Stumbled on an interesting black hat SEO link building strategy this week that those tending towards the white hat SEO arena should steer well clear of.
Letsencrypt uses the Discourse Forum Software from discourse.org. After 15+ years of SEO research I find it difficult to visit a website without having a look at the HTML code behind the curtain and as I visited the Discourse Forum I viewed source (Right Click the webpage, “View Page Source”) and found what appeared to be a semi-hidden link within a noscript tag.
That got my SEO juices flowing: that sounded much better in my head!!!
For the record the people behind the Letsencrypt site (and other Discourse Forum script users) haven’t done anything black hat, they like many other unsuspecting webmasters have installed the Discourse Forum script to run their forum: it’s the people behind discourse.org who are using black hat SEO link building techniques to build quick backlinks to their sites.
What’s a Semi-Hidden Link Within a Noscript Tag?
Black hat SEO Semi-Hiding Links within Noscript Tags
Semi-hiding links within a noscript tag is a REALLY, REALLY old black hat SEO technique. The noscript tag is for a webpage using javascript to serve content & that content doesn’t work correctly if the visitors is using a browser with javascript disabled.
A small number of weird people turn javascript off :-)
In HTML code terms you’ll see something like this in the code source:
<noscript> Some content here that's available via javascript, but doesn't work correctly when javascript is disabled. Flash based content is a good example. You might also see a message the website is best viewed with javascript enabled. </noscript>
The above is the correct use of the noscript tag, the content found within the noscript tag should also be available to visitors with javascript enabled minus the “best viewed with javascript enabled” message (that’s only for the non-javascript users).
When I viewed source of a Discourse Forum webpage I found this:
Discourse Forum Software Semi-Hidden Noscript Link
Technically speaking there’s nothing wrong with the link or the message as long as the link is also shown to visitors with javascript enabled: guess what, the link to https://www.discourse.org does NOT show for those visitors, that’s a semi-hidden text link.
Normally I’d confirm the hidden text link by viewing the Googlecache of a webpage, but I got lazy and assumed it would be in the cache and informed the Letsencrypt forum they have a hidden link and should fix it ASAP: Hidden Link to Discource.org, Potential SEO Issue (I was in that much of a rush I also spelled Discourse wrong, Doh!).
Eventually I checked the Googlecache and here’s where it got interesting, we now go into the hidden realms of black hat SEO cloaking techniques.
What is Black hat SEO Link Cloaking?
What is Black hat SEO Link Cloaking?
When search engine spiders like Googlebot visit websites they use specific user-agents, webmasters can use Googlebots user-agent to serve Google content NOT served to other visitors. If you are contemplating using black hat SEO link cloaking, consider when caught your site will receive a Google penalty!
For example you might have links in an image-map, image-map links can not be indexed by Google, so it would be acceptable to serve Googlebot those links in another format. General visitors see the links in an image-map, Googlebot sees them as text links or standard image links (a clickable image link). As long as a general visitor and Google sees pretty much the same content AND you aren’t gaming Google, it’s acceptable to use cloaking.
I use another form of cloaking for the “Subscribe” to comment link (look above the “Submit Comment” button below). This link goes to webpages (the URLs change for each Post and visitor: potentially a LOT of these webpages and they’d be close to duplicates) I don’t want indexed and Google wouldn’t want indexed. The webpages have a noindex robots meta tag (Google shouldn’t index them) and the links are cloaked using javascript so Google doesn’t spider them: Google ‘sees’ the “Subscribe” link as body text.
Black Hat SEO Techniques Gamble with your Websites Future
This is where what discourse.org are doing gets interesting.
The link to discourse.org and javascript message within the noscript tag is NOT served to Googlebot within a noscript tag, it’s within standard body text. View a Discourse forum webpages Googlecache and the link and message are at the bottom: the vast majority of visitors to a Discourse forum will NOT see that link, it is there purely for SEO reasons (to benefit Discourse, NOT the webmaster of the forum).
What Discourse are doing here is checking for the Googlebot user-agent and serving different content to Googlebot.
Potentially a Google penalty incurring SEO issue.
It’s quite clever black hat SEO setup that’s not easy to spot.
Googlebot gets a sitewide text link to the Discourse home page, as it’s not within a noscript tag** Googlebot will definitely pass full SEO benefit through this link.
