Search Console can continue listing hacked content or harmful resources after visible files are cleaned. The report may refer to a different protocol/subdomain, cached response, generated URL pattern or a page that only changes for Google/search visitors.
Treat each example as evidence, not as a complete list.
Confirm the correct property
Review the Domain property and relevant URL-prefix properties for HTTP/HTTPS, apex/www and subdomains. An old staging subdomain can keep security issues active while production appears clean.
Verify ownership/users in Search Console. Remove unknown users or verification tokens only after preserving evidence and checking legitimate agencies.
Secure the Google account and recovery methods.
Export affected examples
Record issue category, sample URLs, detection/review dates and any described external resources. Group paths by common pattern.
Do not visit every harmful URL in an everyday browser. Use isolated header/content checks and saved network evidence.
Search Console samples are representative; scan and test the broader matching namespace.
Test crawler and visitor differences
Compare responses for logged-out direct, search-referrer, mobile and crawler-like requests under authorised conditions. Record status, canonical, body hash and external domains.
If crawler output differs, inspect rewrites, PHP conditions, database generators and CDN cache keys.
Do not rely on the WordPress editor preview.
Check all delivery layers
Inspect origin files/database, full-page/CDN cache, Workers/redirects, DNS and service workers. Verify every web node.
Remove the generator before purging cached examples. Return honest 404/410 for nonexistent malware URLs.
Check sitemaps, feeds and internal links that continue advertising removed paths.
Audit sitemap and verification artefacts
List every sitemap submitted in Search Console and every sitemap URL advertised in robots.txt. Remove attacker-created sitemap references only after preserving them and confirm the SEO plugin generates the expected language/content indexes.
Review HTML-tag, DNS-record, Google Analytics/Tag Manager and verification-file ownership methods. An unknown verification file or DNS token can grant durable Search Console access even after an unfamiliar user is removed.
Do not delete legitimate agency verification without confirming ownership and handoff. Recheck access after DNS/CDN cache propagation.
Finish incident cleanup
Verify trusted packages/custom code, users/application passwords, scheduled tasks, hosting access and sibling sites. Patch vulnerabilities and rotate exposed secrets.
Search for known domains/hashes plus variant behaviour. A file scanner alone does not cover database or external tag injection.
Observe through the prior recurrence interval.
Submit validation with evidence
Use the Security issues validation/review workflow after every affected pattern is clean. Explain cause, cleanup, credential/access work and verification.
Do not submit a vague “fixed” message or multiple requests while the site still changes. Keep the public response stable and crawlable.
Temporary URL removal tools do not resolve a security issue.
Monitor after validation
Check Page indexing and crawl examples for new spam paths. Review logs for search crawler requests and verify correct statuses.
Track Search Console users, sitemaps and verification files. Confirm legitimate SEO tooling still works.
Keep the cleanup manifest and follow-up integrity/account monitoring.
Compare newly discovered pages by creation/crawl date. URLs first seen after cleanup deserve immediate investigation even if old issue samples are still awaiting recrawl.
Inspect canonical and hreflang output on English, Spanish and Catalan versions. A compromised template can point clean translations toward a spam URL even when their visible content is normal.
Retain clean rendered examples for comparison.
Date them.
When expert review is warranted
Request assistance when the issue persists across properties, crawler output differs or examples expand after cleanup. Send screenshots and public samples without Google credentials.
The goal is not only a cleared dashboard: it is consistent clean responses and a closed generation/access route.