URL Hijacking: The Breakdown
There are a lot of things that can ruin a website, but nothing is quite as devastating as having your website dropped from the search engine results pages (SERPs). This can happen for a number of reasons that include blackhat SEO tactics, shady content practices, and in some cases, URL hijacking.
URL or domain hijacking usually isn’t as glamorous as it sounds. Often, URL hijacking is the result of a mistake or an unintentional redirect, but it is a very real way to lose visitors and ruin all the SEO progress you’ve made.
Web hijacking of your URL isn’t as scary as it sounds, if you know what it is and how to avoid it, and improving your online security doesn’t have to be a hassle. Here’s a quick guide to help you identify and avoid URL hijacking.
URL Hijacking: The Breakdown
According to the Ryte Wiki, an online digital marketing encyclopedia, URL hijacking is, “a process in which a website is falsely removed from the results of a search engine and replaced by another webpage that links to the remote page.”
Domain hijacking is often the result of redirects that confuse search engine results pages, or malicious actors who carry out a URL hijacking attack to replace your URL with another one, often to direct the user to a malicious website.
This other URL (for example notyourwebsite.com) links to your website content (yourwebsite.com) but does so using a redirect rather than a direct html tag. As a result, as SERPs try to decipher which URL is the true URL, the domain owner’s URL gets removed from the index and hidden from view.
Instead of bringing internet users to your website through your URL, another URL gains control and redirects traffic through a fraudulent URL.
Why is URL Hijacking Bad?
Search engine optimization is typically the goal for most website owners. SEO experts optimize content both behind the scenes and on the surface in the hopes that all their hard work will eventually mean top placement in search engine results.
Getting to the top of a SERPs is a big deal. In fact, as much as 53% of all trackable website traffic comes from organic search.
Now, imagine instead of yourwebsite.com getting the top spot on a results page, and linking back to all that content you’ve optimized, notyourwebsite.com does so instead. What’s more, yourwebsite.com can’t be found at all through a search engine because the search engine has hidden or deslisted your URL entirely. That’s what happens when your URL gets hijacked.
Redirects: The Culprit Behind URL Hijacking
The culprit behind most (if not all) domain hijacking is the redirect. A URL redirect helps search engines find content that may have moved, and SEO experts use redirects all the time to ensure content is found and frameworks function smoothly. Some redirects are temporary and others are permanent. And many of these redirects can occur simply due to a misspelled domain that was written incorrectly during domain name registration.
Search engine indexes use redirects to find relevant content pages, and it’s these redirects that sometimes “confuse” a search engine into falsely substituting your URL for another one.
Common redirects include:
- A permanent redirect to a correct domain due to typographical errors
- A permanent redirect when content gets a new filename
- A permanent redirect to the correct URL for a main page
- A temporary redirect if content is temporarily at a different address but will move later
It’s that last one, the temporary redirect, that causes URL hijacking problems. Search engines mistake redirects for correct URLs. As a result, one of the two URLs gets the boot from search engine results pages.
302 Temporary Redirects and URL Hijacking
There are two http status code responses responsible for most redirects—301 and 302. 301 redirects are permanent while 302 redirects are temporary. 302 redirects are most often used to temporarily present content from another URL so those content elements can remain available during things like maintenance or a website rebuild in which you transfer the domain.
What happens during a URL hijacking is that a temporary 302 redirect and the correct URL are seen as duplicate content by a search engine. The search engine then has to make a choice between the correct URL (yourwebsite.com) and what it thinks is the correct URL (notyourwebsite.com/redirect.php?target=www.yourwebsite.com). Http status codes often take precedence, and this can result in your URL being the one that gets deleted.
Mistaken 302 redirects aren’t always your fault. Some happen accidentally, and others are generated automatically by PHP. Still others are URL hijacking attacks from malicious actors gaining access to and intentionally capitalizing on your SEO work and SERPs rankings.
Protect Yourself from URL Hijacking with Security Solutions
Search engine optimization costs you valuable time and resources, which is why no business wants to have all their SEO efforts sabotaged by URL hijacking.
There is no one-size-fits-all URL hijacking fix. URL hijacking is dependent on how well you handle your SEO link building. It’s crucial that you closely examine and optimize new and existing backlinks to filter out the problem URLs. Taking your security further with enterprise-scale security solutions is another step in the right direction.
If you want to protect your hard-earned SEO work from URL hijacking, discover how Quadrant Information Security can better secure your web content with a free trial of our all-inclusive security solution! If you’re satisfied, we’ll deploy everything—no setup fees and no upfront costs—for one all-in price that’s less than the expense of a full-time IT person. Contact the IT security experts at Quadrant to get started today.
