SEO-spam cleanup often involves thousands of links, titles, paths and database records. Broad deletion can remove real multilingual pages, product data, redirects and editorial history while leaving the generator active.
Build an exact spam inventory, close the insertion route and make reversible changes by content owner.
Group symptoms into campaigns
Collect sample URLs, titles, external domains, creation dates, author IDs, post types and path patterns. Separate Japanese keyword, pharmaceutical, casino and link-injection indicators if they differ.
One incident can contain several mechanisms: generated rewrite pages, inserted posts and changed homepage metadata.
Do not use approximate search result counts as the deletion list.
Preserve content and relationships
Take database/files snapshots and export affected record IDs. Include revisions, post meta, taxonomies, menus, widgets, builder templates and attachments.
For WooCommerce, protect orders, products, variations, coupons and customer records. Confirm the active order storage model before database work.
Keep copies encrypted and outside public web access.
Establish precise inclusion rules
Define multiple corroborating indicators: known malicious domain plus creation window plus unknown author, or exact generated path plus payload signature.
Review samples that match and legitimate near-misses that do not. Treat accented/multilingual text carefully; foreign-language content is not automatically spam.
Document why each group is included.
Compare translated and canonical records
Multilingual plugins connect translations through relationship tables or metadata. A spam record can impersonate one language while pointing at a legitimate canonical page, or a bulk deletion can orphan the remaining translations.
Map each candidate to its translation group, language, canonical and hreflang output. Remove only confirmed spam members through the multilingual plugin’s supported API, then regenerate language sitemaps. Verify English, Spanish and Catalan navigation still reaches equivalent real content.
Close the generator first
Find vulnerable plugins, stolen accounts, malicious PHP, database loaders, cron and hosting-level rules. Patch/remove the entry and persistence.
If cleanup begins while the generator runs, new records can appear between inventory and deletion.
Monitor maximum IDs and files during the maintenance window.
Remove through the correct owner
Use WordPress APIs for posts and relationships, builder tools for structured templates and targeted server rules for generated nonexistent paths.
Batch work modestly in staging, compare counts and review rendered pages. Avoid raw wildcard SQL deletion and ordinary text replacement in serialised options.
For each batch, keep ID list, before/after count and rollback.
Restore search-facing signals
Ensure removed spam URLs return 404/410, clean canonical metadata and sitemaps, and no internal links remain.
Use Search Console security validation and temporary removals only after the site is clean. Do not redirect every spam URL to the homepage.
Keep robots access open enough for search engines to observe the removal status.
Validate legitimate site areas
Test primary pages, blog categories, languages, search, menus, forms, feeds and authorised WooCommerce flows. Compare page counts and key URLs with the pre-incident baseline.
Search the clean database/public HTML for known indicators and monitor for new patterns. Search recovery will take recrawling time.
Keep a cleanup manifest
Record removed record groups, files, options, routes, credential actions, backups and verification evidence. Note limitations where logs or old backups are missing.
This manifest supports search review, rollback and future monitoring without retaining payloads in an unsafe location.
Have the content owner sign off the preserved page counts.
Archive that approval.
When specialist cleanup is appropriate
Request help when spam overlaps multilingual content, WooCommerce or serialised builder data. Send sample public URLs and counts, not the database.
The repair should preserve legitimate business content while removing the campaign and every route that can recreate it.