** Some SEO experts argue links within noscript tags won’t pass full SEO link benefit because they are hidden to most users: from an SEO perspective it’s difficult to test, so best to avoid adding important links within noscript tags if they aren’t available in standard body text.
Check this Google SERP out “Powered by Discourse, best viewed with JavaScript enabled” (include the speech marks) – https://www.google.co.uk/search?q=%22Powered+by+Discourse%2C+best+viewed+with+JavaScript+enabled%22
Google Indexed Hidden Text Links to Discourse.org Using Cloaking
That’s 1.7 million webpages using that exact phrase, that’s probably 1.7 million hidden backlinks, some serious link benefit they are stealing from their forum software users! There’s an SEO market for buying/selling links, it could cost hundreds of thousands of dollars to buy this number of text links from quality websites and they are getting them for free.
If a webmaster notices the above links in the Googlecache say and check out their forum (viewing source) they find the link within the noscript tag, which though not a particularly ethical way to gain a link it does at first viewing match the Googlecache so doesn’t look like cloaking.
In my opinion this is a deliberate black hat SEO attempt to hide the backlinks from forum owners. In comparison phpBB forum software has a similar powered by link, but it’s visible to everyone (forum visitors and Google) and there’s loads of articles online about how to remove the phpBB forum links. By hiding the Discourse.org links this way only the most SEO knowledgeable webmasters are going to notice these text links and look to remove them.
Interestingly when you view the message linked to the commit for this link at Github it mentions SEO:
Discourse Forum Software Github SEO Message
Put the ‘Powered by Discourse…’ message shown to crawlers and no-js visitors in a footer element so that SEO something something.
It would appear the links are added for SEO reasons, what are the SEO reasons?
Discourse.org Response to Being Caught Using Black hat SEO Techniques
I signed up to the Discourse forum and made a post titled “Cloaked Link to Discourse.org Within Your Forum Software: Potential SEO Issue”. I explained the above issue etc… and one of the co-founders (Jeff Atwood) responded trying to justify the black hat SEO links, to which I gave a follow up: few hours later the forum topic was deleted and my Discourse forum account was deleted :-)
Deleted Discourse Forum Post About Black hat SEO Link Cloaking!
Fortunately I always keep a copy of everything I post to forums etc… (not my first rodeo :-)) and have posted the deleted forum post as a comment below and took screenshots of the forum posts GoogleCache.
Black Hat SEO Cloaked Links to Discourse.org Forum Post GoogleCache
Update: Made an error below, the Discourse software has a feature where links posted by trusted forum members are NOT nofollow. My mistake was seeing links to discourse.org lacking nofollow which were posted by a trusted forum member (pure coincidence) and jumping to the wrong conclusion it was another black hat SEO link building technique. I was wrong, everything within the “More Black hat SEO Techniques Used by Discourse Forum Software” section below is wrong.
Thanks to PFG (via a comment) for clarifying why some links lacked rel=”nofollow” tags. I’ve kept the section because even though I was wrong it’s a possible black hat SEO technique to look out for: if I were into black hat SEO techniques I could use it with the WordPress SEO themes and SEO plugins I release.
More Black hat SEO Techniques Used by Discourse Forum Software
It gets better, as I was writing this black hat SEO tutorial I noticed when viewing source of the Googlecache of Discourse forum posts links to discourse.org are NOT rel=”nofollow”!
It would appear Discourse have added an exception for links to their own sites!!!
WOW, now technically not black hat SEO per se, but you have to admit it’s very shady and not particularly ethical especially when taking into account the 1.7 million indexed cloaked backlinks.
Discourse Forum Software Right to Reply
Note to the Discourse forum software developers etc… feel free to make a comment to explain the link to your home page that’s served from 1.7 million webpages.
I won’t delete your comments as long as they aren’t abusive.
Jeff Atwood Co-Founder of Discourse Forum Response to Hidden Black hat SEO Links
Jeff Atwood Co-Founder of Discourse Forum Response to Hidden Black hat SEO Links
David Law
David Law : Technical SEO Expert with 20+ years Online Business, SEO, Search Engine Marketing and Social Media Marketing experience... Creator of multiple WordPress SEO Themes and SEO Plugins. Interests: wildlife, walking, environmental issues, politics, economics, journalism, consumer rights.
