Suspicious Link Scanner

• An anchor rendered with display:none, visibility:hidden, zero font size or a large negative offset.
• A commercial destination unrelated to the page's subject.
• A domain that appears exactly once, deep in a template that renders sitewide.
• A link present only in the crawler-view response.

1. STEP 01

   Save the inventory

   Export the list of injected URLs and the pages they appear on.

2. STEP 02

   Clean templates, then stored content

   Reinstall affected themes or plugins from source rather than hand-editing.

3. STEP 03

   Purge caches and CDN

   Cached fragments will otherwise keep serving the links.

4. STEP 04

   Re-scan after 24 hours

   Reappearance means persistence remains on the server.

• Owners of sites whose backlink or outbound-link profile changed without an editorial change.
• WordPress and other CMS administrators after a plugin or theme compromise, where footers and widget areas are the usual injection point.
• SEOs investigating an unexplained ranking drop where the site itself looks visually normal.
• Anyone verifying that a previous cleanup actually removed every injected anchor rather than the visible ones.

Injected outbound links are a form of link spam under Google's spam policies. Because they are usually placed in a sitewide template, a single injection can add thousands of links pointing at unrelated commercial destinations, which both misrepresents your site and signals to search engines that the domain is participating in a link scheme.

Hidden anchors are also the most durable part of a compromise. They generate no visible change, so no one notices, and they survive theme updates when the injection lives in stored content or in the database rather than in a file.

• It cannot say who added a link — that requires server, CMS revision and access logs.
• It cannot see links rendered only for specific visitors unless that condition is reproduced in the request.
• It cannot classify a destination as malicious with certainty; it flags unexpected and hidden anchors so a human can judge.
• It cannot scan authenticated pages or non-public staging environments.
• It cannot remove anything: the output is an inventory used to guide a cleanup.