SEO Poisoning Scanner

What It Does

The SEO Poisoning Scanner (SecuPress Pro) looks for external links injected into the public pages of the site. It needs WordPress 6.5 or newer.

Each run fetches the homepage, a search URL, a missing page, one published post, and one published page, when those contents exist. It then lists http and https links that point outside the site.

The site’s own host is ignored, as are w.org, wordpress.org, and wp.org. A host already on the allowed list is ignored too. The allowed list is matched by host: www is stripped, so www.example.com and example.com are the same host.

The Status column is not a reputation verdict yet. Read the link, then allow the host if it belongs on the site, or remove the link from the content if it does not.

Why It Matters

SEO poisoning hides spam or scam links in a post, a page, or the theme output. Search engines then associate the site with those addresses. A single allowed URL is not enough: the same host often comes back on another page. Allowing the host covers that host everywhere.

How to Use

Open the Malware Scanners module and run a scan. The SEO Poisoning Scanner row shows how many issues were found. Open the row to review them.

Each row shows the source URL, the external link, and the host. Select the hosts you trust and click Add to allowed list. Allowing one result allows that whole host.

When every detected link is already allowed, the details say that no action is needed.

In Expert Mode, the Scan button on this row runs this scanner alone.

The list of tags and attributes to inspect, the URLs to fetch, and the hosts that are always allowed can be changed with secupress.content-spam.scanner.tags, secupress.content-spam.scanner.test_urls, and secupress.content-spam.scanner.allowed_domains.