My website has been affected by a hack and injected with thousands upon thousands of spam pages. I’ve been able to remove almost 2000 indexed spam pages from google by returning a “410 gone” tag for those. But I’ve run into a problem with the links that start with “head.php” (see image below), those pages refuse to return a 410 code and instead return a 404 page no matter what I try to do.
https://preview.redd.it/fy3v8pgukcfa1.jpg?width=257&format=pjpg&auto=webp&v=enabled&s=0bc9da8a15915b03e26202504381b9e08c762e98
Those pages still show up in google search results as well, even though I have updated by sitemap and reindexed all the genuine pages on my website manually.
My site also currently has 14,9k pages that are not indexed by google, how would I go about removing those from the search console entirely?
What can I do?