Ranking Recovery · Part 9
The honest answer is months
Owners want a date. When will the spam pages be out of Google’s index? The truthful answer is that the ones people can see go fairly quickly, and the last of them take many months, and nothing you can buy changes the second part.
That is not a comfortable answer, but it is a useful one, because most of the damage done during recovery comes from owners who expected weeks, saw months, and started changing things that were working.
What the Google index is
The index is Google’s own stored record of pages: the copy it searches when someone types a query. Around it sits a much larger set of addresses Google knows about and has not indexed — things it found in links, in sitemaps, in old crawls.
After a spam hack, your domain has entries in both. A minority of the spam was indexed. The majority was only ever known about. They behave differently, and they leave on different schedules.
From the case file. Of 8,452 spam addresses on the domain in this series, 900 were indexed and 7,552 were not. Google discovered roughly 4,400 in a first wave and indexed 900 of them. A few days later it discovered about 3,100 more and indexed none: it had recognized the pattern in between and stopped taking them in.
Three groups, three timelines
Group one: indexed spam pages. These appear in search results and are the ones customers see. They also clear fastest, because Google requests indexed pages regularly. Each time it asks and is told 410, it drops the page. Expect most of these gone within weeks of the removal rule going live.
Group two: spam addresses that were crawled and not indexed. Google fetched these and declined them. It rechecks them now and then. They clear over a few months.
Group three: addresses discovered and never fetched. The largest group, and the slowest. Google heard of them through links, never asked for them, and has no particular reason to ask now. A 410 can only be delivered in reply to a request. These wait until Google gets around to them, which can be the better part of a year.
The good news about group three is that it is invisible to the public. Addresses that were never indexed do not appear in search results. They are entries in a report, not pages your customers can find.
What shortens the wait
A few things help, modestly.
- Answering 410 instead of 404. Both end in removal. Google acts on 410 with less rechecking.
- Keeping the addresses crawlable. No block in robots.txt, ever, on addresses you want forgotten.
- Giving Google a reason to request them. Pages of links to the dead addresses, or a temporary sitemap, as described in Part 6.
- A healthy, active real site. Google crawls a site more when it has reason to. Real pages that change and are worth visiting bring the crawler back, and it works through the leftovers while it is there.
What lengthens it
These are the ones that turn months into a year.
A removal rule that breaks. If the rule starts returning a server error, Google is told the problem is temporary and holds on to every address.
A cache that hides the break. You look at the site, it looks fine, and you do not learn the rule failed.
A robots.txt block. Addresses under a block cannot be fetched and therefore cannot clear.
Redirecting to the homepage. Google treats it as a soft 404 and keeps checking.
Rebuilding the site at new addresses while this is going on. Now Google has two sets of changes to work out at once.
From the case file. This recovery hit three of those. The first response was a redirect to the homepage, replaced by a proper removal rule once the logs showed the mistake. That rule broke on 1 March and returned server errors until it was caught, hidden for a time by cached pages. And a robots.txt block on the spam pattern stayed in place for months, freezing several hundred addresses until it was removed in late August. Each one was a reasonable-looking decision. Together they added months. The owner’s own conclusion is that the index recovery took far longer than it needed to.
Does anything you do change Google’s pace?
There is a fair argument that it does not — that Google releases old addresses at its own speed and the owner’s efforts mostly serve to make the owner feel better.
The evidence in this case points to something in between. You cannot speed Google up beyond its own pace. You can certainly slow it down. Every item in the list above is a way of standing in the road. So the work is less about pushing and more about removing obstacles and then keeping them removed.
That is a less satisfying job than pushing. It is also the one that is rewarded.
How to tell it is working
Because the pace is slow, measure it in a way that shows slow movement.
- Once a week, record the indexed and not-indexed totals from the Pages report, with the date.
- Once a week, run a
site:search and note roughly how many spam results remain. - Every few days, test one spam address from outside and confirm it still answers 410.
- Watch your logs for Google’s crawler requesting spam addresses and being told they are gone.
The first two will barely move week to week. Over two months they tell a clear story. The third and fourth tell you today whether the machinery is still running.
When to stop watching
At some point the indexed spam is gone, the public sees a clean site, and what remains is a tail of several hundred never-fetched addresses in a report. That tail may be there for a long time. It is not harming your rankings in any way you can measure, and no further action on your part will hurry it.
That is the moment to check the removal rule on a schedule — monthly is enough — and turn your attention to the part of recovery that is about your real pages. Watching the tail every day does not shorten it. It only keeps the incident at the front of your mind long after your customers have forgotten it.
If months have passed and the indexed spam is not falling, something is in the way. A Recovery Review checks each of the obstacles on this page against your live site and reports which one is holding the addresses in place.
Start a Recovery ReviewPaid assessment · scope agreed up front
Back: Why Is My Website Marked as Unsafe? Clearing Warnings After a Hack
Next: How Do I Improve My Google Ranking After a Hack?
Hub: Ranking Recovery Blog Series
ProVAE builds and recovers websites in Douglas, Georgia, serving South Georgia.