The steps
- Find your sitemapWordPress 5.5 and later publishes
/wp-sitemap.xml, while Yoast and Rank Math use/sitemap_index.xml. See how to find your sitemap URL. - Run a scanPaste the sitemap address on the New scan page, load it, and run the scan. The page count tells you how much of the site your plan covers.
- Start with the headline and the action planThe report opens with a paragraph that lists what was found, in order, each part linking to its findings. Hidden and out-of-context links are under Out of context: a pharmacy, casino or loan link on a page about something else, especially a hidden one, is the strongest sign of injection. The Pharma, Gambling and Adult cards link straight to those links.
- View the source of the pageOpen the page in Found on and press Ctrl+U. Search the source for the anchor text shown in the finding.
- Remove the link at its sourceFooters, widgets, theme files and post content are the usual places. A finding appears once, against the first page it was found on, so the same link may be on many more. If it appears across the site, the source is probably a template.
- Re-check, then keep watchingOnce the links are removed and caches are cleared, use Re-check on the report to confirm just those links are gone, without scanning the whole site. Then add the site to monitoring, because a hack that got in once can get in again.
Out of context: “About us” links to pharma content (hidden link)
/about · Anchor text “cheap viagra”Which findings to open first
A scan of a compromised site can return a long list, and most of it will not be the hack. These are the findings that most often are, roughly in the order worth looking at them.
| Look for | Why it points to an injection | What to do |
|---|---|---|
| A Hidden badge | Nobody hides a link from visitors by accident. See hidden links. | Find it in the page source and trace it to the template, widget or post that carries it. |
| Shown only to search engines | The page serves different links to a crawler. See cloaked links. | Check the theme and plugins for code that tests who is asking. |
| Hidden in script | An address stored as encoded text is rare in honest code. See script-written links. | Search the source for atob, unescape and fromCharCode, and check the database as well as the files. |
| Pharma, gambling or adult links on an unrelated page | These are the usual products of an injection. See pharma links. | Remove the link, then find how it got there. |
| The same destination on many pages | A single change in a template or widget reaches every page. | Fix the template once, then re-check. |
On a paid plan you can change the priority order so that out-of-context links come first, which suits a site that has just been hacked. The findings are the same either way. Only the order changes.
A worked example
A garden centre’s site starts getting odd search traffic. The owner runs a scan and the headline names a handful of pharma links, each flagged Hidden, on pages that are about bulbs and lawn care. The same two destinations appear across several posts, and the Found on column shows the earliest page for each.
Viewing the source of one page shows the links inside a hidden block at the bottom of the footer, so the owner asks the developer to check the footer and any widget that outputs it. The developer finds a modified widget, removes the block, updates the plugins and changes the passwords. The owner clears the caches and uses Re-check. The findings leave the report as resolved, and the site is added to monitoring.
The scan told the owner where to look. It did not say how the site was compromised, and finding that out was a separate job.
Mistakes to avoid
- Removing only the link you can see. If a template adds it, it will be back on the next page load. Fix the source.
- Marking a finding as reviewed instead of removing the link. Reviewed is a request to check again, not a fix. See mark a finding reviewed.
- Ignoring a finding because the destination looks harmless. An injected link can point at an ordinary-looking page today and something else next week.
- Treating a clean scan as the end. Pages outside the sitemap are not read, and some techniques are missed. Keep monitoring on.
- Skipping the evidence. Export the findings to a spreadsheet before you clean up, so there is a record of what was found and where. See export a report to CSV.
Questions
Does Link Signals clean the site for me?
No. It finds and reports links. Removing them is up to you, and it does not change your site.
Will it find every injected link?
No. It finds links in the HTML of the pages in your sitemap. Links written by a page’s own scripts, including encoded ones, are found. Links built by scripts loaded from other files, hidden by stylesheet classes, or shown only to crawlers that are verified by network address can be missed.
Do I need to give it access to WordPress?
No. It reads your public sitemap and public pages only.
How do I know the clean-up worked?
Use Re-check on the report. It reads the pages the flagged links were on and marks a finding resolved only when the link is gone or no longer flagged. Monitoring then checks again on its schedule.
How this counts in your LinkSignal
Injected links usually show up in two rows of your site’s external LinkSignal: hidden, cloaked and script-injected links and out of context links. Watching those rows fall after a clean-up is a quick check, alongside a re-check of the flagged pages. The LinkSignal overview lists every row. LinkSignal is Link Signals’ own metric, worked out only from what this tool finds, and it is not connected to any search engine or third-party score.
Paste your sitemap and check every outbound link.
