Security / Spam / Removal / Search Operators Complete Guide (malware + phishing + UGC + redacted + site:)

One sentence: Site security (malware/phishing/hacking)/UGC spam prevention/content removal/Google search operator debugging — these 4 topics are all "defense + tools" knowledge for SEO practitioners, grouped together for easy cross-reference.

TL;DR — When to open this wiki

You encounter	Open Part
Chrome shows "Deceptive site ahead" / Safe Browsing warning	Part 3 (Social Engineering)
Search Console reports malware	Part 2
Want to prevent hacking / harden your site	Part 4
Site gets repeated warnings + 30-day appeal ban	Part 5 (Repeat Offender)
Comments / forum / paper site is spammed	Part 6 (UGC spam)
Want to check if a URL is indexed / debug	Part 7 (`site:` / 4 major operators)
Want to urgently remove a page from Google	Part 8 (Removals tool)
Uploaded PDF / image has redacted information dug out by others	Part 9 (Keep redacted out)

Part 1 — Security Overview: Safe Browsing + Security Issues Report

1.1 What is Safe Browsing

Google Cross-product security service: Chrome / Search use the same "dangerous sites" list. When flagged:

Chrome displays an interstitial page (red box "Deceptive site ahead" / "Site ahead contains malware")
Search results add a warning for that site
Direct downloads are blocked

1.2 Search Console Security Issues report

Entry point:search.google.com/search-console/security-issues

Displays the current site's 4 categories issue:

Category	Meaning	See
Malware	Web-based malware (executes without user interaction)	Part 2
Harmful downloads	Malicious / unwanted software that users actively download	Part 2
Social engineering	phishing / deceptive ads / unclearly labeled third parties	Part 3
Hacked(Derived)	Your site was hacked and serves malicious / spam pages	Part 4 + hacked recovery

After fixing, in the report Request a review — review usually takes a few days.

Part 2 — Malware vs Unwanted Software

2.1 Distinction

	Definition
Malware	Programs that intentionally harm devices / software / users. They without user consent install things, install viruses, etc.
Unwanted Software	Behavior Programs that deceive / surprise / damage experience. Examples: changing homepage, leaking privacy

Many site owners do not realize that the downloads they host have been classified as malware/unwanted.

2.2 5 major behavioral prohibitions (violating any will trigger a warning)

① Do not misrepresent yourself

Ads must accurately inform users what will be downloaded (cannot just say "Download")
Do not use a "Play" button to trigger downloads
Ads must not disguise themselves as publisher content ("Click here to watch a movie", but it is actually software)
Behave as advertised (if you say you collect data, state it clearly in the UI, do not hide it)

② Do not scare users

Do not pretend the system is infected / in a security emergency
Do not pretend to offer services you cannot provide ("Speed up your PC")
"Free" cleaners / optimizers cannot be advertised as "free" if they actually require payment

③ Software guidelines (Chrome / browser level)

Changing Chrome settings must use Chrome Settings Override API(cannot bypass)
Do not suppress browser / OS setting change prompts
Code signing is strongly recommended for your binaries (unsigned binaries are not directly marked unwanted, but signed ones are more trustworthy)
Do not degrade TLS/SSL security(Do not install root CAs, do not intercept SSL unless it is debugging software)
User data may only be transmitted if it is functionally relevant + must be disclosed + must be encrypted
Do not break the browser reset function
Must be one-click uninstallable + uninstall all components cleanly

④ Chrome extension guidelines

Must be hosted on the Chrome Web Store
Installation must go through the official enable flow(cannot be installed by default)
Must comply with single-purpose policy
No silent installs — must be confirmed via Chrome popup

⑤ Mobile app guidelines

Before collecting data informed consent is required
Do not impersonate other brands / apps
Do not display ads / content outside the app context
Do not install other apps without consent(updates ≠ installing new apps)
Do not mimic OS popups
Clean uninstall — cannot install hidden components

2.3 Fix path

Self-check against the 5 major guidelines
Search Console → Security Issues report → Request a review
Mobile app warnings can go through Play Store appeal
Cannot fix after repeated attempts → Report a security issue to Google manual review

