Look for pages you never made

How to do it

Attackers who get into a site often add spam pages, hidden links or redirects that only crawlers or phone visitors see. Google's Security issues report lists hacked content, malware and social engineering, with sample addresses. Pull the pages with impressions from the Search Console data, or search site:example.com with words you never use. Treat a finding as a security incident, as Declare incidents early says. Close the hole first, as Keep software current and quiet says, or the pages come back. Fix every affected page, then request a review as Read and answer a manual action says.

Examples

JavaScript example

export const unknownPages = (pagesWithImpressions, sitemapXml, redirectSources) => {
  const known = new Set([...sitemapXml.matchAll(/<loc>([^<]+)<\/loc>/g)].map(([, loc]) => loc))
  return pagesWithImpressions.filter(page => !known.has(page) && !redirectSources.includes(page)).sort()
}

Python example

import xml.etree.ElementTree as ET

SITEMAP_NS = {"s": "http://www.sitemaps.org/schemas/sitemap/0.9"}

def unknown_pages(pages_with_impressions, sitemap_xml, redirect_sources):
    known = {loc.text for loc in ET.fromstring(sitemap_xml).iterfind("s:url/s:loc", SITEMAP_NS)}
    return sorted(set(pages_with_impressions) - known - set(redirect_sources))

How to check

A weekly job lists every page with impressions in the last 7 days from the Search Console data. It fails on any page that is in neither the sitemap nor the redirect map. A log entry records the Security issues report status, and the latest entry is under 8 days old.

Sources

• Search Console – Security issues report
• Google Search Central – Get started with Search Console

Related rules

• OPS-25 Declare incidents early in Operations and observability
• APS-67 Keep software current and quiet in Application security
• SEO-60 Read and answer a manual action in SEO