Links hidden in scripts: how they’re found

What it looks like

Searching the page source for the destination’s domain finds nothing, which is the point. The address is stored as an encoded string and decoded only when the page runs.

<script>document.write(atob("PGEgaHJlZj0iaHR0cHM6Ly9jaGVhcC1waWxscy5leGFtcGxlL2J1eSI+Y2hlYXAgbWVkczwvYT4="));</script>

What Link Signals reads

Link Signals reads the text of a page’s inline scripts. It does not run them. It looks for links being written into the page and decodes the usual ways of hiding them.

How it appears in a report

A link found inside an encoded string is marked Needs review at the least, even when the destination looks harmless, because legitimate widgets rarely hide their links this way. If the destination is also on a blocklist, it is Not safe.

What to do when you find one

1. Open the page sourceOpen the page in Found on, press Ctrl+U, and search for atob, fromCharCode, unescape and eval near the anchor text in the finding.
2. Work out where the script is addedA footer or header in the theme, a plugin setting, or a value in the database options table are the usual places.
3. Remove it and close the way inRemove the script, change passwords, update plugins and themes, and remove anything you don’t recognise.
4. Scan againClear caches and run a new scan to confirm the finding is gone.

Why attackers use scripts

Searching the HTML for a domain is the first thing most people do when they suspect injected links, and a script that builds the link at load time defeats it. Encoding the address adds a second layer: even a search of the script finds only meaningless characters. The links are still written into the page when it loads, so a browser or crawler that runs scripts sees them.

Scripts that are legitimate

• Widgets, banners and embedded players that write links in plain text. These are judged on their destination like any other link, with no badge.
• Analytics and consent tools, which usually load from other files and are not read.
• Templates that build navigation in JavaScript.

Encoding a link inside an inline script is the unusual part. That is why the badge and the review verdict only apply to encoded links.

Where the code usually hides

• A theme’s header or footer file, or a “custom code” setting.
• A plugin that inserts snippets, or one that has been replaced by a malicious copy.
• The database, in a widget, option or post whose content contains a script tag.
• A compromised third-party script that is loaded on every page.

Common mistakes

• Removing the script from one page when the template adds it to all of them.
• Deleting the visible link but leaving the loader, which writes another one the next time.
• Searching for the destination’s domain in the source. It will not be there, so search for the function names instead: atob, unescape, fromCharCode.
• Assuming the problem is solved after cleaning files when the malicious script lives in the database.

How to confirm it is fixed

Run a re-check from the report’s Overview tab after the fix. It reads only the pages your flagged links are on, so it takes a minute or two. Marking a finding as reviewed does not close it: the next scan reads the page again and calls the finding resolved only when the link is gone or no longer flagged. On a monitored site, later checks keep watching for it to come back.

In your report

Links found inside an encoded script are counted on the Out of context links card on the Overview tab, in the red Hidden in scripts number, under the card’s Priority 3 chip by default. Review these links opens the Findings tab on its Out of context tab, where each of them carries a red Hidden in script chip.

• Only links hidden inside an encoded string are counted. A link written in plain text by a script is judged like any other link and gets no chip.
• The detail panel says “A script writes this link into the page and the link is stored in an encoded string. Legitimate widgets rarely hide their links this way; injected code usually does”.
• Such a link is Needs review at the least, and Not safe if its destination is on a blocklist.
• The same link is also counted in the Hidden from visitors number on a category card, such as Pharma or Gambling.

The fix is in the script, not in the visible page, so use Found on to see which page carries it, then look for the code that adds it to every page. Out of context links explains the rest of the card.

How this counts in your LinkSignal

A script-injected link is counted in the hidden, cloaked and script-injected links row of your site’s external LinkSignal, alongside hidden and cloaked links. The row’s points and limit are in how the score is worked out, and the LinkSignal overview lists the other rows. LinkSignal is Link Signals’ own metric, worked out only from what this tool finds, and it is not connected to any search engine or third-party score.