Does using HEX entities (&#xHH) in href attribute impact SEO?

Question

Currently all the links on my website look like

<a href="&#x2F">Home</a>
<a href="&#x2F;user&#x2F;settings">Settings</a>
<a href="&#x2F;user&#x2F;logout&#x3F;redirect&#x3D;&#x2F;products&#x2F;207292">Log out</a>

So all href atrributes are HEX-encoded with the corresponding entities (&#xHH) to prevent any XSS issues.

Google doesn't show a warning for these links, but some online SEO tools consider these links to be broken since they treat them as & (ampersand) followed by # (hash) and drop everything after #.

So is it safe for SEO using this kind of HTML attribute encoding or I should heed the advise of the SEO tools?

Answer 1

These URLs are valid only when present in an HTML document, and "some online SEO tools" are sort of incorrect to report this as a problem.

What happens here is that you have used numeric HTML entities to represent various characters, but the URL format does not treat these as encoded characters that should be decoded to get the URL that will actually be used. The only permitted encoding in a URL is percent encoding.

The parser used by this online tool, however, does not take into account that HTML parsing engines are required to decode HTML entities early in document parsing, before the URL is actually used.

The ABNF grammar given in RFC 3986 makes clear that neither & nor # are valid at this point in the URL. And, in the most recent revision of the URL specification work in progress, all of the URLs you gave as examples are supposed to return a parse error. This means the URL is not valid generally and should never be given out as a bare link or in any non-HTML context. It only becomes valid after the HTML parser is done with it.

If you use URL percent encoding as, e.g. %2Fuser%2Fsettings then this will be parsed correctly by everyone, and these URLs are safe to use anywhere. But note that the ? which delineates the query string is not allowed to be percent encoded. Neither is the scheme (e.g. http or https) and the :// which follow it, allowed to be percent encoded.

So, there's no real SEO impact here.

But, there's also no real reason to do this for everything. For cross-site scripting, for instance, you aren't letting users construct their own URLs. If you were, then you need to do some escaping. And as it's trivially parsed it doesn't really obfuscate anything.