Remove leaked pages from search the same day

How to do it

Delete the page, put it behind sign-in, or edit out the data. Robots.txt does not remove a page from search, so never use it for this. The Removals tool in Search Console hides an address from Google within about a day. That removal lasts about six months, so the page must stay gone or locked. Ask for each variant of the address, such as http and https, www and the bare host, and addresses with parameters. If you only edited the page, ask Google to refresh the outdated result so the old snippet goes. Bing Webmaster Tools can block an address for up to 90 days, with most blocks done within 12 hours. Replace a leaked password or key as well, because hiding it does not undo a copy. Leaked personal data may also be a breach you must report, as Start every reporting clock from one moment says.

Examples

Shell example

for url in https://example.com/files/export.csv http://example.com/files/export.csv \
           https://www.example.com/files/export.csv 'https://example.com/files/export.csv?download=1'; do
  status=$(curl -s -o /dev/null -w '%{http_code}' "$url")
  case "$status" in 401|403|404|410) ;; *) echo "still public: $url ($status)"; exit 1 ;; esac
done

How to check

The incident runbook lists the removal steps for Google and Bing, and at least two people hold owner access in both tools. After a removal, a script requests every variant of the address and each answers 401, 403, 404 or 410.

Sources

• Google Search Central – Remove your site info from Google
• Search Console – Refresh Outdated Content tool
• Bing Webmaster Tools – Block URLs from Bing

Related rules

• CMP-21 Start every reporting clock from one moment in Compliance and governance