Shopify store owners discovered spam pages being indexed by Google through exploited URL parameters, primarily affecting /collections/vendors?q= and /search?q= endpoints. Malicious bots create fake URLs by appending spam queries (often FIFA coin advertisements) that get indexed when external sites link to them, despite robots.txt blocking.
Root Cause:
The vulnerability stems from Shopify themes displaying search queries as page titles on zero-result pages instead of returning 404 errors. Google indexes these pages when external spam sites create backlinks, ignoring robots.txt directives.
Community Solutions Implemented:
Shopify’s Response:
After community pressure, Shopify deployed fixes making /collections/vendors?q= pages return 404 status. Similar fixes were implemented for search pages and web-pixels-manager spam. However, new variants continue emerging (e.g., /collections/all/ spam).
Current Status:
The /vendors?q= issue is largely resolved. Affected stores report gradual deindexing over weeks, with SEO rankings recovering. Store owners should verify noindex implementation and ensure robots.txt doesn’t block crawlers from seeing 404/noindex responses.
Interesting. I am having the same issue but mine is “euromillion” & lottery-type stuff and not FIFA. The majority of it was in Chinese so I needed to use google translate to see what it says. If you search “euromillion shopify” in google, numerous sites pull up but you can tell they are all malware on normal sites.
It is also in my venders?q section.
I haven’t submitted a ticket yet because I was just researching it and found this thread.