Cloaked Link to Discourse.org Within Your Forum Software: Potential SEO Issue
I made a forum post to the Discourse forum, but despite a response from the forum software co-founder (Jeff Atwood) it was deleted within hours. Here’s the forum post and Jeff Atwood’s response including screenshots:
Subject: Cloaked Link to Discourse.org Within Your Forum Software: Potential SEO Issue
I’m not a Discourse forum user so not familiar with your forum script.
I’ve worked in the SEO industry for over 15 years and when visiting a site I almost always take a look at the source code. While logged into this forum: https://community.letsencrypt.org/ I noticed the semi-hidden link to your main site in a noscript tag.
I posted about it on the forum at https://community.letsencrypt.org/t/hidden-link-to-discource-org-potential-seo-issue/39763 to warn them having links like that could result in a Google penalty IF the linked to site is penalized and they suggested letting you know.
Linking via a noscript tag without an equivalent link within standard body text (outside a noscript tag) is seen as gaming Google: Google is being served content most users are not seeing (only a small percentage will browse with jasvascript disabled).
I made the mistake of not doing detailed SEO research before posting (should have checked the Google cache to see what Google sees), so will describe the issue as Google isn’t spidering a semi-hidden link within a noscript tag, it’s spidering a standard text link within standard body text, but the forum users ARE not served the same link (that’s cloaking).
Google’s Take on Cloaking https://support.google.com/webmasters/answer/66355?hl=en
You can see from this Google search https://www.google.co.uk/search?client=firefox-b&q=”Powered+by+Discourse%2C+best+viewed+with+JavaScript+enabled” there’s 1.7 million pages with this code, that’s 1.7 million hidden backlinks to the your main site!
If/when Google notices these links are NOT served to the forum visitors there’s a very good chance your site will be penalized. Also the sites linking to you this way could also be caught in the crossfire, they could be penalized for linking to a ‘bad’ domain.
Your intention might not be to game Google, but the current setup is close to a perfect black hat SEO setup.
You have a cloaked text link to your home page only served to Googlebot: you gain significant SEO benefit from 1.7 million backlinks.
You have the same link served within a noscript tag to other visitors: the link exists, but the webmaster of the forum is highly unlikely to see it and decide to remove it.
You do NOT have the link served as standard body text to visitors: as above, forum webmasters don’t know the link is there and so won’t remove it.
You are taking a significant risk with this setup, as mentioned on the forum I used to create WordPress themes with visible powered by links (nothing hidden) and Google penalized the domain for the millions of backlinks it generated.
In my experience as both an SEO consultant (12 years) and a webmaster (~20 years) I find adding links this way as unethical, nothing should be hidden from the webmaster or Google and there should be an easy to use option to disable the link (the webmaster shouldn’t need to modify code).
Assuming you haven’t been hit with a penalty already I suggest either removing the link completely or add a rel=”nofollow” tag to it so Google ignores the link.
Practically speaking there isn’t a good reason to keep the powered by link, Googlebot doesn’t care if the website is powered by your software (it’s a bot, it doesn’t need to read the text “Powered by Discourse, best viewed with JavaScript enabled.”). Visitors to a forum might like to know it’s powered by your software, but only a tiny minority of users browse with javascript disabled, so most don’t see the link and text. Even the forum visitors who aren’t using javascript don’t need to know it’s powered by your software, all they need to know is it’s “Best viewed with JavaScript enabled”.
You should change the code to something like “Best viewed with JavaScript enabled” when javascript is disabled (noscript tag) and if you want a powered by link show the same code to both Googlebot and forum visitors and allow the owners of the sites to enable/disable the link.
David Law
Black Hat SEO Cloaked Links to Discourse.org Forum Post GoogleCache
And Jeff Atwood : co-founder of Discourse.org responded-
This is pretty standard stuff in the forum world; you may want to contact phpBB as well
So 99% of the time, I buy copyright removal on any plugins and such. I normally would create a dedicated credits page in the help section displaying copyright to all addons and themes even if I had bought copyright removal or not. I like to show support for developers. I just not a fan of having a thousand links in my footer is all.
However, XenForo being a $250 price tag to do so, I never have done it for XenForo as I own multiple forums. and not really worth the price tag.
With that said, I am looking to do it for one of my forums. Has anyone purchased Copyright Removal for XenForo? I know a lot of people look for that footer link when looking for nulled forums. The last thing I need to be accused of is having a nulled forum after paying $250 for a copyright removal xD
Jeff Atwood Co-Founder of Discourse Forum Response to Hidden Black hat SEO Links
And my follow up forum post:
The “Powered by phpBB” link isn’t hidden from forum visitors, I’ve built forums using their forum script and all visitors see the same code.
