Recently a fellow SEO posted a screenshot in a Facebook group that showed weird characters appearing in the titles of WordPress search results pages and these were indexed by Google in the thousands.
I instantly recognized the phenomenon as it had happened to multiple sites of a client in 2019. Here is the screenshot.
This website only had a few dozen pages, but the SERP was showing around 65,000 pages indexed in Google. All the junk indexed pages were Search Result Pages generated by the WordPress CMS.
When I did some digging, I found these websites did not have the no-index directive for WordPress search result pages. That's why Google was indexing these pages.
Solution:
Most website don't need their search result pages indexed in Google. So, these should have the no-index meta tag. Yoast does this by default. While, Rank Math has the option to no-index search result pages.
Google crawler will find out the new meta tag on your search result pages, and it will take out all the spammy search results pages of your website from its index. For some people, this can take a while.
How Did It Happen?
Anyone can add any string in the search variable parameter, and they can then link to this new URL on your website from websites made to send spam links.
E.g. YourDomain.com/?s=any thing you want here times infinity
Have a script that does this process thousands of times to generate thousands of links on your website.
Then the spammers/evildoers link these URLs from their network of websites. Wallah! Google will index most of the URLs, unless your search result pages have the no-index meta tag.
<meta name='robots' content='noindex, nofollow,' />