Several of the site's pages end with a block of hidden links to unrelated, low-quality sites. Visitors never see them. Search engines do. This page shows what a review like this finds, what it means for the business, and how the site would be cleaned up and kept from getting infected again.
Everything here is visible to any visitor or to a search engine. A first review does not log in, run scanners, or touch the server. Severity reflects how much it can hurt the business, not how hard it is to fix.
A number of guide and tool pages end with an invisible block of outbound links. The anchor text and destinations are unrelated, low-quality sites that have nothing to do with real estate. The homepage and a few other pages are clean, which is typical: the injection targets pages with the most search traffic.
The block is wrapped in a style that hides it from people while leaving it fully readable to search engines. That is the point: someone is borrowing the reputation of a trusted local brokerage to rank their own sites.
The links are not typed into the pages. The site's code reaches out to an outside server on page load and inserts whatever comes back, which is why removing the links in the page editor does not make them stay gone. Some pages also print raw server error messages just above the hidden block, a tell-tale sign of the same mechanism.
This matters more than the links themselves. Whoever controls the outside server can change the payload at any time: redirect visitors, show a fake login form, or serve malware, without touching the site again. It also confirms the problem lives in the site's code or hosting account, not only in the page text.
The robots.txt file, which tells search engines where to look, was rewritten to list many sitemaps with random numbers in their names. The site's real sitemap lives at a different address. Fake sitemap entries are a textbook way to feed spam pages to search engines under a legitimate domain.
Search Console will show whether those addresses serve spam only to search crawlers and whether Google has already flagged the site.
The content management system, the SEO plugin and the contact-form plugin are all several releases behind. The theme and page-builder plugins come from the original site vendor and are locked to that old core.
Out-of-date plugins are the most common way sites like this get compromised. This is almost certainly how the injection got in, and it will keep happening until updates are routine.
A security plugin is installed and a CDN sits in front of the site. Neither prevented the injection or caught it afterwards, which usually means free tiers are on with default settings and nobody is reading the alerts.
The site also sends few of the standard browser security headers (transport security, content-security policy, frame and MIME protections). These are quick to add and make several classes of attack harder.
The site forces HTTPS, remote-publishing endpoints are blocked, the public list of user accounts is locked down, and the login page cannot be embedded in other sites. These are worth keeping through the cleanup.
Search engines detect injected links and fake sitemaps. The usual outcomes are a "This site may be hacked" warning under the listing, a manual penalty, and a drop for the pages that bring in buyer and seller searches. Recovery takes weeks after cleanup, so every month of delay compounds.
Anyone who views the page source, uses an ad blocker that flags low-quality domains, or gets a browser or antivirus warning sees the brokerage's name next to content it would never endorse. Agents share these guide pages with clients every week.
A brokerage is held to a higher standard for what appears under its name. Injected content is outside its control, and the attacker can change it to anything, including discriminatory or defamatory text, overnight.
The same access that inserts links can read what visitors type into contact and valuation forms. Names, phones, addresses and financing details flow through the site, and breach-notification rules may apply if that data is taken.
Domains associated with spam campaigns get scored down by mail providers. Agents' email from the firm's domain can start landing in junk folders with no obvious cause.
Today it is links. Spam operators routinely resell access, and the next buyer may redirect visitors or plant a fake "sign in to view this listing" page. Nothing on the site will look different until a client calls.
Three phases. The first needs access to the hosting account and CMS admin, which only the owner or the site vendor can grant. The rest runs on a schedule and reports back monthly in plain language.
Moving to a static site closes most of this list for good, and the monitoring plan keeps watch over the rest: domain, email, listing-search vendor and the brokerage's accounts.
Every plan includes a cleanup guarantee: if the same infection returns shortly after cleanup, it is fixed at no charge.
Required first step for any plan. Done within a few business days of receiving access.
Know within the hour if anything changes. For a site that stays on its current CMS with light editing.
Everything in Watch, plus the protections that stop the next attempt instead of just reporting it.
For a rebuilt static site. Hosting, monitoring and the brokerage's whole web footprint under one roof.
Plans are shown without pricing in this sample report.
Until access is granted, nothing on the live site changes. The review above was done entirely from the outside, the same way a visitor or a search engine sees it.