3.1 3 major types

Type	Example
Phishing	Pretending to be a trusted entity (browser/bank/government) to trick users into giving passwords/phone numbers/SSN
Deceptive content	Fake buttons / fake "software expired" / fake offers to induce downloads
Third-party services not clearly labeled	You host a donation form for a charity website, but the form does not state "This form is processed by ExampleHosting on behalf of ExampleCharity"

3.2 ⚠️ Even if you did not do it, you may still be held responsible

Embedded social engineering content(deceptive content in ads) — the host page violates policy(because you embedded it)
Injected by hackers — after a site is hacked, hackers insert deceptive pages / popups → the Security Issues report will show it

3.3 4 types of typical violations

(Images omitted, see original document)

Fake software update popups tricking users into installing malicious apps
Fake browser update prompts(example from original document)
Fake Google login page(phishing, URL is usually incorrect)
Ads disguised as page UI elements(fake player updates / fake required components / fake play buttons)

3.4 4-step fix

Step 1: Search Console 自查
  - 验证 ownership 没被新增可疑 owner
  - Security Issues report 看是否报 deceptive
  - 看 sample URLs(用站外电脑访问,因为聪明的黑客检测到 site owner 会停止攻击)
  - 没 sample URLs 但你确信清白 → 直接 request review

Step 2: 移除 deceptive 内容
  - 整页扫一遍照 examples 对照
  - 觉得 Safe Browsing 误判 → report 给 Google

Step 3: 检查第三方资源
  - 广告网络会轮播 — 多刷新页面看是否出现 deceptive ad
  - 桌面 / 移动看可能不同 — URL Inspection tool 都看
  - 第三方服务遵守 third-party guidelines(见 3.5)

Step 4: Request review(几天)

3.5 Clean guidelines for third-party service integration

If your site embeds third parties (payments / donations / forms / customer service), conditions to avoid being marked as social engineering:

On every page third-party brands must be clearly displayed(users know who is operating it)
If a page has first-party branding,clearly state the relationship between both parties + link to "More information":

This service is hosted by Example.com on behalf of Example.charities.com. More information.
best practice: Use industry-standard services — for example, use OAuth for auth, do not roll your own

Part 4 — Prevent Malware Infection

4.1 General checklist (all webmasters)

Strong passwords — use Google account guidelines
Choose third-party content providers carefully — third-party apps / ads must have support + contact info
Contact your hosting provider — most have security pages / RSS feeds, subscribe to them
Keep local computers secure too — computers used to modify the site should have up-to-date software / antivirus

4.2 Advanced checklist (users with server access)

Check server config
- Apache: security tips
- IIS: Microsoft tech center
Backups .htaccess(required before changes, delete backups after completion)
Keep software + patches up to date — forgetting about installed forums/blogs is a common pitfall; record every plugin version;hosting provider OS patches should also be pushed for updates
Check log files
- Abnormal URL parameters (=http:, =//)→ may be exploited by open redirects
- Hackers often modify logs → move log files away from default locations to make them harder for hackers to find
Self-check for common vulnerabilities:
- Directory open permissions (equivalent to leaving the door wide open)
- XSS
- SQL injection
Protocols: Use SSH / SFTP instead of telnet / FTP
Stay current:
- Google Security Blog
- US-CERT government-level technical warnings

4.3 Use `site:` operator for self-check

site:example.com

See which pages of your site Google has indexed — finding unexpected pages = possible hack (common injected blackhat links / blackhat articles / subdirectories).

Part 5 — Safe Browsing Repeat Offenders Policy

5.1 Trigger condition

Repeatedly switching between "compliant / violating" in a short time → classified as Repeat Offender.

5.2 Penalty

Notification received in Search Console email
Requesting additional reviews is prohibited for 30 days
Can appeal again only after 30 days

→ Fix thoroughly, do not just patch things and alert the attacker.

Part 6 — Prevent User-Generated Spam(UGC)

Spammers like sites with open comments / forms, leaving spam links + junk content.Simple deterrents can also drive away most of them.

6.1 7 major methods

A. Tell users you do not allow spam

Clearly state the abuse policy during registration
Let trusted users be able to report spam

B. Build a user reputation system

Track these signals to identify spammy accounts:

Form completion time (bots fill in seconds)
Large number of requests from the same IP range
User agent
Username / form values

C. Add `noindex` ⭐

What spammers want is for Google to index their links.New users → noindex → spammers get no benefit; after users build reputation over time, let their content be indexed.

