How I Purged 1.3 Million Ghost Pages from www.sedssl.org

How I Purged 1.3 Million Ghost Pages from www.sedssl.org

A Webmaster's 60-Day War on SEO Spam, Crashed Servers, and Google's Index

Prologue: Welcome to Day One, Everything Is Broken

"Our site is down, our old server was hacked, and we have 500,000 spam pages live on Google with 800,000 more in the pipeline."

1. What Happened? (The Forensic Timeline)

How the Hack Worked

1. The Injected Links: The hacker's script created millions of fake web addresses like www.sedssl.org/?o=41723607101460 and www.sedssl.org/product/review/15986057061460.
2. The Cloaking Trick:
   • When Googlebot↗ visited, the server returned keyword-stuffed HTML so Google would rank it.
   • When a real human clicked from Google, the server immediately executed a redirect to external spam shops.
3. The Spider Trap: Each fake page contained links to 50 more fake pages, trapping Googlebot↗ in an endless indexing loop that indexed over 500,000 pages in weeks.

2. The Battle Plan: Two Big Jobs

3. Step 1: Put Up the Shield (Late July - August)

Move 1: Google Search Console Prefix Removals (Aug 15 - Sep 01)

Move 2: The Emergency Firewall (Cloudflare WAF)

(http.request.uri.query contains "o=") or

(http.request.uri.path contains "/product/category") or

(http.request.uri.path contains "wp-") or

(http.request.uri.path eq "/shop/storeSearch/KeepCriteriaInput.aspx") or

(http.request.full_uri contains "KeepCriteriaInput.aspx") or

(http.request.full_uri contains "index.php")

4. The Magic Status Code: Why 410 Beats 403 & 404

5. Building the Trap: Cloudflare Worker

/**

 * SEDS Sri Lanka - Ghost Link Cleaner

 * Catches 1.3M spam URLs and tells Google they are GONE forever.

 */

export default {

  async fetch(request) {

    const url = new URL(request.url);

    const { pathname, searchParams } = url;

    // 1. Check for spam numbers like ?o=123456

    const oValue = searchParams.get("o");

    const isSpamQuery = oValue !== null && /^\d{6,}$/.test(oValue);

    // 2. Check for fake store categories and Japanese event pages

    const spamPathRegex =

      /^\/(product\/(category|review)|contents\/event\/[^/]+)\/\d{6,}/;

    const isSpamPath =

      spamPathRegex.test(pathname) ||

      pathname === "/shop/storeSearch/KeepCriteriaInput.aspx";

    // 3. Check for old hacker scripts & backdoors

    const fullUri = pathname + url.search;

    const isSpamFile =

      fullUri.includes("KeepCriteriaInput.aspx") ||

      fullUri.includes("index.php") ||

      pathname.startsWith("/wp-");

    // If it's spam, kill it with 410 Gone

    if (isSpamQuery || isSpamPath || isSpamFile) {

      return new Response("HTTP 410 Gone: This page has been permanently deleted.", {

        status: 410,

        statusText: "Gone",

        headers: {

          "Content-Type": "text/plain; charset=utf-8",

          "X-Robots-Tag": "noindex, nofollow, noarchive",

          "Cache-Control": "public, max-age=31536000, immutable",

        },

      });

    }

    // If it's a real page, let the visitor through!

    return fetch(request);

  },

};

Safety First: Fail Open

6. Throwing Away the Old Server: Rebuilding on Next.js

• No PHP files or old CMS backdoors: Attackers have no writable files or SQL injection points.
• Hosted on Vercel's global network: Fast, stable, and immune to server crashes.
• Protected by Cloudflare: Free SSL, DDoS protection, and our custom Cloudflare Worker↗ running at the edge.

Before & After: The Transformation

Before: The Compromised Legacy Site

After: The Rebuilt Modern Portal

7. Testing in the Terminal: Watching It Work

# Test 1: Fake number link

$ curl -IL "https://www.sedssl.org/?o=41723607101460"

HTTP/2 410 Gone

x-robots-tag: noindex, nofollow, noarchive

# Test 2: Fake product review link

$ curl -IL "https://www.sedssl.org/product/review/15986057061460"

HTTP/2 410 Gone

# Test 3: Fake Japanese event link

$ curl -IL "https://www.sedssl.org/contents/event/kansyasai/31055966010460"

HTTP/2 410 Gone

# Test 4: Real SEDS SL Homepage

$ curl -I "https://www.sedssl.org/"

HTTP/2 200 OK

server: Vercel

8. The Victory: September 14, 2026

3 Lessons Every Webmaster Should Know

1. Check Search Console on Day One: When taking over any website, don't just look at the home page. Check Google Search Console↗ immediately to see what Google is actually indexing.
2. Cheap Hosting is Expensive: Unmanaged cheap hosts with old software are easy targets for hackers. A clean modern stack (Next.js↗ + Cloudflare↗ + Vercel↗) saves you weeks of headaches.
3. Use 410 Gone for Spam Cleanup: Don't just throw up a 404 or 403. Tell Google clearly that the pages were permanently deleted with an HTTP 410 Gone↗ header so they disappear from search results fast.