When I visit a Discourse forum I do NOT see the text link to the Discourse site because you are serving Googlebot an alternative version of the site (that’s cloaking). This looks like black hat SEO to me and I’ve tested black hat SEO techniques to see how far you can push Google. I would not do what you are doing on an important domain, the risk is way too high.
It’s OK to serve Googlebot a modified version of a site, but Google must see the same content as a standard visitor and right now that’s not the case.
If you think that link is so important, do what others do and serve the same code to everyone. It’s also a risk adding visible links like the “Powered by phpBB” links, Google sometimes downgrades links like those as well.
All it takes is one person to report your site (competitors love this sort of stuff) and you might get manually reviewed. Are you confident you can justify the reason for the hidden link resulting in 1.7 million backlinks to a Google manual reviewer???
Try now, why is it hidden to normal visitors?
If you can’t make a valid case for the hidden link, remove it.
If I were a Google manually reviewer I’d slap your domain with a huge link penalty for gaming Google. I assume you use Google Webmaster tools, you’ll get a notice if you ever get a penalty.
I’ve seen domains banned for far less than this, you are risking your business with this black hat SEO technique.
This does make for a good SEO lesson, I’ll be writing this up as a black hat SEO tutorial for my SEO site.
David Law
Few hours later the entire forum thread was gone and my Discourse account was deleted. I guess they don’t like being called out for abusing the trust of their forum script users!
If you use the Discourse Forum script you are sending a sitewide hidden link to the Discourse home page. This is taking advantage of your trust and damaging your sites SEO (these links cost YOU link benefit).
I suggest going to their forum and insist they justify the above black hat link building SEO technique which is both threatening the long-term success of the Discourse.org site and YOUR forum: if they are hit with a Google black hat SEO link penalty, you are linking sitewide to a bad domain.
FWIW, the nofollow behaviour in links contained in posts depends on the trust level of the poster. The post without nofollow was made by a user with trust level >= 3, other links posted by users with different trust levels (like the one to discourse.org in the first post of that thread) use nofollow. I believe this was implemented to make comment spam less useful.
Leave a reply to Black Hat SEO Link Building Techniques to Avoid – Discourse.org Hidden Links
I made a forum post to the Discourse forum, but despite a response from the forum software co-founder (Jeff Atwood) it was deleted within hours. Here’s the forum post and Jeff Atwood’s response including screenshots:
Subject: Cloaked Link to Discourse.org Within Your Forum Software: Potential SEO Issue
I’m not a Discourse forum user so not familiar with your forum script.
I’ve worked in the SEO industry for over 15 years and when visiting a site I almost always take a look at the source code. While logged into this forum: https://community.letsencrypt.org/ I noticed the semi-hidden link to your main site in a noscript tag.
I posted about it on the forum at https://community.letsencrypt.org/t/hidden-link-to-discource-org-potential-seo-issue/39763 to warn them having links like that could result in a Google penalty IF the linked to site is penalized and they suggested letting you know.
Linking via a noscript tag without an equivalent link within standard body text (outside a noscript tag) is seen as gaming Google: Google is being served content most users are not seeing (only a small percentage will browse with jasvascript disabled).
I made the mistake of not doing detailed SEO research before posting (should have checked the Google cache to see what Google sees), so will describe the issue as Google isn’t spidering a semi-hidden link within a noscript tag, it’s spidering a standard text link within standard body text, but the forum users ARE not served the same link (that’s cloaking).
Google’s Take on Cloaking https://support.google.com/webmasters/answer/66355?hl=en
You can see from this Google search https://www.google.co.uk/search?client=firefox-b&q=”Powered+by+Discourse%2C+best+viewed+with+JavaScript+enabled” there’s 1.7 million pages with this code, that’s 1.7 million hidden backlinks to the your main site!
If/when Google notices these links are NOT served to the forum visitors there’s a very good chance your site will be penalized. Also the sites linking to you this way could also be caught in the crossfire, they could be penalized for linking to a ‘bad’ domain.
Your intention might not be to game Google, but the current setup is close to a perfect black hat SEO setup.
You have a cloaked text link to your home page only served to Googlebot: you gain significant SEO benefit from 1.7 million backlinks.
