How to use 410 Gone to kill hacked redirect URLs in WordPress
Quick answer
Serve HTTP 410 Gone (not 404, not 301) for every hacked URL pattern. 410 tells Google the URL is intentionally and permanently removed, which de-indexes it in days instead of months. Combine 410 rules in .htaccess or Nginx with a clean sitemap, then request removal in Search Console for the worst offenders. We used this exact SOP on a UK agency network in August 2025 to drop 4,200 spam URLs from Google in under 14 days.
Why 410 beats 404 and 301 after a hack
404 Not Found tells Google the URL might come back. Google keeps re-crawling it for months and the spam stays in search results.
301 Redirect to your homepage looks tidy but Google treats it as a soft 404 and may penalise the destination for thin or irrelevant content.
410 Gone is a permanent removal signal. Google drops the URL from the index far faster, usually within one to two crawl cycles.
After the August 2025 UK agency network hack we tested all three on matched samples. 410 cleared the index in 9 to 14 days. 404 was still showing spam after 60 days.
Symptoms that mean you need this SOP
site:yourdomain.com in Google shows pharma, casino, or Japanese SEO spam pages you never created.
Search Console shows a sudden spike in indexed URLs that match patterns like /shop/, /goods/, /?p=12345, or /xmlrpc.php?...
Logged-out users get redirected to a third party domain via a 302; logged-in admins see the site normally.
Sitemap is suddenly ten times larger and full of URLs you do not recognise.
Step 1: Inventory every hacked URL pattern
Export the indexed pages report from Search Console and filter by the hacked pattern.
Pull server access logs for the last 30 days and grep for spam slugs and 302 responses.
Run Screaming Frog in list mode against the spam URL list to confirm the current HTTP status of each.
Group URLs into patterns so a few rules cover thousands of URLs.
Step 2: Serve 410 Gone at the server level
Apache htaccess: RewriteEngine On then RewriteRule for the hacked path with the G flag, which emits 410 Gone.
Nginx: a location block matching the hacked prefixes that returns 410.
Cloudflare Workers: respond with a 410 Gone Response for matched paths when you do not own the host config.
Verify with curl head request and confirm the 410 Gone status in the response.
Step 3: Clean the sitemap and request removal
Regenerate the sitemap so it contains only legitimate URLs.
In Search Console, submit a Removals request for the top 10 to 50 worst spam URLs to accelerate de-indexing.
Resubmit the clean sitemap. Watch the Pages report; the Not found 410 bucket should grow and the Indexed bucket should shrink to clean URLs only.
How we proved this on the UK agency network in August 2025
An agency we white label for had 11 client sites hit by the same 302 redirect malware. 4,200 spam URLs across the network.
We deployed the 410 ruleset within 90 minutes of access. Logs went from 200 OK on spam URLs to 410 Gone within minutes.
By day 9, Search Console showed 3,100 of 4,200 URLs as Not found 410. By day 14, all 4,200 were gone from site search.
Organic traffic returned to baseline by day 21. No clean URL lost ranking.
Common questions
Will 410 Gone hurt my SEO?+
Not for clean URLs you never serve 410 on. For hacked URLs you never wanted indexed, 410 is the fastest way to restore your site's reputation in search.
Should I 410 a real page I deleted on purpose?+
Yes if there is no replacement. If a replacement exists, 301 to it instead. 410 is for content that is permanently gone with no successor.
How long until Google removes the URLs?+
Typically 7 to 21 days after the first 410 response, faster if you request removal manually in Search Console for the worst offenders.
What if the hack keeps creating new URLs?+
Stop the persistence first. See our 302 redirect hack and mu-plugin malware playbooks. 410 only works after the attacker is fully out.
Receipts: real recoveries on this exact issue
Anonymised case files from the WebCare ledger.
Want this handled for you?
Book a call and we will review your site before recommending anything.