Google search console threw up some URLs from my site tha haven’t been indexed.
They seems to be spammy links to a fifa coins site.
But I didn’t create them
Any help would be hugely appreciated.
Best
Mike
Topic summary
Issue Identified:
Shopify store owners discovered spam URLs appearing in Google Search Console, primarily related to FIFA coin sites they didn’t create. These URLs exploit search query parameters and vendor fields to generate spammy backlinks.
Root Cause:
The spam results from bots manipulating search terms and vendor query strings (e.g., /collections/vendors?q=fifa-coins). Shopify support initially characterized these as harmless “spam backlinks” from external search queries, not actual security breaches.
Community Solutions:
User Jizo_Inagaki provided code snippets to add noindex meta tags:
- For vendor pages: Check if path is
/collections/vendorswith zero products - For search pages: Check if path is
/search/with zero results
Both solutions insert <meta name="robots" content="noindex"> in theme.liquid after the <head> tag.
Official Response:
Months later, Shopify deployed a platform-wide fix generating 404 pages for unknown vendors based on query strings, blocking Google indexing. However, the rollout is gradual.
Ongoing Concerns:
Some users report recurring spam pages despite fixes. Questions remain about whether to use Google’s disavow tool (designed for external backlinks, not on-site spam) and whether the solutions fully prevent future attacks.
2 Likes
Hey, @MikeTaylor
Have you had someone do some work on your store in the past? With that said, based on the URL it looks like that link was created in part by using the ‘Vendor’ field to create a URL based on Fifa coins.
Go to your Admin > Products page and click on the ‘Product Vendor’ filter to find any vendors that mention ‘Fifa Coins’. When you filter them, those products that include that vendor will appear in the products list. From there you can select those products for editing, and the fifa coins mention from the vendor field.
If there is anything else I can help you with, please let me know.
Hi There,
August 18th – I’m having the same issue as MikeTaylor. Google search console found a couple SPAM pages that I didn’t create. It’s the same spam about FIFA coins.
I don’t know how to get rid of them as the pages aren’t in any accessible area of Admin. Had a call into Shopify support earlier today and they were very perplexed and said they will get back to me with a resolution. (hopefully)
I tried the fix above but there were no selections for another vendor.
Any further help would be most appreciated.
MikeTaylor – Did you see more SPAM pages appear after your post July 30th?
Thanks
Michael
1 Like
To respond to Dirk’s question…In my case no one outside has worked on the site and all admin has been done from the same location for years. Login is always done via two-stage.
Nonetheless, it has the appearance that someone on the outside was able to generate the SPAM pages.
3 Likes
Hi. I’ll need to check Google Search Console (I’m away). But Dirks experience is exactly mine.
Exactly. If this is the case, Shopify has a major security issue on its hands.
3 Likes
Sorry Michael’s issue. Doing this on a phone. (Badly).
I agree it looks like a security issue. Curious to see how many other shop owners have the same issue since not everyone checks their indexed pages or Google Search Console all the time. For reference, I uploaded a screen shot of the SPAM urls Google found. Again, these were generated somewhere outside, not by me and there is not a way to delete the bogus pages. I have not yet heard back from Shopify Support but will contact them again today.
6 Likes
We have just discovered the same issue. No work done by outsiders. No vendors for Fifa found under products. It seems like some security breach.
4 Likes
Hey Shopify. This really seems to be a problem. It looks like a flaw in your platform is being exploited and people are able to manipulate our websites. Can you please update us on where you are with this?
Best
Mike
5 Likes
Hi Michael
Did you hear anything from Shopify support?
Same issue in my Google Search Console. Doesn’t appear connected to my shop at all, nothing found in vendors or products, nobody else has done work on my shop.
Google shows the referring page to this bogus link as:
www_reviewopolis_com_slash_4r468_slash_c42rs_dot_pptx
Looks like this referring page was created back in June. Stayed up for a month before disappearing, then came back last week. It is now gone again.
1 Like
Hi Mike,
I am having the same issue. Did you happen to install the app Easy Redirects 301 & 404? Shopify keeps telling me it could be an app and perhaps we can try to narrow down which (if any) it is.
1 Like
iconhookah.com - we are having the same issue. We need this to be solved please.
1 Like
Shopify only recommended us to disavow this in search console, but did not provide a solution to remove this from the website. Apparently they can’t fix this so far.
1 Like
Google shows 327 000 search results with this page. This looks like a mass problem. Conversation with support ended only on second recommendation to disavow the link. This is not the backlink, this is a page created on my domain! And the screenshot shows that those pages are indexed!
2 Likes
Hi Dirk,
I wanted to just highlight that we have all tried this but nothing shows up. I’ve also made all the changes to ensure it wasn’t a breach however this is starting to look like an issue with shopify itself. I keep getting told whenever I reach out it could be a theme issue, yet all the sites here are different templates most of which are shopify templates (mine is third party). We are also told it could be apps but what is the likelihood that we all downloaded the same app? The same spam can be seen through all our sites. I am seriously concerned about customer data right now and all your team is doing is shifting the blame to us and saying we should “hire experts”.
This really needs to be fixed, it’s not enough to tell us to disavow on search console. If you do not solve this many more of your sites will be compromised.
We have a huge season coming up and need this fixed asap.
4 Likes
Hey.
I just had the similar reply (see below). They’re obviously aware of the issue and have decided this is how they deal with it for now. I feel that this issue is bigger than “it’s just a thing you can’t stop and doesn’t matter - get Google to disavow them…”
Hi Mike,
Thank you for reaching out to us. My name is XXXX and I am here to assist you today.
I understand there are some unauthorised activity initiated in your store and I would be more then happy to resolve this issue for you.
I’ve taken a deeper look on all the information you’ve provided on the thread and I am very happy to share with you that your store is safe and it is just a little bot running wild.
The odd-looking url and domains that you have posted on the thread are actually search terms of what some visitors to your site have actually searched.
This search term is usually distinct from typical searches on the site (such as being in Korean on an American shop, and including a domain) and may span up to thousands of these kinds of backlinks. It can be a bit scary for the merchant but there are no real security concerns here.
The technical term of what has happened is called Spam Backlinks. I get that this is not exactly the most pleasant thing to have so I have attached a link here on how you can potentially stop it from happening.
Whatever that is happening at the moment does not pose any form of threat to your store in anyway. Taking that into consideration there are 2 courses of action here that you can take:
Option 1: Not take any action as none is actually necessary and taking steps would not do anything other then removing some search data that is not affecting you now or in the future
Option 2: “Code” it away
Using your SEO reporting software (Which in your case is Google Search Console) you can collect all the bad backlinks into a .txt file and report them via Google’s Disavow Tool. Information on the structure can be found in their help doc here. Note that the backlinks to list will be the referral site address rather than their search term URL.
Please understand that option 2 is fairly complicated and in light of that I will need to share this disclaimer with you pertaining to Option 2:
This is an advanced feature and should only be used with caution. If used incorrectly, this feature can potentially harm your site’s performance in Google’s search results. We recommend that you only disavow backlinks if you believe that there are a considerable number of spammy, artificial, or low-quality links pointing to your site, and if you are confident that the links are causing issues for you.
**
1 Like
Hey. I didn’t install this app. Sorry.
