So, I recently bought a domain name from Bluehost. Soon, I realized the domain name used to belong to someone else before I bought it. Now, the problem I am facing is that there are a few trash files that get crawled by all kinds of bots when they access my domain website which belonged to the previous domain. There is no way I can access those files on my cPanel server.

My website got flagged as malicious by Google Ads probably due to their files using 'http' calls while all my pages run on https. I did find a work-around to the mixed content problem by creating blank files and folders of the same name on my server that were causing http calls, and setting up redirects to my homepage. But google ads still flags my website as malicious content. It came up as clean in sucuri malware scan after resolving the mixed content issue.

Is there any way I can remove all the junk files that were left associated to my domain by the previous domain owner? If I choose to ignore it and let things be as they are, will it be a problem for me in the future? Should I just buy another domain name that didn't belong to anyone in the past and move my website there?

Update: I have confirmed on search console that the pages being flagged problematic by sucuri do return a 404 error. It seems I only need to configure my 404 handler and make sure they don't use http links. I would like to thank @stephenostermiller, @raulreyes and @patrickmevzek in helping me understand the problems.

PS: Google support also got in touch with me and told me that my website is clean and they'll be removing the malicious software tag from it soon.

  • If those files can get fetched from your domain when you own it, they aren't from the previous owners. It sounds to me like your site got hacked. Apr 13 at 12:55
  • Can you actually visit those files via URL? Do they return 200 header response? @Ajit?
    – Raul Reyes
    Apr 13 at 13:12
  • When you point the domain to a new server, all the old files are no longer accessible and return "404 not found". There isn't anything else to "clean up" on your site itself. You shouldn't need to put in blank pages or redirect to your home page. Apr 13 at 13:17
  • @RaulReyes No, those sites/webpages cannot actually be visited. But the crawlers are still somehow accessing them.
    – Ajit
    Apr 13 at 13:18
  • @Ajit how do you know they are accessing them?
    – Raul Reyes
    Apr 13 at 13:20

Your website is https://thewildfire.in/ (it would have been simpler to say so immediately at the start of your question insteady to rely on screenshots that are difficult to read, impossible to search on or to quote, even so much here that the important parts are just text lines that you could have pasted as is).

The software you show in screenshot seems to try some random not existing URLs such as https://thewildfire.in/404javascript. If you go there, and look at source code, you see:

    <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script>

This seems to be a default "404" handler that will generate a page for any random URL not existing, hence explaining your "which are not present on the root directory of my server,".

Try https://thewildfire.in/foobar and you will get the same page and same error.

Some security tool are testing random pages like that to search for vulnerabilities.

But this page served is reported as having "HTTP served in HTTPS" because you are serving a page over HTTPS that includes elements (here a Javascript) served over HTTP. This should be fixed because nowadays browsers will at least flag that, if not even refuse to load this HTTP content, as otherwise it creates a security risk (the security of a whole system is the security of its weakest link: if you run "inside" and HTTPS page a Javascript downloaded over HTTP, this cancels the security you gained with HTTPS as that script over HTTP could have been completely hijacked in transit)

Your solutions in no specific order nor are they exclusive of each other:

  • look if the above content served over HTTP can be served over HTTPS and if so, fix that URL
  • look at your configuration and why you are serving those kind of pages in case of 404. Do you really need them? Specifically because right now besides showing a spinner they fail to do anything useful. Remove this specific "404" handler or have one not depending on HTTP resources.

All of this has nothing to do with previous content. Your current content is what is above and generates the errors of "HTTP in HTTPS".

  • Thank you Patrick, I also looked up the problematic links on my search console and on live testing confirmed that they do return 404 errors, which is a good thing. It seems the only thing left to do is work on my 404 handler. I will look into that. Thanks.
    – Ajit
    Apr 13 at 17:02

Assuming you are using a new hosting for your website on another server than the one used before you owned the domain, you need to do nothing.

I would recommend using another approach to the one used to fix he sucuri reported issues. You need to find out, perhaps with Google ads support or search console reports why your website was flagged as malicious and use their recommended procedure to become thrustful again.

Going back to your concern, and judging by your comments, be aware that once you transfer your domain to a new host all files are removed automatically because your domain is not pointing to that old DNS anymore. If you want to recover this domain, you do not need to buy a new domain, once you improve the domain and website reputation you won’t need to worry about using your domain as it should.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.