, I'm not an expert, I don't even work with Wordpress, but I can tell you that there must be any solution other than restoring your site.

Anyway, I'm going to try to solve this problem for you. I have seen that you have talked about everything except the plugins, have you installed any plugins recently? Or any theme?

Nulled, especially?

Click to expand...

Thanks for your response @Funiki , The WordPress website is no longer available, as I've migrated my site to the Ghost CMS platform. I'm now using Cloudflare and Namecheap for hosting, and all the previous content has been unpublished.

Also, I’m not using any plugins at the moment.

Since I’ve already moved away from WordPress, what steps would you suggest I take from here to fix the issue? Any advice on what might still be causing Google Search Console to show so many pages, even though the site has only 8 live pages now?

NeedMyLink said:

Use GSC to manually inspect a few of the URLs that shouldn't exist. Sometimes, this can give you more specific errors or issues that aren't visible otherwise.

Click to expand...

Thanks @NeedMyLink for your suggestion, but GSC is not able to inspect these "infected" URLs. It doesn’t provide any specific errors or details for these pages. Any thoughts on what else I can try?

hideath said:

Well, that will take some relatively long time for sure,
Not only you want to remove these pages from the SERPs/GSC,
But you need to get your website out of the radar or/and possible penalties,

If the domain does not have a decent link profile, it's not worth it,
Move on with a different domain/website, it will be faster, easier and more guaranteed to deal with,
Especially in your case with over a million of spam pages created,

If you want to keep and reuse the domain,
You have to make sure everything is cleared up & clean and let google revaluate it (if it does),
You might want to change the website hosting IP as well as it might be flagged,
Then you simply wait, google will take some time to recrawl all of the old pages

Click to expand...

@hideath ,
I’m also considering moving to or using a different domain, especially since dealing with over a million spam pages could take a long time to resolve.

If I do decide to keep and reuse the domain, I'll follow your advice to make sure everything is fully cleaned up and wait for Google to re-evaluate it. I’ll also look into changing the hosting IP to avoid any potential flags.

Appreciate the advice, Thanks.

teqtop786 said:

Thanks for your response @Funiki , The WordPress website is no longer available, as I've migrated my site to the Ghost CMS platform. I'm now using Cloudflare and Namecheap for hosting, and all the previous content has been unpublished.

Also, I’m not using any plugins at the moment.

Since I’ve already moved away from WordPress, what steps would you suggest I take from here to fix the issue? Any advice on what might still be causing Google Search Console to show so many pages, even though the site has only 8 live pages now?

Click to expand...

Good to know that man!!