875,000 Spam URLs Cleaned in 24 Hours
Site indexed for spam URLs, SEO destroyed, bot attacks hammering server.
The Call
Client woke up to a nightmare: Google Search Console showing 875,000 indexed pages. Real site: 5 pages. Thousands of spam URLs. Server load 90%+ from bot hammering. Crawlers couldn't be stopped, legitimate traffic dying.
What Happened
SEO spam injection attack. Attackers created hundreds of thousands of spam URLs (casino, pharmaceutical, cheap products). Google dutifully indexed all of them. Legitimate pages drowning in results. Bots crawling at scale.
What We Found
- SEO spam injection in URL parameters
- No rate limiting (bots flooding server)
- No bot detection or blocking
- Weak security headers
- No spam URL patterns in robots.txt or sitemap
What We Built
410 Gone Responses — Nginx rules for spam patterns, return 410 (not 404) for faster de-indexing
Bot Filtering — User-agent blocking for known malicious crawlers
Rate Limiting — Nginx limit_req_zone to throttle repeat offenders
Security Headers — CSP, X-Frame-Options, X-Content-Type-Options, HSTS
Firewall Rules — Cloudflare WAF rules for known bad IPs
Sitemap Cleanup — Regenerated sitemap with only legitimate pages
Tech Stack
Nginx, Cloudflare, custom Python monitoring script
Timeline
Deployed fixes: 4 hours. De-indexing: 2–4 weeks after 410 responses propagated.
Outcome
- Spam URLs removed from index within 2–4 weeks
- Server load reduced ~80%
- Malicious bot traffic blocked
- Monitoring dashboards live
Quote
"Diagnosed and fixed the entire incident within a day. Professional and fast." — CTO, E-commerce Company
“Diagnosed and fixed the entire incident within a day.”
— CTO, E-commerce Company
Related case files
Have a problem worth solving?
We take on a limited number of engagements at a time. Tell us what you are dealing with.
Start a conversation →