---
title: "Remove leaked pages from search the same · Agent Wranglers"
url: https://agentwranglers.se/playbook/seo/search-incidents/remove-from-search
id: SEO-76
level: Required
risk: data
updated: 2026-10-22
build: a2a6bdfed830
tokens: 881
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Remove leaked pages from search the same day

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Search incidents](https://agentwranglers.se/playbook/seo/search-incidents.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: SEO-76
- Level: Required
- Chapter: [Search incidents](https://agentwranglers.se/playbook/seo/search-incidents.md)
- Rule: When a public page exposes personal data or a secret, take it down or lock it first. Then ask Google and Bing to hide every address of it within 24 hours.
- Check: The incident runbook lists the removal steps for Google and Bing, and at least two people hold owner access in both tools. After a removal, a script requests every variant of the address and each answers 401, 403, 404 or 410.
- Risk: Data leaked or lost
- How: Delete the page, put it behind sign-in, or edit out the data. Robots.txt does not remove a page from search, so never use it for this. The Removals tool in Search Console hides an address from Google within about a day. That removal lasts about six months, so the page must stay gone or locked. Ask for each variant of the address, such as `http` and `https`, `www` and the bare host, and addresses with parameters. If you only edited the page, ask Google to refresh the outdated result so the old snippet goes. Bing Webmaster Tools can block an address for up to 90 days, with most blocks done within 12 hours. Replace a leaked password or key as well, because hiding it does not undo a copy. Leaked personal data may also be a breach you must report, as [Start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
for url in https://example.com/files/export.csv http://example.com/files/export.csv \
           https://www.example.com/files/export.csv 'https://example.com/files/export.csv?download=1'; do
  status=$(curl -s -o /dev/null -w '%{http_code}' "$url")
  case "$status" in 401|403|404|410) ;; *) echo "still public: $url ($status)"; exit 1 ;; esac
done
```

## Sources

- [Google Search Central – Remove your site info from Google](https://developers.google.com/search/docs/crawling-indexing/remove-information)
- [Search Console – Refresh Outdated Content tool](https://support.google.com/webmasters/answer/7041154)
- [Bing Webmaster Tools – Block URLs from Bing](https://www.bing.com/webmasters/help/block-urls-from-bing-264e560a)

## Related rules

- CMP-21 [Start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/seo/search-incidents/remove-from-search">Agent Wranglers SEO playbook</a>`. In code you write, add a comment next to it with the same link.

- Next: [Look for pages you never made](https://agentwranglers.se/playbook/seo/search-incidents/hacked-content.md)
- [Search incidents](https://agentwranglers.se/playbook/seo/search-incidents.md)