Hidden links: how to find them on your site

What a hidden link looks like

Visitors see an ordinary page. The HTML underneath contains a link that has been pushed off-screen or made invisible, so a crawler reads it and a person never does.

<div style="position:absolute;left:-9999px">
  <a href="https://cheap-meds-direct.example/viagra">cheap viagra</a>
</div>

The usual motive is to pass your site’s standing to the destination without anyone noticing. Links like this are most often added by something that has gained access to a site, such as a compromised plugin, theme or account, rather than by the people who run it.

What Link Signals checks

For every outbound link on a page, Link Signals reads the link and its 7 nearest parent elements and looks at their inline style attributes for these 7 techniques.

A link also counts as hidden if it, or one of those parent elements, has the HTML hidden attribute or aria-hidden="true".

How a hidden link is reported

A hidden link is never judged on its appearance alone. Link Signals still checks where it leads, then adds a Hidden badge to the finding. The example below was flagged for two reasons at once: the link is hidden, and a pharmacy link has no place on an About page.

In the report’s detail panel the same finding adds: “The link is hidden from visitors with inline CSS — a common sign of injected spam.”

Hidden is not the same as harmful. Collapsed menus and tabs can use the same styles. A hidden link to an otherwise harmless site is, at most, marked Needs review, and it is only Not safe when the destination is also confirmed bad.

What to do when you find one

1. Open the pageUse the Found on column to open the page that contains the link.
2. View the sourcePress Ctrl+U in most browsers to view the page source, then search for the anchor text shown in the finding.
3. Find where it comes fromLook at the element around the link. In a footer or widget area, a template or widget is the likely source. Inside an article, check the post content.
4. Remove it and scan againAfter removing the link and clearing any caches, run a new scan and check that the finding is gone.

Why hidden links matter

A hidden link is rarely there by accident. For search, Google’s spam policies list hidden text and links among the techniques to avoid, and a site that carries them risks being treated as spam. For visitors, the page looks normal, so nobody notices that it is vouching for a pharmacy or a casino. For trust, the real damage is often done long before anyone looks: the link may sit in the HTML for months while the site’s owner sees nothing wrong.

Where hidden links sit in your action plan

Hidden links are grouped under Out of context in the report’s action plan, which comes third by default, after parked and unregistered domains. You can change that order in set your priority order if hidden links matter more to you.

Common mistakes

• Deleting the link from one page when it comes from a template, widget or plugin that writes it into every page.
• Removing the link but leaving the code that added it, so it returns on the next page load.
• Forgetting to clear page, plugin and server caches, then concluding the fix did not work.
• Marking the finding as reviewed without changing the page. Reviewed is not fixed.
• Treating a clean result as proof that no hidden links exist, when the limits above mean some styles are not read.

How to confirm it is fixed

Run a re-check from the report’s Overview tab after the fix. It reads only the pages your flagged links are on, so it takes a minute or two. Marking a finding as reviewed does not close it: the next scan reads the page again and calls the finding resolved only when the link is gone or no longer flagged. On a monitored site, later checks keep watching for it to come back.

In your report

Hidden links are counted on the Out of context links card on the Overview tab, in the red Hidden with styling number. The card carries a Priority 3 chip by default. Selecting Review these links opens the Findings tab on its Out of context tab, where each hidden link has a red Hidden chip in the Signals column.

• The number counts links hidden with inline styles, or with the hidden or aria-hidden attributes. It counts only links whose destination was flagged as unsafe or needing review.
• A link that is also cloaked or written by a script is counted in each of those numbers too, so the numbers on the card can add up to more than the links it lists.
• The detail panel says “The link is hidden from visitors with inline CSS — a common sign of injected spam”, and its What to do note usually reads “Remove this link” when the link is still followed.
• The Hidden from visitors number on a category card, such as Pharma or Gambling, counts the same links together with cloaked and script-written ones.

A hidden link is treated as a possible hack, so the card’s advice is to find out how it was added, remove it, and change your passwords. Out of context links explains the rest of the card.

How this counts in your LinkSignal

Every hidden link found in a scan is counted in the hidden, cloaked and script-injected links row of your site’s external LinkSignal, once, however many ways it is concealed. The row’s points and limit are set out in how the score is worked out, and the LinkSignal overview lists the other rows. LinkSignal is Link Signals’ own metric, worked out only from what this tool finds, and it is not connected to any search engine or third-party score.