Once the site is clean, the spam URLs can still sit in Google's index for weeks. The cleanup of the index is a separate job with its own order of operations. Getting the order wrong is the common reason spam results linger.
Clean the site first
Everything below assumes the site no longer generates the spam. If it still does, removing URLs from Google only delays the next batch. See WordPress spam links hack and the WordPress Malware Cleanup Checklist.
1. Get an accurate list of what's indexed
Search site:yourdomain.com together with the spam terms, for example the product or language that appears. In Search Console, the Pages report shows indexed URLs and can be filtered. Export or note the patterns: spam is usually generated in bulk under a few URL structures.
2. Make the spam URLs return a clear "gone" signal
Pages that no longer exist should return a 404 or 410 status. If the site returns a normal page or a soft-404 for these URLs, Google keeps them. Check a handful of spam URLs in a browser or with curl -I and look at the status code.
curl -I https://yourdomain.com/some-spam-url/3. Fix the sitemap
Remove spam URLs from any sitemap and make sure the site's sitemap lists only real pages. Check that no extra sitemap was submitted in Search Console by the attacker. Under Sitemaps, anything you don't recognise should be removed.
4. Check ownership
In Search Console, under Settings, then Users and permissions, look for owners you don't recognise. Attackers sometimes verify themselves as owners to submit spam sitemaps. Remove unknown owners and any verification tokens or files that aren't yours.
5. Use the Removals tool for urgent cases
The Removals tool temporarily hides URLs from search results, and can handle a whole prefix at once. It's a stop-gap for visible damage; permanent removal depends on the pages returning 404/410 and being re-crawled. Google's documentation explains the details: see further reading.
6. Request a security review, if you have a warning
If Search Console shows a Security issue, request a review after the site is clean. See flagged and blacklisted sites.
7. Monitor
Re-run the site: search weekly and watch the Pages report. If new spam URLs appear, the cause isn't fully removed: return to reinfection causes.
If you want this done for you, our malware removal service covers the cleanup and gives you the written recommendations for the recovery steps. See also the The Complete WordPress Hacked Site Recovery Guide.
Further reading
Dealing with this on a live site?
Send us the details and we'll tell you what we'd do and what it would cost.