Apparently Google indexes hashbang URLs: https://www.youtube.com/watch?v=kDs-MufuiAg

Can an attacker link to another website with fictitious hashbang-URLs and use it to hurt that website (if the victim's website does not specify a canonical URL and responds with status code 200)?

Example: victimswebsite.example/somepage#!malicious-keyword

1 Answer 1


That video is out of date. Google deprecated hash bang AJAX and as of 2018 stopped the special crawling of it. At this point hash bang URLs are no more special than any other fragment URL. Google crawls /somepage#!malicious-keyword and /somepage#malicious-keyword exactly the same now: it loads /somepage and executes the JavaScript on it which may or may not choose to load different content based on the fragment identifier.

There are also other ways to append to URLs. On many servers, any of the following are likely to return the same content of /somepage:

  • /somepage/appended/path/
  • /somepage?query=string
  • /somepage#fragment-identifier

This does not usually hurt SEO, even if a bad actor were to append malicious keywords to the URL and create a link to it that Google can find.

  • Google doesn't give much (if any) weight to keywords in the URL itself these days. Just using a keyword in the URL doesn't seem to affect SEO either positively or negatively.
  • Appending to the URL does not usually cause the keywords to appear in the page. If the appending a keyword does cause it to appear in the text of the page, it is more likely to be able to hurt SEO. One place this is possible is in site search: /search?q=malicious+keyword
  • When Google discovers two URLs that have the same content, it usually choose to index one of them and ignore the other. The version that is linked internally on your site and is in your XML sitemap is much more likely to be chosen as the canonical by Google even when you don't use canonical tags. It is very unlikely that linking to an appended malicious keyword would get that version of the URL indexed in Google.

There are several ways to combat this if somebody does try to spam your site like this:

  • Use canonical link tags in every page (as you mention in your question)
  • Disallow crawling of some appended URLs in robots.txt like Disallow: /search or Disallow: *?
  • Create and submit an XML sitemap to Google that lists all your preferred URLs, Google will use it as a canonical signal.

In summary

  • There is nothing special about hash bang URLs now.
  • There are several types of URLs that could possibly be spammed with appended keywords.
  • Appending keywords to URLs is not a spam technique that usually has any effect.
  • There are ways to combat keywords appended to URLs if it ever did cause a problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.