How to Remove Hacked URLs from Google

Updated October 2026 · v1.0.1

Spam URLs from a hack stay in results after you restore the site, because Google already crawled them. Removing them in Search Console does not remove the backdoor.

Fix the site, then use Removals for the URLs that should disappear while Google recrawls. URLSweep is the queue for that second step, not a malware cleaner.

Get URLSweep for Chrome

Clean the site before Search Console

If the spam is still being served, a removal expires and the URL comes back.

Take the site offline or restore a clean copy. Change passwords, remove the unfamiliar files, and confirm a spam URL now 404s or 410s.
List the spam URLs. From the hack’s sitemap, Search Console pages, or a crawl. Include only URLs that are no longer supposed to exist.
Request a removal for a sample. Submit one in Removals and confirm the scope is that URL, not your whole site.

Submit the spam list

Paste or upload the list after the server is clean. Preview it. A prefix on / is how people hide their own homepage.

Import the spam URLs. CSV, paste, or the bad sitemap if you are sure every URL in it is spam.
Filter. Drop any real URL that slipped in. Search for your homepage and your main folders.
Run removals. Free is 20 per property. A large hack is a Premium queue plus several days if Google slows the dialog. Pause and read errors.

Security first

URLSweep never logs into your host. It only drives the Removals page you already opened.
Tell your host or a security person about the hack. A removal is not incident response.
Watch the property for new spam URLs after the cleanup.

Frequently Asked Questions

Can I prefix-remove the whole domain?

You can, and you will hide legitimate results too. List the spam URLs.

The spam page is still live. Should I remove it anyway?

Take it offline first. A removal of a page that still returns 200 is temporary.

Does this request indexing of the clean pages?

No. That is GSC Index, after the clean URLs are the ones you want Google to see.