4 ms·

There's a simpler explanation, which is that the site really was hacked as we claimed. Here's an example cached page that we crawled on May 2nd: http://webcache

There's a simpler explanation, which is that the site really was hacked as we claimed. Here's an example cached page that we crawled on May 2nd: http://webcache.googleusercontent.com/search?q=cache:zl9t7DQwkH4J:model1.webdesigncompany.net/articles/&hl=en&gl=us&prmd=imvns&strip=0 http://webcache.googleusercontent.com/search?q=cache:zl9t7DQ... I count the name of one drug repeated over 100+ times. I've been quite clear that there's nothing wrong with A/B testing. In fact, less than a month ago I tweeted that "A/B testing can be really helpful" and included a link to best practices: https://twitter.com/#!/mattcutts/statuses/191658511149711360 https://twitter.com/#!/mattcutts/statuses/191658511149711360

saurik 14y ago
That is not the same website: that is model1.webdesigncompany.net, which seems to be some kind of lorem-ipsum design or functionality demonstration. That site does not seem to be linked from www.webdesigncompany.net (based on a complete recursive wget of that site) and is not hosted on the same server as www.webdesigncompany.net: the only thing it shares with www.webdesigncompany.net is the domain name. It is also not entirely clear that it actually has been hacked. Is this kind of circumstantial evidence really relevant for Google?
- Matt_Cutts 14y ago
  Hi saurik, here's what I can tell from home on a Sunday night: - some pages on the domain were definitely hacked across multiple pages for weeks. - we detected hacked pages on the site both manually and algorithmically based on our hacked site classifier. - we sent a message via the webmaster console on May 5th to alert the site owner so they'd have a heads-up. - it looks like this has nothing at all to do with A/B testing (which as I've said before is perfectly fine to do). That's what I know with near 100% confidence. Here's what I believe, but won't be able to confirm until tomorrow when I can talk to a few folks. I think the domain was hacked in multiple ways. I found the hacked pages on model1.webdesigncompany.net just from doing site: searches. And you're right that those are auxiliary pages, not related to the main part of the site. But I suspect the core site was also hacked, based on looking at the manual action that was submitted. I'll be happy to talk to the relevant webspam people to ask for more details.
melvinram 14y ago
Hi Matt, Looks like the subdomain you referenced did have a hack, but the main site didn't. I had done a Google fetchbot request to check before hand. Regardless, I can see how having hacked subdomains might trigger the warning. Based on your comment, should we understand that split testing, where it actually redirects to a few different separate pages, is an okay form of testing that won't trigger the "this site was compromised" warning?
- Matt_Cutts 14y ago
  melvinram, that's correct. Split testing is a perfectly fine form of testing and doesn't have anything to do with the "this site was compromised" warning. That's the high-order bit. If you want low-level/detailed info, we discuss this topic on our support page at http://support.google.com/websiteoptimizer/bin/answer.py?hl=en&answer=72507 http://support.google.com/websiteoptimizer/bin/answer.py?hl=... . Hope that helps.
  - melvinram 14y ago
    Thanks for the clarification.
    - Matt_Cutts 14y ago
      P.S. Looks like the robots.txt now blocks /wp-includes/ . If you remove that block, we should be able to crawl the relevant files and verify that they're clean (or more accurately, 404) now, which would let the system auto-revoke the hacked label.
      - melvinram 14y ago
        Updated it. PS: Thanks again for your help on this.

saurik 14y ago

That is not the same website: that is model1.webdesigncompany.net, which seems to be some kind of lorem-ipsum design or functionality demonstration. That site does not seem to be linked from www.webdesigncompany.net (based on a complete recursive wget of that site) and is not hosted on the same server as www.webdesigncompany.net: the only thing it shares with www.webdesigncompany.net is the domain name. It is also not entirely clear that it actually has been hacked. Is this kind of circumstantial evidence really relevant for Google?

Matt_Cutts 14y ago
Hi saurik, here's what I can tell from home on a Sunday night: - some pages on the domain were definitely hacked across multiple pages for weeks. - we detected hacked pages on the site both manually and algorithmically based on our hacked site classifier. - we sent a message via the webmaster console on May 5th to alert the site owner so they'd have a heads-up. - it looks like this has nothing at all to do with A/B testing (which as I've said before is perfectly fine to do). That's what I know with near 100% confidence. Here's what I believe, but won't be able to confirm until tomorrow when I can talk to a few folks. I think the domain was hacked in multiple ways. I found the hacked pages on model1.webdesigncompany.net just from doing site: searches. And you're right that those are auxiliary pages, not related to the main part of the site. But I suspect the core site was also hacked, based on looking at the manual action that was submitted. I'll be happy to talk to the relevant webspam people to ask for more details.

melvinram 14y ago

Hi Matt, Looks like the subdomain you referenced did have a hack, but the main site didn't. I had done a Google fetchbot request to check before hand. Regardless, I can see how having hacked subdomains might trigger the warning. Based on your comment, should we understand that split testing, where it actually redirects to a few different separate pages, is an okay form of testing that won't trigger the "this site was compromised" warning?

Matt_Cutts 14y ago
melvinram, that's correct. Split testing is a perfectly fine form of testing and doesn't have anything to do with the "this site was compromised" warning. That's the high-order bit. If you want low-level/detailed info, we discuss this topic on our support page at http://support.google.com/websiteoptimizer/bin/answer.py?hl=en&answer=72507 http://support.google.com/websiteoptimizer/bin/answer.py?hl=... . Hope that helps.
- melvinram 14y ago
  Thanks for the clarification.
  - Matt_Cutts 14y ago
    P.S. Looks like the robots.txt now blocks /wp-includes/ . If you remove that block, we should be able to crawl the relevant files and verify that they're clean (or more accurately, 404) now, which would let the system auto-revoke the hacked label.
    - melvinram 14y ago
      Updated it. PS: Thanks again for your help on this.