D. Add `nofollow` or `ugc`

to all links in untrusted content rel="nofollow" or rel="ugc" so leaving links is useless for them.

E. Manually review high-risk interactions

Comments / registrations / major form changes → require manual approval before publishing.CMS built-in moderation exists for a reason.

F. blocklist

When spammy IPs / accounts are found → add them to the firewall deny list. For CMS, use plugins such as Akismet etc.

G. Prevent automated account registration

reCAPTCHA or similar verification tools.

6.2 monitoring spam signals

Use site: + spammy keywords / Google Alerts for automatic monitoring
Sudden traffic spikes in logs
Google Safe Browsing API Test your own URLs
confidence check — mainly serving Japanese users, but suddenly thousands of Italian IPs in the early morning → almost certainly spam. Use language detection libraries or Google Translate API to identify the language of newly created content

Part 7 — 4 Major Search Operators (for SEO debugging)

⚠️ Core point: search operators are subject to indexing + retrieval limit limitations,results are inaccurate. For debugging, prioritize URL Inspection tool(Search Console); operators are only for rough checking assistance.

7.1 Full table

Operator	Purpose	Limitations
`site:`	Restrict results to a certain domain / URL / prefix	Does not return all indexed URLs; results when no query is provided No sorting
`filetype:`	Restrict file type (by content-type or file extension)	Example: `filetype:rtf galway`
`imagesize:`(Google Images only)	Restrict image dimensions (width x height)	Example: `imagesize:1500x1000`
`src:`(Google Images only)	Find pages that reference a specific image URL	Cross-domain(Lets you see who is hotlinking your images)

7.2 `site:` Practical patterns

Query	Purpose
`site:example.com`	See which pages Google has indexed from your site (may be incomplete)
`site:https://example.com/recipes/tsukemen.html`	Check whether a specific URL is indexed
`site:example.com viagra casino`	Monitor whether spam has been injected into your site
`site:https://example.com/ lemon`	See which URLs on your site rank for "lemon"
`site:https://example.com/page.html lemon`	Check whether a specific URL can rank for "lemon"

⚠️ site:https://www.example.com ≠ site:https://example.com/ — the www subdomain and the bare domain are not the same,be careful to enter the exact value.

7.3 `src:` + `imagesize:` Combinations

src:https://example.com/media/carrot.jpg imagesize:500x1200

→ Find a specific-size version of a particular URL

site:https://example.com/ imagesize:500x1200

→ Find all images of a certain size on your site

7.4 `src:` Check hotlinks

src:https://yoursite.com/your-image.jpg → returns all pages that use this image as their src (cross-domain). an amazing hotlink monitoring tool.

Part 8 — Remove a Page from Google

⚠️ Not your page? → Remove personal info from Google Take a different approach.

8.1 Temporary (takes effect within 1 day, valid for ~6 months)

Search Console → Removals tool → submit a URL prefix or a single URL.

Why temporary: it gives you time to handle the issue permanently.It will come back after expiration.

8.2 The 3 permanent methods

Method	Pros and cons
Delete / modify content	Most thorough — other search engines will also not be able to find it
Password protection	True access control; even Googlebot cannot get in
noindex tag	Only blocks Google; engines that do not support noindex can still find it

⚠️ Do not use robots.txt as a removal tool — see Complete Guide to Crawling and Indexing Control (robots.txt / noindex / X-Robots-Tag / data-nosnippet / rel): disallowed URLs may still be indexed (without content).

8.3 URL variant traps

example.com/puppies / example.com/PUPPIES / example.com/petchooser?pet=puppies may point to the same content.All URLs must be handled, see find the right URL to block.

8.4 How to remove content from other Google properties

Shopping, etc.: Opt out of specific Google properties
Business Profile: Edit business info
Knowledge Panel: Update

Part 9 — Keep Redacted Information Out ⭐⭐⭐

You upload a PDF / image that "looks cleanly redacted",but search engines may dig out hidden information. OCR / document history / metadata are all sources of leaks.

