Did you think hackers were just nefarious for the sake of being nefarious? That’s not the case. Google makes it clear in their webmaster channel that SEO is a big motivator for hackers. Once hackers get into your WordPress, it can be very tricky to remove their code. Another thing to keep in mind is that most black SEO experts go to great lengths to make WordPress hacks hard to detect in the code.
So why would hackers turn to SEO and SEO experts turn to hacking?
The answer is simple: because there is a lot to be gained from unsuspecting websites. Google wrote:
Search Engine Optimization ‘SEO’ spam is one of the primary reasons that vulnerable websites are targeted by hackers. Some forms of SEO spam can redirect your users to malicious sites and cause you to lose customers.
An early warning sign of this can be from customers trying to access your site. Be sure to pay attention to user feedback, questions, or complaints. Pay attention to feedback provided by Google Search Console. If Google detects any malicious redirects, we’ll send you a message in Search Console. #NoHacked
A notorious example is SEO expert Charles Float. He came under notice after DDOS’ing a government website and uploading the video to YouTube to take credit for the attacks. After this, the police took an interest in Charles. The authorities eventually caught up with him and found enough nasty files on his computer(s) to send him to jail. Before his arrest, he openly recommended link injection techniques to gain links.
Not all SEO experts are resorting to dirty tricks like these. There are two sides to the industry: black hat SEO and white hat SEO. Of course, many individuals fall somewhere in the middle with their way of optimizing websites. Being 100% white hat means following to the letter Google’s recommendations even when they mislead or aren’t fully transparent in their guidelines. Most black hat SEO techniques aren’t necessarily nice but few are as dirty and as legally dubious as hacking websites for links.
What’s the impact on your website?
Your SEO and hard earned reputation could quickly go down the drain. If a black hat SEO starts messing with your website and injecting bogus links to products like cheap Rolex watches or weight loss pills. The worst part? You may not notice your website has been hacked. Thousands of websites have already been hacked and most of the owners aren’t even aware of it.
What is the objective of link injections?
The name of the game is to get links pointing to a website. Links are a ranking signal for search engines. However, some spammy or low quality websites have a hard time getting legitimate links on their own. Black hat SEOs hack websites and insert backlinks in websites without the owner’s permission.
Getting hacked for SEO is harmful to a website
Once the link injection software is placed on your website, it can do real damage. Search engine bots will get suspicious about the outbound links pointing to shady websites. Google could mark your website as malicious. This would kill your organic traffic. Cleaning up your website will often be a long and arduous process. While getting rid of pesky links and banishing the nefarious forces that control your website is already hard work, you have another thing coming… Search engines have a relatively long memory and it will take time to rebuild the trust they placed in your website and its contents.
How can you detect spam SEO on your website?
SEO spam is sneaky because it’s not visible. However, you can uncover it 4 ways:
- A drastic drop in your organic traffic showing in your Google Analytics stats
- A notification from Google Search Console. Every website owner should sign up for this free Google tool to keep up-to-date on anything fishy that the search engine crawler sees on your website.
- Check your source code. If you see any irregularities in your could like viagra links, it’s time to clean up your website.
- Pay attention to customer complaints. Usually, your customers will catch things you don’t see. Follow-up on complaints talking about bad content or weird things on your website.
Common ways your WordPress can be hacked
Oftentimes, we are inviting hackers in. How? By downloading nulled WordPress templates or plugins. That’s right, trying to avoid paying for a premium plugin or template could cost you big in the end. Let’s get back to Charles, the black hat SEO we talked about earlier in this article. Here is one of his recommended SEO techniques on his blog:
Nulled Template Injection
Charles Float recommended a way to get “a load of free links” easily if you happen to have bought a couple of Premium themes. There are 2 ways he went about acquiring links: footer links via the footer.php of most template files or homepage links via the index.php file in a WordPress template. Basically, to gain access to a website, you need to modify the files in the WordPress template and then share it on torrent or theme sharing forums. Hackers improved their website’s SEO by including the links to the website they are trying to boost or inserting PHP scripts that update the links as they wish. These nulled templates get shared quite a lot because they are free and easy to find. This hacking technique worked quite well for some black hat SEO experts so beware.
The next time you think about getting something that isn’t free for free, you should think twice. The implications of a “free” template or plugin could turn out to be much more than you can handle.
Applying security concepts: a to-do list
How can you improve security? WordPress recommends a few steps if you want to keep your website safe:
- Limit access: Limit the number of people who have administrative rights on your WordPress.
- Functional Isolation: Minimize the damage that can be done if your website is compromised. That means avoiding large numbers of web applications stored on a single hosting account.
- Backups: Maintain reliable backups to be able to restore your website if it is damaged.
- Stay Up-to-Date: Keep your WordPress installation up-to-date. This includes everything: the CMS, plugins and themes on your website.
- Trusted Sources: Get your themes and plugins from trusted websites. Nulled plugins and themes have a nasty tendency of coming bundle tight with malware.
- Security Updates and News: stay aware of vulnerabilities thanks to databases maintained by teams like WPVulnDB.com. You can also stay ahead of the latest trends by following WordPress’s own Security tag.
Have you ever had a website hacked for SEO purposes? How did you fix the problem?
Resources for this article:
- https://www.seroundtable.com/google-seo-reason-sites-hack-target-23223.html
- http://siteolytics.com/black-hat-seo-technique-demystified/
- https://codex.wordpress.org/Hardening_WordPress
