5

I am just an amateur web editor and have had a non-commercial personal website www.mysurname.example with useful technical tips and culture content since 1999. I code my web pages directly in HTML and use a cheap web hosting service with cPanel.

Recently I have noticed that other domain names with funny names like www.abeautytips.example and www.ketorecipeideas.example are pointing to my website. These are probably not complete copies, because as soon as I change something on www.mysurname.example, the changes are immediately visible there as well.

Sometimes, however, there is an automatic change, e.g. <a href="mailto:[email protected]"> is changed to <a href="/cdn-cgi/l/email-protection#afc2ceddc4c0efdfc6c1dbcaddc6cc81ccc0c2">, which, strangely enough, does not change the address. This indicates that these pages are actually piping my website in real time.

How dangerous is this and what can I do about it? Please note that I am a complete amateur, have no access to Linux and my webmaster capabilities are limited by the cPanel menus.

I also wonder why is this happening. My website is not important and does not have much traffic (according to my PHP counter, maybe a few dozen page views per day, and many of those are just web spiders; according to cPanel, 5 GB of web traffic per month, including webmail). I also found, using the Wayback Machine - Internet Archive, that copycat webpages used to exist as real webpages.

Improve this question
1

2 Answers 2

Reset to default
7

There are a couple things you can do about it:

  1. Add canonical tags to every page on your site. For example one of the pages on your site should have this tag in the <head> section:

    <link rel=canonical href=https://www.mysurname.example/mped.html>

    Doing this will let Google know which is the correct URL to index, even when it finds the same content on other domains.

  2. Add code to your .htaccess file to redirect any of these alternate domains to your domain name:

    RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\.mysurname\.example$ [NC]
RewriteRule ^(.*)$ https://www.mysurname.example/$1 [R=301,L]

    That way if somebody requests an alternate domain name from your web host's server, the server will issue a redirect rather than serve the content for your site.

This kind of problem is usually caused by other people accidentally pointing their domain to your web server via DNS and your web server being configured to serve your site as the "default". When you are on cheap shared hosting, it is very unusual to have your site configured as the default, but it can happen. In Apache's configuration, whatever site comes first in the configuration is the default. Most hosting companies make sure that their own site is first, or that a dummy site that shows an error is first. It is possible that your site is listed first by your hosting company.

As far as the changed email links, that is done by Cloudflare. If I visit that /cdn-cgi/l/email-protection URL on one of the other domain names, I see a message from Cloudflare explaining that they are trying to obfuscate email addresses. Cloudflare is a content delivery network (CDN) that uses servers all over the globe to proxy and cache websites that are configured to use it. Sites choose to use a CDN because it makes their web site faster. The reverse proxy has Cloudflare act like a pipe between your server and the visitor, so they can (and do) alter the pages a bit in some cases. Some of these alternate domains are set up to use Cloudflare where their DNS points to Cloudflare and then Cloudflare is configured to use your server as its "origin server." It is likely that if you were to redirect to your domain with .htaccess, Cloudflare would also redirect these sites.

If redirects don't stop the sites that are mirroring your site through Cloudflare, you could take more drastic action and block all requests from Cloudflare completely. Doing so would preclude you from using their services yourself. Cloudflare sends several headers when requesting content from your site and you could configure your site to block requests if these headers are present. I picked one to use:

RewriteEngine On
RewriteCond %{HTTP:CF-RAY} .
RewriteRule ^ - [F]
Improve this answer
11
  • Yeah, that .htaccess solution is awesome! It also takes care of the Google canonical problem. I already use .htaccess to redirect http to https and some similar things. I should have come up with this solution myself, but it was still interesting to learn the causes of the problem.
    – Pygmalion
    Oct 23, 2021 at 9:53
  • 3
    "pointing their domain to your web server via DNS and your web server being configured to serve your site as the "default"." - Although that doesn't appear to be the case in this instance? Requesting the IP address or pointing an arbitrary domain at that IP address just results in the generic cPanel "sorry!" page. However, unless that was the case then I can't see how the .htaccess solution would have worked?! (Maybe there's some kind of misconfiguration at the host?? Although those other domains do seem quite spammy IMO and are registered in two different countries AFAICT?)
    – MrWhite
    Oct 23, 2021 at 17:16
  • @MrWhite I added a paragraph about blocking Cloudflare. Can you check the RewriteRule I propose? I didn't test it and you can spot problems with them for miles away.
    – Stephen Ostermiller ♦
    Oct 23, 2021 at 17:48
  • It looks fine, although you could simplify/optimise the regex a bit, eg. RewriteCond %{HTTP:CF-RAY} . RewriteRule ^ - [F] - The header just needs to contain at least 1 char (you don't need to actually match the whole header) and the RewriteRule just needs to be successful for everything (it doesn't need to actually match anything). Minor point, but I would remove the NC flag on the first condition on point #2 at the top. Since it's a negated condition, you want the condition to be successful when the host is not www.mysurname.example (exactly, all lowercase).
    – MrWhite
    Oct 24, 2021 at 0:50
  • 2
    @MrWhite domain names are not case sensitive. I don't believe you should try to redirect to canonicalize the case in the domain name itself. I believe it is correct to allow upper case letters in the domain name portion of a URL.
    – Stephen Ostermiller ♦
    Oct 24, 2021 at 9:36
4

It isn't dangerous. Looking at DNS, both those domains are hosted through cloudflare, so it likely a misconfiguration there.

If it bothers you it is possible to stop them displaying your content. Here is a technical answer https://security.stackexchange.com/questions/83362/how-can-i-stop-someone-from-displaying-my-website-on-his-domain You could ask the hosting service to help.

Or...you could place some ads on the site and possibly benefit from it ;o)

Improve this answer
3
  • Thanks for the reply - that was a great relief to me. The only problem is that the stupid Google gets confused and sometimes thinks that these piping domain names are real domain names. As for monetization, I occasionally get offers to run ads - which is pretty silly; with the current traffic on my site, I'd make maybe a few cents a month - it's not worth it. So I am wondering why I am receiving these offers in the first place.
    – Pygmalion
    Oct 23, 2021 at 8:35
  • I read the link you suggested. I can barely understand anything. First, can you please tell me if I can even do this on cPanel?
    – Pygmalion
    Oct 23, 2021 at 8:49
  • @Pygmalion "You could ask the hosting service to help."
    – Steve
    Oct 24, 2021 at 1:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.