A hidden link is an outbound link that is in a page’s HTML but made invisible to the people reading it, for example pushed off the edge of the screen. It is not always a hack, because collapsed menus and skip links use the same techniques, but a hidden link to an outside site that nobody on your team can account for is the classic sign of injected spam.
What Link Signals checks
For every outbound link, Link Signals reads the link and its 7 nearest parent elements and looks for 7 inline-style tricks: display:none, visibility:hidden, a zero font size, zero opacity, a position pushed far off-screen, and a zero width or height. A link also counts as hidden when it, or one of those parents, has the hidden attribute or aria-hidden="true".
<div style="position:absolute;left:-9999px">
<a href="https://cheap-meds-direct.example/viagra">cheap viagra</a>
</div>A hidden link is never judged on its appearance alone. Link Signals still checks where it leads. A hidden link to an otherwise harmless site is at most Needs review, and it is Not safe only when the destination is also confirmed bad.
Is it always a hack?
- Sometimes it is deliberate. A skip link or a menu that opens on a click can be hidden by design.
- Often it is not. Hidden links are most often added by something that has gained access to a site, such as a compromised plugin, theme or account, because the aim is to pass the page’s standing on without anyone noticing.
- Age does not make a site safe. A site nobody has touched in years is a common target because nobody is watching it, and a scan is a quick way to find out.
What it cannot see
Links written by a page’s own inline scripts are read, including ones hidden in an encoded string. Only the encoded ones get the badge. A link written in plain text inside a script is judged like any other link. See script-written links.
Can a hidden link pass ranking credit?
If it is followed, meaning it has no nofollow, sponsored or ugc marker, it can pass credit to its destination, which is the point of the technique. Marking it nofollow limits that but does not explain how it got there. Find out first, then remove it. Link Signals does not speak for any search engine, and Google’s own wording on hidden links is in its spam policies.
What to do
- Open the pageUse Found on in the finding, then view the page source and search for the anchor text.
- Remove it and change passwordsTake out the code that adds it, not only the link, then follow after a WordPress hack.
- Re-checkUse re-check once caches are cleared. Marking a finding reviewed does not fix it.
Hidden links count in the first row of your LinkSignal, once however many ways they are concealed. LinkSignal is Link Signals’ own metric, based only on this tool’s findings and not connected to any search engine or third-party score. See hidden and cloaked links.
Questions
Does Link Signals check hidden internal links?
No. It only evaluates links that go to another site. Links within your own domain, with or without www, are skipped.
Is cloaking checked as well?
Yes, on a sample. About 10% of pages are also compared as a search crawler sees them, which finds links shown only to search engines. A clean sample is not proof that the whole site is clean.
Where do I see hidden links in the report?
On the Overview tab, the Out of context links card shows a red Hidden with styling number. Review these links opens the Findings tab, where each one carries a red Hidden chip.
Paste your sitemap and Link Signals reads every outbound link on every page your plan covers.
