The Unsuspecting Recruit: Why every SEO MUST learn Internet security

Internet security is a big problem, and it isn’t just for the IT staff anymore. It affects us as SEOs. Don’t believe me? Consider the incident reported at the end of last year by security research firm Sunbelt Software.

…criminals are now combining SEO tactics and booby-trapped Web pages, and doing it systematically. By posting tens of thousands of Web sites simultaneously, criminals can take over all the top spots on a search results page, casting a wide net that’s more likely to catch Web users. Eckelberry described these criminals as “SEO Gods,” saying they can “take any site and get it on the first page of Google results.”

Instead of wasting energy defacing sites and showing them off as trophies to their peers on IRC, hackers are now modifying the code of hacked sites to include (invisible) links to their web properties or link farms. The article talks about virus writers creating tens of thousands of websites and cross-linking them using all sorts of queries as anchor text. They then spam blog comments around the Web to improve the overall PageRank of the link farm.

Hackers already know how to break into sites. Now that they see the profit that can be made from top-ten search rankings, they have adapted their techniques to break to take advantage. Currently, search engines’ quality reviewers can detect most sites utilizing these black-hat techniques because they show up pretty obviously as SPAM. However, this is just the beginning, and I’m willing to predict that this is going to scale with cleverer hacks that are harder to detect. Most break-ins will be highly sophisticated and highly automated. They will “recruit” thousands of computers into their link-farm. If your site is one of those “recruited” without your knowledge, your site will most likely be penalized by the search engine along with the whole group.

How can somebody break into my server if they don’t know my password?

I remember my days working for a big ISP, setting up firewalls, installing the latest patches and hardening servers. It was a constant battle between the hackers and me (crackers is the correct term, but I will use hackers out of habit). One day one of the consultants the company hired to do penetration testing told me that I was not letting him “do his job.” He meant breaking into the servers of course; the only thing left for me to do, he said, was to disconnect the servers from the network. I couldn’t resist laughing out loud.

I had another boss once that would ask me simply to change the passwords each time our sites got hacked. He didn’t even want to buy a firewall, the most basic form of protection. Why changing the password is ineffective may be too obvious for those of you with some security background—but that’s clearly not everyone.

Hackers break into systems by exploiting software vulnerabilities. These vulnerabilities exist because most software is tested under “normal” circumstances. Software developers don’t usually expect users to provide input designed to fool the program into doing something it was not designed to do. But that’s exactly what hackers do using buffer overflows, string format attacks, script and SQL injection, default passwords, and other tools of the trade.

Protect your site from hackers now

You can protect your site or blog from such attacks, however. The first order of business is fairly straightforward:

  1. Server hardening. Update all software, apply the latest security patches and disable all unneeded services.

  2. Install a firewall.

  3. Install an Internet security scanner and instruction detection, such as Set it up to poll your site every day and address all issues that come up in the reports.

Unfortunately, some setups require a large number of software packages and keeping that list of components up to date can be quite a nightmare. The most common approach to deal with this is to use a multilayer approach—separate servers that do specific functions, such as a web server, database server, application server, etc. It is also common to host the blog, forum, chat rooms, and other elements on separate servers because each requires different applications and poses new security risks. The idea behind all this is to, at the very least, isolate the sensitive parts of your system, like your e-commerce components, customer list, and other delicate information.

Where SEO meets security

When you set up a blog or forum on a separate server, you still want to have it linked from the main site, typically using subdomains like or The problem with this approach for SEO purposes is that search engines regularly treat each subdomain as a separate site when counting incoming links. The incoming link juice is therefore split among the domains. Google makes an exception only when displaying search results.

The single domain will benefit from higher rankings if links to the subdomains are funneled to the main one. Luckily, there is a technique to do this—reverse proxies. I have mentioned reverse proxies in the past and they are very useful beasts. In a nutshell, a reverse proxy sits in front of the web server, receives all requests, does some special processing (such as caching) and forwards the requests to the actual servers. A reverse proxy can be used to map URLs to different servers, and this feature comes in very handy for SEO.

We can use Apache’s mod_proxy for this. Here is a sample configuration

ProxyRequests Off

<Proxy *>
Order deny,allow
Allow from all

ProxyPass /blog
ProxyPassReverse /forum

Instead of directing users to, we write a reverse proxy rule to send requests for to the internal server We can do the same for forums, chat, e-commerce systems, and so on. It is completely transparent to the user (and search engines) that the website is divided among multiple servers. Note that each web server will need to be isolated completely for the security to work. If someone breaks into the blog because the software hasn’t been updated, for instance, at least he won’t get to the e-commerce system.

Internet security is a very large (and interesting) topic. I will talk about it more in the future if there is enough interest. As usual, please share what you think in the comments.

15 replies
  1. Manual Directory Sub
    Manual Directory Sub says:

    Hamlet, it is very nice at informative post.

    I had attended a cyber security conference in india where top security experts told that it is the race of cat and rat. Some times softwares become smart not to hack like instead of 64 bit security, 128 bit security come and now 256 bit security is common. At other side hackers are very smart as well. They see the security holes in softwares itself.

    So it means that we need to buy latest antivirus, internet security and operating system and live update all these continuously or choose open source which is quite a difficult for new users.

    We need to face this security problem in our day to day life. Every body is affected not just tech community.

    So we must ready to be the part of this cat and rat race.

    Padhamanabha Sharma
    Directory Maximizer
    Manual Directory Submission Service

  2. Andy
    Andy says:

    Thanks for the interesting post Hamlet.

    To move the subject on, maybe talk about how to tell when your service is being probed for weaknesses?

    As a forum moderator, I suspect that many weird posts are possibly due to some kind of test or that some member registrations are to do with setting up a future spam attack.


  3. JD
    JD says:

    Great article. Through posts like this, I think bloggers are beginning to realize the importance of security. I remember late last year a few articles about security issues with WordPress, I think we all need to keep abreast as you suggest.

  4. says:

    Hi Hamlet,
    Great post. Really. This battle will exist as long as someone will be ready to pay a lot of money for top 10 on Google.

    Your blog redesign added a lot of character to your writing (I am aware you changed it a while ago).

  5. harley
    harley says:

    this happen recently to godaddy, got hacked and so was other big websites stealing their domain names. Hopefully this get sorted out! Thanks for the article!


Trackbacks & Pingbacks

  1. […] The Unsuspecting Recruit: Why every SEO MUST learn Internet security […]

  2. […] The Unsuspecting Recruit: Why every SEO MUST learn Internet security – A very good post about protecting your site from hackers. […]

Leave a Reply

Want to join the discussion?
Feel free to contribute!

Leave a Reply

Your email address will not be published. Required fields are marked *