The Search Console Security Issues report shows warnings when Google finds that your site might have been hacked or used in ways that could potentially harm a visitor or their device. When Google detects a security issue on a website, Search Console verified site owners will receive an email alerting them about this issue
with a link to more information on how to solve it. Read your emails carefully. It's important that you see these alerts as soon as possible.
Types of Hacking
There are many different types of hacks. The most common one is URL injection that can happen through stolen credentials or outdated software. Once hackers gain unauthorized access to the CMS or the hosting service of a website, they can remove, modify or add content, steal user data, or exploit the reputation of the website for their own commercial purposes.
We will focus on three forms of hacking through injection of URLs, content, or code.
Injections usually result in harming the user experience and trust, damaging the reputation of the website. URL injection happens when a hacker creates new pages on a site containing spammy links. These links redirect users to other sites. Content injection happens when a hacker adds unrelated content to a site's pages, such as spammy keywords or gibberish text.
Code injection happens when a hacker injects code to a website to change its behavior, for example, by sending spam emails. Typically, hackers take control of a website in one of these ways.
- By gaining access to an insecure directory on a server. For example, you may have forgotten about a directory that has open permissions
- By exploiting a vulnerability in a software running on a site, such as a content management system. For instance, you might be running an older insecure version of your CMS
- By hacking third-party applications, such as plugins or widgets, on a site
So, do a lot of security issues come from outdated software and bad credential management? Yes.
Hackers usually look for technical signals to assess if a website is well protected or not. If they see that a website is running an outdated version, they might exploit a known vulnerability.
Social engineering tricks users into doing something dangerous online, such as revealing confidential information or downloading malicious software. Phishing is an example of social engineering. Google Safe Browsing protects users by warning them before they visit deceptive websites or download harmful files. If Google Safe Browsing detects that your website has deceptive content, the Chrome browser may display a "Deceptive site ahead" warning when visitors click to access your site.
Search Console will alert you by email if they think any of the pages on your site contain social engineering content. But take a quick look at your Security Issues report once in a while just to be on the safe side– pun intended.
Some examples of social engineering are: deceptive content, your site tries to trick visitors into doing something they'd only do for a trusted entity, for example, sharing a password or a credit card number; deceptive ads, your site contains ads that falsely claim that device software is out-of-date, prompting users into installing unwanted software. Since deceptive content makes you believe that it is the original source, it may try to trick you into sharing your sensitive data. But don't fall for those tricks. Well, you may not fall for obvious phishing attacks, but deceptive contents, such as fake download buttons, may try to trick you to download malware.
In addition to social engineering warnings, Google also reports on other security issues.
Your site offers a download that Google Safe Browsing hasn't seen before. Chrome may warn those who download it that it could be dangerous. These warnings are lifted automatically if Google Safe Browsing verifies that the files are safe.
Your site offers users a download that Google Safe Browsing thinks is either malware or unwanted software. Browsers, such as Chrome, may show a warning when a user visits your site. To remove this warning, you must remove the links to harmful sites.
Unclear mobile billing
Your site is not sufficiently informing users about mobile charges. Chrome may display a warning before the user loads a page that incurs these charges.
Your site has been infected by or is hosting malware from a hacker. This can be software, a mobile application, or a script specifically designed to harm a device when a user knowingly or unknowingly installs it. You can find out more about malware issues and how to fix them in the Assessing Malware Documentation linked in the description.
Always remember to pay attention to the Security Issues report in Google’s Search Console. It could contain critical information regarding the security of your website and your users. Beware of social engineering, pay attention to warnings, and don't fall for deceptive content and harmful downloads.