---
title: "Look for pages you never made · Agent Wranglers"
url: https://agentwranglers.se/playbook/seo/search-incidents/hacked-content
id: SEO-80
level: Recommended
updated: 2026-10-22
build: a2a6bdfed830
tokens: 1031
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Look for pages you never made

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Search incidents](https://agentwranglers.se/playbook/seo/search-incidents.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: SEO-80
- Level: Recommended
- Chapter: [Search incidents](https://agentwranglers.se/playbook/seo/search-incidents.md)
- Rule: Every week, compare the pages that get search impressions with your sitemap and redirect map, and read the Security issues report. Treat any unknown page as a possible break-in.
- Check: A weekly job lists every page with impressions in the last 7 days from the Search Console data. It fails on any page that is in neither the sitemap nor the redirect map. A log entry records the Security issues report status, and the latest entry is under 8 days old.
- How: Attackers who get into a site often add spam pages, hidden links or redirects that only crawlers or phone visitors see. Google's Security issues report lists hacked content, malware and social engineering, with sample addresses. Pull the pages with impressions from the Search Console data, or search `site:example.com` with words you never use. Treat a finding as a security incident, as [Declare incidents early](https://agentwranglers.se/playbook/operations/incidents/declare-incidents.md) says. Close the hole first, as [Keep software current and quiet](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/patch-and-hide-versions.md) says, or the pages come back. Fix every affected page, then request a review as [Read and answer a manual action](https://agentwranglers.se/playbook/seo/search-incidents/manual-actions.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export const unknownPages = (pagesWithImpressions, sitemapXml, redirectSources) => {
  const known = new Set([...sitemapXml.matchAll(/<loc>([^<]+)<\/loc>/g)].map(([, loc]) => loc))
  return pagesWithImpressions.filter(page => !known.has(page) && !redirectSources.includes(page)).sort()
}
```

### Python example

```python
import xml.etree.ElementTree as ET

SITEMAP_NS = {"s": "http://www.sitemaps.org/schemas/sitemap/0.9"}

def unknown_pages(pages_with_impressions, sitemap_xml, redirect_sources):
    known = {loc.text for loc in ET.fromstring(sitemap_xml).iterfind("s:url/s:loc", SITEMAP_NS)}
    return sorted(set(pages_with_impressions) - known - set(redirect_sources))
```

## Sources

- [Search Console – Security issues report](https://support.google.com/webmasters/answer/9044101)
- [Google Search Central – Get started with Search Console](https://developers.google.com/search/docs/monitor-debug/search-console-start)

## Related rules

- OPS-25 [Declare incidents early](https://agentwranglers.se/playbook/operations/incidents/declare-incidents.md) in Operations and observability
- APS-67 [Keep software current and quiet](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/patch-and-hide-versions.md) in Application security
- SEO-60 [Read and answer a manual action](https://agentwranglers.se/playbook/seo/search-incidents/manual-actions.md) in SEO

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/seo/search-incidents/hacked-content">Agent Wranglers SEO playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Remove leaked pages from search the same day](https://agentwranglers.se/playbook/seo/search-incidents/remove-from-search.md)
- Next: [Read and answer a manual action](https://agentwranglers.se/playbook/seo/search-incidents/manual-actions.md)
- [Search incidents](https://agentwranglers.se/playbook/seo/search-incidents.md)