You have the same link served within a noscript tag to other visitors: the link exists, but the webmaster of the forum is highly unlikely to see it and decide to remove it.
You do NOT have the link served as standard body text to visitors: as above, forum webmasters don’t know the link is there and so won’t remove it.
You are taking a significant risk with this setup, as mentioned on the forum I used to create WordPress themes with visible powered by links (nothing hidden) and Google penalized the domain for the millions of backlinks it generated.
In my experience as both an SEO consultant (12 years) and a webmaster (~20 years) I find adding links this way as unethical, nothing should be hidden from the webmaster or Google and there should be an easy to use option to disable the link (the webmaster shouldn’t need to modify code).
Assuming you haven’t been hit with a penalty already I suggest either removing the link completely or add a rel=”nofollow” tag to it so Google ignores the link.
Practically speaking there isn’t a good reason to keep the powered by link, Googlebot doesn’t care if the website is powered by your software (it’s a bot, it doesn’t need to read the text “Powered by Discourse, best viewed with JavaScript enabled.”). Visitors to a forum might like to know it’s powered by your software, but only a tiny minority of users browse with javascript disabled, so most don’t see the link and text. Even the forum visitors who aren’t using javascript don’t need to know it’s powered by your software, all they need to know is it’s “Best viewed with JavaScript enabled”.
You should change the code to something like “Best viewed with JavaScript enabled” when javascript is disabled (noscript tag) and if you want a powered by link show the same code to both Googlebot and forum visitors and allow the owners of the sites to enable/disable the link.
David Law
Black Hat SEO Cloaked Links to Discourse.org Forum Post GoogleCache
And Jeff Atwood : co-founder of Discourse.org responded-
This is pretty standard stuff in the forum world; you may want to contact phpBB as well
:: https://www.inmotionhosting.com/support/edu/phpbb/remove-footer/
And XenForo
:: https://www.theadminzone.com/threads/xenforo-copyright-removal.136028/
And IPB
:: https://invisioncommunity.com/forums/topic/235932-remove-powered-by-invision-board-from-the-first-page-title/
Jeff Atwood Co-Founder of Discourse Forum Response to Hidden Black hat SEO Links
And my follow up forum post:
The “Powered by phpBB” link isn’t hidden from forum visitors, I’ve built forums using their forum script and all visitors see the same code.
When I visit a Discourse forum I do NOT see the text link to the Discourse site because you are serving Googlebot an alternative version of the site (that’s cloaking). This looks like black hat SEO to me and I’ve tested black hat SEO techniques to see how far you can push Google. I would not do what you are doing on an important domain, the risk is way too high.
It’s OK to serve Googlebot a modified version of a site, but Google must see the same content as a standard visitor and right now that’s not the case.
If you think that link is so important, do what others do and serve the same code to everyone. It’s also a risk adding visible links like the “Powered by phpBB” links, Google sometimes downgrades links like those as well.
All it takes is one person to report your site (competitors love this sort of stuff) and you might get manually reviewed. Are you confident you can justify the reason for the hidden link resulting in 1.7 million backlinks to a Google manual reviewer???
Try now, why is it hidden to normal visitors?
If you can’t make a valid case for the hidden link, remove it.
If I were a Google manually reviewer I’d slap your domain with a huge link penalty for gaming Google. I assume you use Google Webmaster tools, you’ll get a notice if you ever get a penalty.
I’ve seen domains banned for far less than this, you are risking your business with this black hat SEO technique.
This does make for a good SEO lesson, I’ll be writing this up as a black hat SEO tutorial for my SEO site.
David Law
Few hours later the entire forum thread was gone and my Discourse account was deleted. I guess they don’t like being called out for abusing the trust of their forum script users!
If you use the Discourse Forum script you are sending a sitewide hidden link to the Discourse home page. This is taking advantage of your trust and damaging your sites SEO (these links cost YOU link benefit).
I suggest going to their forum and insist they justify the above black hat link building SEO technique which is both threatening the long-term success of the Discourse.org site and YOUR forum: if they are hit with a Google black hat SEO link penalty, you are linking sitewide to a bad domain.
David Law
FWIW, the nofollow behaviour in links contained in posts depends on the trust level of the poster. The post without nofollow was made by a user with trust level >= 3, other links posted by users with different trust levels (like the one to discourse.org in the first post of that thread) use nofollow. I believe this was implemented to make comment spam less useful.