My website has been affected by a hack and injected with thousands upon thousands of spam pages. I’ve been able to remove almost 2000 indexed spam pages from google by returning a “410 gone” tag for those. But I’ve run into a problem with the links that start with “head.php” (see image below), those pages refuse to return a 410 code and instead return a 404 page no matter what I try to do.
Those pages still show up in google search results as well, even though I have updated by sitemap and reindexed all the genuine pages on my website manually.
My site also currently has 14,9k pages that are not indexed by google, how would I go about removing those from the search console entirely?
What can I do?