Removing Malicious Outbound Links From Your Site

By Glenn Lyvers · Updated September 20, 2026 · 4 min read

Something is flagging your site for linking to bad neighbourhoods. You look at your pages and see nothing unusual, because the links were never meant for you to see — they are hidden with styling, tucked into places nobody reads, or shown only to search engine crawlers. Finding all of them is the job, and missing a few is why sites get flagged again a week later.

Why your site has them

Links from established sites carry weight, and that weight can be stolen. An attacker who can write to your pages gets to point search engines at whatever they are promoting, borrowing your domain's credibility to rank content that could never rank on its own. The destinations are usually counterfeit goods, gambling, pharmaceuticals or outright malware.

Occasionally the links are there to damage you rather than to help them, but that is rare. Almost always this is commercial, automated and impersonal, and the same campaign has done it to thousands of sites this month.

How they are hidden from you

Styling is the most common method: text coloured to match the background, positioned far off-screen with negative coordinates, given zero height or width, or wrapped in a container set to display none. The link is present in the HTML, invisible in the browser, and perfectly readable by a crawler.

The second method is conditional output, where the links appear only for requests that look like search engine crawlers — the same cloaking behaviour covered in my guide on cloaking hacks. The third is simply putting them where nobody looks: the bottom of a long post, an unused page, a widget area, or the footer of a template you have not read in years.

Finding all of them

View the rendered source rather than the page, and search it for anchor tags pointing at domains that are not yours. Doing that by eye on one page is easy; doing it across a whole site needs a crawler, and a site-wide crawl that lists every external link by destination domain is the single most efficient tool here. Sort by domain and unfamiliar destinations stand out immediately.

Then search the database directly, because most injected links live in post content, and a query for anchor tags containing the offending domain finds every instance at once. Check your theme templates, your widgets, and any plugin that outputs content site-wide. Finally, fetch a few pages with a crawler user agent and compare, to catch links that only appear for search engines.

Removing them cleanly

Where links were injected into post content, clean the content rather than deleting the posts — a careful find-and-replace across the database removes the injected markup while preserving your writing. Take a database backup before you run anything that modifies content in bulk, because a slightly wrong pattern can take chunks of legitimate text with it.

Where they came from a template or a widget, remove them at source. Where they were generated by injected code, removing the code removes the links. And then keep going, because injected links are a symptom — something had write access to your site, and that is the real finding. My guide on injected spam links covers the WordPress-specific hiding places in more detail.

The rest of the cleanup

Do the full pass: replace core, plugins and theme from clean sources, sweep the database for other injected content, delete administrator accounts you did not create, check scheduled tasks and mu-plugins for persistence, rotate every credential, and close the entry point.

Then verify the way an outsider would: crawl the site again and confirm the external link list contains only destinations you recognize. That list is a genuinely useful artefact to keep, because comparing it against a future crawl makes the next check trivial.

Cleaning up the consequences

Linking to malicious destinations gets sites flagged by browsers and antivirus vendors, so expect some delisting work. The blacklist removal links page collects the forms for each vendor, and my guide on deceptive site warnings covers the browser side.

If the links were extensive enough to attract a manual action, filing a reconsideration request is how that gets lifted. And if you would rather have someone find every last one rather than discover a missed batch when you get flagged again, that is what my malware removal service is for.

Common questions

How do I find hidden links on my own site?

Crawl the whole site and list every outbound link grouped by destination domain — unfamiliar domains stand out instantly. Reading rendered page source works for spot checks, but hidden links are invisible in the browser and often sit on pages you never visit, so a site-wide crawl is the only thorough approach.

Why can I not see them when I look at my pages?

Because they are styled to be invisible — coloured to match the background, moved off-screen, or given no dimensions — or because they are only output to requests that look like search engine crawlers. They are in the HTML and readable by machines either way.

Can I just delete the affected posts?

You could, but you would be deleting your own content to remove a few injected characters. A targeted find-and-replace across the database removes the injected markup and keeps the writing. Take a database backup first, since a badly formed pattern can damage legitimate content.

Will these links hurt my rankings?

They can. Linking out to spam and malware destinations at scale is a quality signal in the wrong direction, and in serious cases it attracts a manual action. It also gets sites flagged by browsers and antivirus vendors, which usually does more immediate commercial damage than the ranking effect.

They came back after I removed them. Why?

Because something on the site is still writing them — typically a backdoor that runs on each request, or a scheduled task. Removing injected links without removing the injector only cleans the output. Go looking for the persistence mechanism rather than repeating the find-and-replace.