<story><title>A website that deletes itself once indexed by Google</title><url>https://github.com/mroth/unindexed/blob/master/README.md</url></story><parent_chain><item><author>tonyarkles</author><text>I had a client once who had something similar, although unintentionally. She approached me because her website &amp;quot;kept getting hacked&amp;quot; and she didn&amp;#x27;t trust the original developers to solve the security problems... And rightly so!&lt;p&gt;There were two factors that, together, made this happen: first, the admin login form was implemented in JS, and if you went to log in with it with JS disabled, it wouldn&amp;#x27;t verify your credentials. And it submitted via a GET request. Second, once you were in the admin interface, you could delete content from the site by clicking on an X in the CMS. Which, as was the pattern, presented you with a JS alert() prompt before deleting the content... via a GET request.&lt;p&gt;Looking at the server logs around the time it got &amp;quot;hacked&amp;quot;, you could see GoogleBot happily following all the delete links in the admin interface.</text></item></parent_chain><comment><author>ars</author><text>&amp;gt; I had a client once who had something similar, although unintentionally.&lt;p&gt;I did that too. I was aware of the problem, but at the time (1996) I did not know how to fix it.&lt;p&gt;So I just documented it and warned that they should keep the site away from altavista.&lt;p&gt;This was back before cookies had wide support, so login state was in the URL. If you allowed a search spider to know that URL it would have deleted the entire site by spidering it.&lt;p&gt;I did eventually fix it by switching to forms, and strengthening the URL token to expire if unused for a while. And then eventually switching to cookies (at one point it supported both url tokens and cookies).&lt;p&gt;I have not thought about those days in such a long time.</text></comment>
<story><title>A website that deletes itself once indexed by Google</title><url>https://github.com/mroth/unindexed/blob/master/README.md</url></story><parent_chain><item><author>tonyarkles</author><text>I had a client once who had something similar, although unintentionally. She approached me because her website &amp;quot;kept getting hacked&amp;quot; and she didn&amp;#x27;t trust the original developers to solve the security problems... And rightly so!&lt;p&gt;There were two factors that, together, made this happen: first, the admin login form was implemented in JS, and if you went to log in with it with JS disabled, it wouldn&amp;#x27;t verify your credentials. And it submitted via a GET request. Second, once you were in the admin interface, you could delete content from the site by clicking on an X in the CMS. Which, as was the pattern, presented you with a JS alert() prompt before deleting the content... via a GET request.&lt;p&gt;Looking at the server logs around the time it got &amp;quot;hacked&amp;quot;, you could see GoogleBot happily following all the delete links in the admin interface.</text></item></parent_chain><comment><author>ikeboy</author><text>Are you this guy &lt;a href=&quot;http://thedailywtf.com/articles/The_Spider_of_Doom&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;thedailywtf.com&amp;#x2F;articles&amp;#x2F;The_Spider_of_Doom&lt;/a&gt;? Or &lt;a href=&quot;http://craigandera.blogspot.com/2004/04/beware-googlebot_12.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;craigandera.blogspot.com&amp;#x2F;2004&amp;#x2F;04&amp;#x2F;beware-googlebot_12....&lt;/a&gt;? (They seem like the same story but have different names.)</text></comment>