9.1 The 5 major leak sources

Source	How it leaks
"Redaction" inside images	Black rectangles covering text / small font size / same-color background text — OCR can still read it
Document history	Word/PDF may retain change history; pre-redaction content can be recovered
False impression from image cropping	When you "crop" an image in Word/PPT, the public version still contains the full uncropped image
Metadata	Editor name / access records / document ID
URL / filename	Even if blocked by robots.txt, the URL itself may be indexed (without content); if the URL contains an email/name, that is leaked

9.2 Must-dos before redacting

A. Edit images, then embed them

Crop / paint over sensitive areas first before putting them into the document
Completely remove / blur (OCR can read any text → do not use mosaics)
Remove metadata
Export to a non-vector / flattened format (PNG / WEBP) — prevents vectors from containing hidden layers

B. Edit text, then publish

Use a professional redaction tool, do not cover with black rectangles
Double-check the metadata of public documents
Use document redaction best practices (check by format)
URL / filename Avoid emails / names,use hashes
Use authentication + noindex on login pages to restrict access

9.3 What to do if improper redaction has already been indexed — 5-step remediation

1. 把活的 document 从站上撤掉
2. 用 Removals tool(verified site)— 几小时内移
   - 多文件可用 URL prefix
3. 把 redact 干净的版**新 URL 重发** — 防止旧版残留在 Google 缓存
   - 更新所有指向链接
4. 联系**其他可能转载**了未 redact 文档的站
   - 让他们用自己的 Removals tool
   - 或你用 [Outdated Content tool](https://support.google.com/webmasters/answer/7041154) 让 Google 更新搜索结果
5. 等 URL removal 过期(URL 已更新进索引 / ~6 个月,二选一先发生)

⚠️ Verify your site in Search Console before you publish — only then can you use Removals quickly when something goes wrong.

Part 10 — Collection of 14 anti-patterns

#	Anti-pattern	Consequence
1	Modifying Chrome settings without using the Settings API	Flagged as unwanted software
2	Chrome extension silent install	Classified as malware
3	Apps installing a root CA / intercepting SSL (not for debugging)	Serious violation of the unwanted software policy
4	Popping up fake "System critical / You are infected" alerts	Scare tactic, triggers warnings
5	Using "Download" as the only ad text	Misrepresentation, triggers warnings
6	Embedding third-party ads that contain deceptive content	Host page violates the social engineering policy
7	Not disclosing the relationship between parties when integrating third-party services	Social engineering violation
8	Only applying noindex after improper redaction (not publishing a clean version at a new URL)	Google cache / other search engines still have it
9	Covering text with black rectangles when redacting	OCR / PDF readers can still read it
10	Cropping an image after embedding it	The public version of the document still contains the original image
11	URLs / filenames containing sensitive information (email / name)	Even if the page is noindex, the URL leaks the information
12	Using robots.txt to remove already indexed pages	May still appear in results (without content)
13	UGC sites not adding a reputation system + noindex for new user content	Spammers flood in
14	Not adding nofollow / ugc to links in UGC comments	Violates the link spam policy + helps spammers achieve their goal

Part 11 — Related wiki

robots.txt / noindex / X-Robots-Tag details: Complete Guide to Crawling and Indexing Control (robots.txt / noindex / X-Robots-Tag / data-nosnippet / rel)
canonical / redirects / temporary closure 503: Complete Guide to Canonical / Redirects / Site Migration (including full HTTP status code table + 503 temporary closure playbook)
helpful content / E-E-A-T (to avoid being algorithmically judged spammy) / 24 spam policies: Google SEO Basics + How Search Works + Search Essentials
Traffic under attack / sudden drops (may be a security issue): How to Use the Search Console + Analytics + Trends Trio (Traffic Diagnostics / Keyword Research / Looker Studio) 7-step diagnosis
Complete guide to fixing hacked sites: https://web.dev/articles/hacked
Safe Browsing Transparency Report: https://www.google.com/transparencyreport/safebrowsing
Google Security Blog: https://security.googleblog.com/

Last updated

2026-05-17 — Compiled based on Google Search Central's 11-part monitor-debug + remove-information + keep-redacted series (latest as of 2025-12).