Blog

The latest news from Google AI

Helping webmasters re-secure their sites

Monday, April 18, 2016

Posted by Kurt Thomas and Yuan Niu, Spam & Abuse Research10 million users encounter harmful websites‘this site may harm your computer’hereInternational World Wide Web ConferenceHow many sites get compromised?

Number of freshly compromised sites Google detects every week.

drive-by downloads
Finding the most effective ways to aid webmasters

Getting in touch with webmasters: One of the hardest steps on the road to recovery is first getting in contact with webmasters. We tried three notification channels: email, browser warnings, and search warnings. For webmasters who proactively registered their site with Search Console, we found that email communication led to 75% of webmasters re-securing their pages. When we didn’t know a webmaster’s email address, browser warnings and search warnings helped 54% and 43% of sites clean up respectively.

Providing tips on cleaning up harmful content: Attackers rely on hidden files, easy-to-miss redirects, and remote inclusions to serve scams and malware. This makes clean-up increasingly tricky. When we emailed webmasters, we included tips and samples of exactly which pages contained harmful content. This, combined with expedited notification, helped webmasters clean up 62% faster compared to no tips—usually within 3 days.

Making sure sites stay clean: Once a site is no longer serving harmful content, it’s important to make sure attackers don’t reassert control. We monitored recently cleaned websites and found 12% were compromised again in 30 days. This illustrates the challenge involved in identifying the root cause of a breach versus dealing with the side-effects.

Making security issues less painful for webmasters—and everyoneeasier to receive security notifications through Google AnalyticsSearch Consoleupdating your site’s softwareadding additional authentication