Voices of Search Podcast Episode Summary: "Raising SEO Security Awareness"

Release Date: January 6, 2025
Host: Tyson Stockton (Previsible IO)
Guest: Chris Band, Senior Technical SEO at Lumar

1. Introduction

In this episode of the Voices of Search podcast, host Tyson Stockton delves into the increasingly critical intersection between Search Engine Optimization (SEO) and cybersecurity. Joined by Chris Band, Senior Technical SEO at Lumar, the discussion centers on the rising importance of SEO security awareness and how collaboration between SEO and security teams can safeguard a website's integrity and search performance.

2. The Rise of SEO Security Awareness

Chris Band opens the conversation by sharing his background and the evolution of SEO within highly secure environments. He recounts his experience working on an SEO team within a company that adopted bank-level security measures:

"[00:03:03] Chris Band: ...SEO is obviously now working for a large scale crawler. We run afoul of Cloudflare and DDoS protection and stuff like that all the time."

Chris emphasizes how rapid scaling of security protocols can inadvertently disrupt SEO activities, such as accessing essential tools like Gmail, Google Search Console, and Google Analytics:

"[00:03:03] Chris Band: ...I can't access Gmail anymore. Well, why is that? ... It's technically a proxy and you could in theory use that to get around the company's acceptable use policy."

3. Importance of SEO and Security Collaboration

The discussion highlights the often-overlooked partnership between SEO and security teams. Chris illustrates the challenges faced when SEO initiatives clash with stringent security measures:

"[00:03:03] Chris Band: ...We had to get campaigns over the line and things like that. This is when I was a way more generalist SEO..."

Tyson underscores the value of building relationships across departments to foster understanding and collaboration:

"[00:10:20] Tyson Stockton: ...making that effort to build those relationships and then being able to learn that context of why something might be a problem or why something might be, be an issue."

4. Security Risks Affecting Organic Search Traffic

Chris elaborates on various security vulnerabilities that can negatively impact a website's SEO performance:

• Pharma and Japanese Keyword Hacks: Unauthorized content injection that alters search engine results and damages reputation.

  "[00:15:59] Chris Band: ...if you have user content that switches based on user agents, it can lead to unauthorized content appearing in SERPs."

• Reputational Damage: Negative user experiences resulting from hacked sites can deter visitors and reduce trust, leading to decreased traffic and rankings.

  "[00:15:59] Chris Band: ...you're going to look broken. So why would I click on it? ... reputational damage is financial damage."

• Indexing Issues: Malicious alterations can lead to unintentional indexing of harmful content, triggering Google warnings and deranking.

  "[00:15:59] Chris Band: ...Google will send you a 'you have been hacked' warning in your GSC and then it will start deranking pages."

5. How SEOs Can Flag Security Issues

Chris provides actionable strategies for SEOs to identify and report security vulnerabilities effectively:

1. Log File Analysis: Monitoring unusual patterns, such as unexpected spikes in crawl activities.

   "[00:10:47] Chris Band: ...if you see things that seem a bit weird go down that rabbit hole."

2. Audit Old Subdomains: Investigate deprecated or test subdomains for lingering vulnerabilities or unauthorized content.

   "[00:15:59] Chris Band: ...Google still has the connection between the two. So you can see that stuff in there."

3. User-Agent Testing: Regularly check how different user agents (e.g., Googlebot) interact with the website to spot discrepancies.

   "[00:25:38] Chris Band: ...if you allow users to create URLs, it's worth saying to the team, what if somebody signs up the username robots txt, what happens then?"

4. Demonstrations and Reporting: Provide clear evidence of vulnerabilities, such as screenshots or demonstrations, when reporting to security teams.

   "[00:26:52] Chris Band: ...demonstrate what you found and then try and find an email alias for the security team and just fire it directly at that."

Tyson adds that building trust and showing genuine concern can facilitate more effective communication:

"[00:21:29] Tyson Stockton: ...sometimes having like an overlap to it. But I don't feel like there has been much coverage in these use cases."

6. Resources and Further Learning

Chris recommends several resources for SEOs interested in expanding their knowledge of cybersecurity:

• Darknet Diaries Podcast: Insights from hackers and cybersecurity professionals.

  "[00:30:24] Chris Band: ...there is a phenomenal podcast called Darknet Diaries..."

• Krebs on Security: A blog by Brian Krebs, a renowned cybersecurity journalist.

  "[00:30:24] Chris Band: ...there's a website called Krebs on Security that's K R E B s on Security..."

• Troy Hunt's Resources: Including the "Have I Been Pwned?" website and his informative blog.

  "[00:30:24] Chris Band: ...Troy Hunt's site, Troy Hunt runs Have I Been Powned?"

• Search Pilot (formerly Distilled ODm): Tom Anthony's security research videos on YouTube.

  "[00:30:24] Chris Band: ...there's a video of his called Fuzzing websites for fun and profits..."

Tyson encourages listeners to explore these resources to bolster their understanding and capabilities in SEO security.

7. Conclusion

The episode wraps up with Tyson thanking Chris for his invaluable insights and previewing the next episode, which will focus on actionable technical SEO strategies. Listeners are encouraged to engage with the podcast through social media, newsletters, and by visiting the Voices of Search website for additional resources and show notes.

Key Takeaways

• Interdepartmental Collaboration: Building strong relationships between SEO and security teams leads to better website performance and security.
• Proactive Monitoring: Regularly analyze log files, audit subdomains, and test user-agent interactions to identify potential security threats.
• Effective Reporting: Use evidence-based reporting to communicate vulnerabilities to security teams effectively.
• Continuous Learning: Utilize recommended resources to stay informed about the latest in cybersecurity and its impact on SEO.

Notable Quotes:

• "SEO is obviously now working for a large scale crawler. We run afoul of Cloudflare and DDoS protection and stuff like that all the time." — Chris Band [03:03]

• "Making that effort to build those relationships and then being able to learn that context of why something might be a problem..." — Tyson Stockton [10:20]

• "If you allow users to create URLs, it's worth saying to the team, what if somebody signs up the username robots txt, what happens then?" — Chris Band [26:52]

For more detailed insights and additional resources mentioned in this episode, visit voicesofsearch.com and subscribe to their weekly newsletter. Follow the podcast on LinkedIn, Twitter, Instagram, and Facebook at @voicesofsearch.