Hacked website - Dealing with 301 redirects and a large .htaccess file

[FPK]

One of my client's websites was recently hacked and I've been dealing with the after effects of it. The website is now clean of malware and I already appealed to Google about the malware issue. The current issue I have is dealing with the 20, 000+ crawl errors which are garbage links that were created from the hacking.

How does one go about dealing with all the 301 redirects I need to create for all the 404 crawl errors? I'm already noticing an increased load time on the website due to having a rather large .htaccess file with a couple thousand 301 redirects done already which I fear will result in my client's website performance and SEO performance taking a hit as well.

[Linda-Vassily]

If they are garbage links, why are you redirecting them? Let them 404. Having not found pages does not lead to penalties, in and of itself.

[PenaltyHammer]

Hi

I just finished similar job.

What you should do:

• collect all bad "pages" and links pointing to them
• find a pattern like some kind of directory
• set them (directories I believe?) 410, not 404
• set robots to disallow those directories
• push all pages and links to reindex
• remove from Google index
• done (need to wait some time)

Important thing is to get rid of all bad links pointing to those pages. If you do that, then there'll be no issues. However this could be ongoing negseo. If you need help with that, pm me.

Krzysztof

[CleverPhD]

Just a correction here.  I agree with all the items above, with one very, very, very, very, very important change.

DO NOT set the corrected urls to disallow in your robots.txt

If you do not allow Google to crawl the pages, Google will not see that the links were removed, that the page is now 4xx, etc. If you were to disallow all those pages, all the clean up work that you have done will not be seen by Google and would be for naught.

If you later want to disallow those pages, that would be fine, but you need to let Google see your clean up work first.

[PenaltyHammer]

So robots part could be at the end but in my case it worked fine too.

[ChrisAshton]

This is the correct answer.

To expand on this slightly, just make sure none of the 404s are internal (ie there are no links on your site pointing to one of these dodgy pages as a result of the hack) and you're all good.

Remove the entries from your htaccess file to avoid having to parse them constantly and let any external links to dodgy pages 404. This sort of circumstance is exactly what 404s are made for!

The only site at risk of a ranking drop from these 404s is the one pointing to those dodgy pages - who cares about your hackers' rankings?