In your report
When a scan finds links to malware or phishing destinations, the overview shows a Malware and phishing card. It is one of the category cards, which break the flagged links down by what they are about. The card is marked High risk, and it appears first among the categories because malware is the most serious thing a link can lead to.
The card shows four numbers: Flagged links, On a blocklist, Off-topic for their page and Hidden from visitors. Its advice reads: treat the links as urgent, remove them, and check your pages for how they got there. Review these links opens the findings list filtered to this category.
In that list, each link has the category chip malware, and often an Out of context chip, because a site about gardening or accounting has no reason to point at malware. The link is usually marked Not safe. If it is also concealed, you will see a Hidden, Cloaked or Hidden in script chip as well.
Out of context: “Contact us” links to malware content
/contact · Anchor text “verify your account”How a link ends up in this card
Malware and phishing are judged differently from some other categories. The bundled blocklists cover adult, gambling and violent content only. They do not include malware or phishing lists, so the On a blocklist number on this card is normally zero.
Instead, the destination page is read, and an AI check decides whether it looks like malware or phishing, given the page’s title and text. It also compares the destination with the page carrying the link and the anchor text, which is where the Out of context chip comes from.
Why it matters
- Visitors who follow the link may be asked for passwords or card details, or have software forced onto their device. The blame lands on your site.
- Browsers and search engines can warn people away from a site that links to harmful pages.
- On most sites, nobody chose these links. They are a strong sign that something has been changed without permission.
What to do, in order
- Do not click the link on a normal deviceRead the destination address in the finding instead. If you need to see the page, use a device you can afford to lose access to, or leave it to a security professional.
- Find the link in your own pagesUse the Found on column to open the page, view the source with Ctrl+U, and search for the anchor text or the destination’s domain.
- Remove itDelete the link from the page, template or widget it comes from. If it is in the database, a post or a menu item, edit it there.
- Find how it got thereCheck recently changed plugins, themes and user accounts, and look for logins you do not recognise. After a WordPress hack walks through the usual routes.
- Change the passwords that matterReset hosting, admin and database passwords, and update everything that can be updated. Removing the link without closing the way in lets it return.
- Tell your hostMany hosts can scan the files, restore a clean backup or confirm what else has changed.
Hacked site or false positive?
Links to malware are rarely deliberate. On a hacked site they are typically injected into posts, footers or widgets, often hidden from visitors with styles or scripts, so check the Hidden from visitors number first. A link in plain view in an old comment or forum post can instead be a user who posted something harmful, or a good site that has since been compromised.
False positives do happen. A security-research blog that quotes a phishing address as an example, or a cyber-safety article that links to a test page, may be flagged correctly by the rules and still be perfectly legitimate. If the link is genuinely intended, and you are certain the destination is what you think it is, mark it reviewed and make the link plain text if the address does not need to be clickable.
Common mistakes
- Removing the link and stopping. The link is a symptom. The way in is still open.
- Visiting the destination out of curiosity. Use the details in the finding.
- Dismissing it because it is hidden. Hidden links are the usual sign of injection, not a reason to relax.
- Assuming no flag means safe. The check is a judgement and has limits.
How to confirm the fix
After removing a link, use Re-check to confirm it is no longer on the page. Then run a new scan so the whole site is read again, and keep an eye on later scans, because injected links often come back until the cause is fixed.
Questions
Why does the card say 0 on a blocklist?
Because the bundled blocklists do not cover malware or phishing. Those links are judged by an AI check of the destination page, so the blocklist count for this card is usually zero.
Is every link on this card definitely malware?
No. It is a judgement. Look at the reason in the finding and the destination, and use Mark reviewed if you are sure it is fine.
Why is it High risk even if only one link is listed?
One link is enough. A single injected link to a phishing page can reach every visitor to that page.
Does Link Signals clean my site?
No. It reads the pages and reports what they link to. Removing links and securing the site is done by you or your developer.
How this counts in your LinkSignal
A link to a malware or phishing site is flagged as risky or unsafe, and that is what links that need review counts in your site’s external LinkSignal. If the same link is hidden, or sits on a page it does not fit, it is counted once in the hidden, cloaked and script-injected links or out of context links row instead. The LinkSignal overview lists every row, and how the score is worked out gives the points. LinkSignal is Link Signals’ own metric, worked out only from what this tool finds, and it is not connected to any search engine or third-party score.
Paste your sitemap and see whether any page links to somewhere it should not.
