So i should just not bother with no index and all of that?
Topic summary
Shopify store owners discovered spam pages being indexed by Google through exploited URL parameters, primarily affecting /collections/vendors?q= and /search?q= endpoints. Malicious bots create fake URLs by appending spam queries (often FIFA coin advertisements) that get indexed when external sites link to them, despite robots.txt blocking.
Root Cause:
The vulnerability stems from Shopify themes displaying search queries as page titles on zero-result pages instead of returning 404 errors. Google indexes these pages when external spam sites create backlinks, ignoring robots.txt directives.
Community Solutions Implemented:
- Add noindex meta tags to vendor/search pages with zero results
- Modify theme.liquid to prevent spam text in titles
- Update collection-content.liquid to display 404 messages for empty vendor queries
- Use Google Search Console’s temporary removal tool for bulk URL removal
- Avoid Google Disavow tool (recommended only for manual penalties)
Shopify’s Response:
After community pressure, Shopify deployed fixes making /collections/vendors?q= pages return 404 status. Similar fixes were implemented for search pages and web-pixels-manager spam. However, new variants continue emerging (e.g., /collections/all/ spam).
Current Status:
The /vendors?q= issue is largely resolved. Affected stores report gradual deindexing over weeks, with SEO rankings recovering. Store owners should verify noindex implementation and ensure robots.txt doesn’t block crawlers from seeing 404/noindex responses.
Correct, can you paste a few of those pixel URLs in here and we can see if they 404
@Anonymous can you post the text URLs here do I can check the status codes
Looks like there is a correct header of noindex. Can you check your robots file to see if you’re blocking this URL and if so, unblock it.
Please someone tell me if this makes sense , my store can’t take being slammed by Google anymore. Am I correct the issue is that our auto generated sitemap.xml includes these bad urls. What if built my own tidy sitemap and sent that to Google instead.
I think this should work my brother helped by putting this code in the robot.txt file to unblock the url. Hopefully this will take care of the issue.
Hello,
your code definitely helped to stock the hack from the /collections directory but now the /search seems to be the new entry door.
What would you recommend to prevent this ?
Many thanks
Anthony
We have the same issue on our site that @shadi1 has.
I looked at the Shadi1 code and they have not got the page set to noindex as you say they have. So even if they do unblock this pathway on robots.txt (something that Shopify forced on all of us when it was updated to disallow crawling of any URLs with [email removed] then it will still get crawled and still get shown in the index.
Why hasn’t the same solution been applied to those URLs with [email removed] as you did to those with [email removed] As whilst not ideal at least with a 404 page and the noindex directive, I can simply request search engines remove the URLs from the index and it will be sorted ina day or two. With crawling being blocked by robots.txt, there is nothing to stop search engines from adding them back to the index again.
Will you be applying the same fix to the [email removed] versions that you did to the [email removed] URL’s going forward? Or will you be resolving the issues that are causing these pages to be found in the first place?
1 Like
I m going to look deeper into it today , but the shopify staff member stated here that the page is set to no index and all i have to do is undo the blocked [email removed] from the robot.txt.
Honestly i m getting sick of this bs. Every time i start to get my ranking and traffic up something new takes me down.
My blocked by robot text but still indexed count jumped by 1k today. I understand this will take some time, but how is this happening!
Brenden_H is right Shopify we need the same fix that was done to /web-pixel-manager ASAP.
1 Like
Hey everyone,
My indexed pages are also shooting up day after day because of the [email removed] URLs. This is stressful as I have just been able to get reindexed on Bing after 3 months (following the spam pages exploit).
I am unsure what solution to implement while we wait for Shopify to fix the issue on their end. There seems to be contradicting information being provided.
Can anyone from Shopify give us a temporary fix that we could implement while we wait for the permanent fix on Shopify’s end?
For those of us who are not very technical, detailed instructions would be very helpful.
By the way, thank you for you help until now @gregbernhardt .
1 Like
We’re still internally discussing a solution regarding the pixel pages. I’ll report when I have more information.
Yes @shadi1 , I checked the page you shared and it isn’t set to noindex as Shopify have done with the first version of the URL. I don’t believe there is a way we can set it as noindex ourselves as these pages are not in the structure available to us to add these directives using Shopify apps.
If you want to take them out of the index temporarily so that search engines are not judging you on this, go to your Google Search Console and on the left-hand side of the screen select “Removals” in the indexing section. Then add this URL as a temporary removal request using the “new request” button: https://xtremedigitalgraphix.com/wpm@
It will then remove anything using that entire pathway from the index. Search Console will take a week or so to catch up but if tomorrow you go onto Google and use the site: search and add that URL to it there shouldn’t be anything indexed there. Then you can wait on Shopify to resolve at their end as this removal can last for 3-6 months and will cover all versions of that URL pathway.
@gregbernhardt do you have a timeline for when we can expect to have an answer?
Greg are you sure there no index no follow implemented right now?
1 Like
No timeline. Noindex is implemented, but robots is blocking crawling from seeing it atm.
I’ve attached an image of the source code from the page that @shadi1 shared and it is not set to noindex.
The noindex setting is only showing on the versions of the URL which start with [email removed] address - there are no meta robots directives on URLs starting with [email removed] as I have checked dozens of them on our site and on the person who shared theirs here.
I believe the noindex is sent via header
1 Like
Hi …I could be wrong this is all over my head, but I focussed on sitemap.xml , since that is what Google uses to index. I went through support. Wasn’t me , somehow my sitemap (products) was revised from
https://vr.supplies/sitemap_products_1.xml (which was filled with garbage links)
to
https://vr.supplies/sitemap_products_1.xml?from=1680358867017&to=6815972884560 (which is just my product)
Whoever did this …THANK YOU! seems to be a good solution.
GO to your domain.xxx/sitemap.xml copy and paste into URL Field and see what’s there. Then go to your Google Console and ask Google to re-index it now.