Ranking Recovery · Part 3
The button that looks like the answer
You have thousands of spam addresses in Google under your domain. Search Console has a section called Removals, with a red button marked New Request. It looks like exactly what you need.
It is useful, and it is not what most people think it is. The removals tool hides results. It does not delete anything from Google’s index, and what it hides comes back unless the real removal has happened by the time the request expires. Used as the first step in a sequence, it buys you time. Used as the whole plan, it buys you about six months and then returns the problem.
What the Google Search Console removals tool actually does
A removal request does two things, both temporary.
- It stops the address from appearing in Google’s search results for roughly six months.
- It clears Google’s stored copy and snippet of the page.
It does not remove the address from the index. It does not stop Google crawling it. It does not change what your server answers. After the period ends, the address is eligible to appear again, exactly as before, unless something else has changed in the meantime.
Google’s own wording is that this is for urgent, temporary blocking while you do the permanent removal. The permanent removal is your server answering that the page is gone.
Temporary hiding against real removal
| Removals tool | Server answers “gone” | |
|---|---|---|
| Takes effect | Usually within a day | When Google next fetches the address |
| Lasts | About six months | Permanently |
| Removes from the index | No | Yes |
| Works on addresses Google never fetched | Hides them from results | Only once they are requested |
| Needs you to keep doing something | Renew, or it lapses | Keep the rule working |
The two are meant to be used together. Hide what the public can see now. Make the server answer correctly so that, when the hiding lapses, there is nothing left to show.
When the tool is the right move
There are good reasons to use it straight away.
Customers are seeing the spam. If a search for your business name returns pharmacy pages or a foreign-language shop under your domain, that is costing you trust every day. Hide it.
The content is harmful. Pages leading visitors to malware or scams should come out of results immediately, whatever else is going on.
The pattern is tidy. The tool accepts a prefix, so one request can cover every address that begins a certain way. If all the spam sits under one folder, a single request hides the lot.
When it does not help
When the spam has no common prefix. Many injections use a query string on your real pages — the same path with a different code on the end. A prefix request broad enough to catch those would also hide your own pages.
From the case file. The spam addresses on this domain were the site’s own homepage with a parameter attached: a question mark, a letter, and a random token. Nearly five thousand distinct tokens turned up across twenty captured pages. No prefix could separate them from the real homepage, so bulk removal by prefix was never an option. The permanent route was the only route.
When the pages are not indexed anyway. Most spam addresses in a large injection sit in the not-indexed part of the report. They are not appearing in results, so there is nothing for the tool to hide.
When the server is still serving the pages. Hiding a page that still exists is the six-month loan with nothing done to repay it.
The sequence that works
- Confirm the cleanup. The files and the mechanism that generated the pages are gone.
- Make every spam address answer 410. That is the status code for “gone, deliberately.” A 404 also works in the end, but 410 is clearer and is acted on sooner.
- Check that nothing in robots.txt blocks those addresses. Google has to be allowed to fetch them to see the 410.
- Then use the removals tool for whatever is visibly harming you in results.
- Verify the 410 from outside your own browser, and keep verifying.
Done in that order, the temporary hiding covers the gap while the permanent removal takes effect. By the time the request expires, Google has fetched the addresses, been told they are gone, and dropped them.
The other tabs in the Removals report
The report has three tabs, and only the first is yours to drive.
Temporary removals is the one described above.
Outdated content lists requests made through a public tool that anyone can use to report a result whose page has changed or vanished. After a hack you may see entries here that you did not create. That is other people reporting your spam. It is a good sign.
SafeSearch filtering lists pages reported as adult content. Injected spam sometimes lands here. Once the pages are gone, so is the issue.
What about the request that says denied?
Requests are sometimes refused or cancelled. The usual reasons are that the address is not on a property you have verified, that the same request is already active, or that the address was written with a typing error. Check that you are working in the right property: the version with and without “www,” and with “https,” are treated as different unless you verified the whole domain.
Do not mistake quiet for finished
The danger of the removals tool is how well it works at first. The spam vanishes from results within a day. The pressure eases. The owner moves on to other things. Six months later the requests lapse, and if the server-side rule was never put in place — or was put in place and later broke — the pages reappear as though nothing had been done.
Put a date in your calendar five months after each request. On that date, check what your server answers for those addresses. If it is still 410, you have nothing to renew.
Whether the addresses are truly gone or only hidden is something you can establish. A Recovery Review checks what the live server answers for each spam address and what Google is still holding against the domain.
Start a Recovery ReviewPaid assessment · scope agreed up front
Back: Google Ranking Drop After a Hack: What Was Actually Lost
Next: Google Search Console Crawl Errors After a Hack: Which Ones Are Good News
Hub: Ranking Recovery Blog Series
ProVAE builds and recovers websites in Douglas, Georgia, serving South Georgia.