UPDATE: It would seem Google is looking into this right now, which is great. The sole reason I posted this was to get the issue patched, I couldn’t find a method of contacting Google or reporting this directly and maybe naively thought this would generate the most gravitas.
UPDATE 2: This was fixed within 7 hours of reporting the problem. Great work by the team at Google to get it fixed and all the URL’s removed in this way should now be back in the index.
This is my first post so I thought I should make it a good one, I hope you enjoy reading it as much as I have writing it.
Yesterday I was busy removing thousands of URL’s from within Googles Webmaster Tools, it was pretty time consuming as there were so many, there had to be an easier way? I settled on quickly making myself a chrome extension that adds a link next to a result in a Google search, deep linked into webmaster tools. With that installed I was busy clicking away removing the URL’s in record time.
Then I made a little mistake and accidentally removed a URL of a website I have no relation to?!? I was stunned it could be that easy. Surely there was no way Google would actually remove the page, right?
I decided to dig a little deeper and do a few tests to see how powerful this could potentially be and how wrong was I! These are the tests I performed, some of which I do not have screenshots for as I really didn’t think it would actually work.
The Tests
- Remove a website I control (not in my webmaster tools account) on 18/07/2011 – Gone!
- Remove a URL on one of the world’s largest websites (the accident) on 18/07/2011 – Gone!
- Remove a friends blog (blank and with permission) on 18/07/2011 – Gone!
NB: On none of the tests were the pages blocked by robots or returned a 404 response (apparently a prerequisite for removal)
How To Do It (please don’t and hopefully Google will patch it soon)
Disclaimer: If you are going to test this please make sure you have permission from the site owner, otherwise although it is a loophole I am pretty sure it is illegal.
The process is actually very simple and just requires some minor modifications to a URL, followed by a form submission. Edit the following URL:
https://www.google.com/webmasters/tools/removals-request?hl=en&siteUrl=http://{YOUR_URL}/&urlt={URL_TO_BLOCK}
Replace in the URL above:
- {YOUR_URL} = A URL you control within Webmaster Tools
- {URL_TO_BLOCK} = The URL of the site you want to block:
- You can request removal of the following:
- Site – Provide top level domain (E.g. http://www.someurl.com/)
- Section – Provide URL of the folder (E.g. http://www.someurl.com/somefolder/)
- Page – Provide URL of the page (E.g. http://www.someurl.com/somefolder/somepage.html)
If you request the modified URL in your browser (make sure you are logged in to your Google account) you should see:
I didn’t actually remove the News Of The World by the way, News International have done quite a good job of that themselves. If you do actually click the Submit Request button, you should see the following:
It then gets inserted as a Pending request in the site owners Webmaster Tools account. If the request is not cancelled it usually leads to the removal of the site from Google’s index which is why I think this is probably the biggest vulnerability in Google today and why I am highlighting it here. I can’t believe I am the only person to figure this out and there are a number of things that could be happening right now if this information is already in the wrong hands.
Thankfully, there is a time delay from when the request is made to when it is actually processed. The only reason I am happy to highlight this here whilst it is still possible, is because it should be so easy for them to fix (and should have never been possible in the first place).
I have tried to forward this on to Google in the hope that they fix it, but if anyone can pass it to the correct person that would be great. If someone from Google could email me, I also want to let you know the URL of the site I accidentally removed so you can remove the removal request for that URL.
{ 126 comments… read them below or add one }
← Previous Comments
don’t work
Yo dawg, i heard you like removals so we removed the removal request from our removal request list. LOL!
Nice find. I hope google will fix it soon.
nice trick ..really like it
thx for your post! any chance of releasing your chrome-extension to the public?
OMG! I wonder how many pages have been maliciously removed before Google solved the problem
Freakin’ genius, mate! Hope Google gets to know about this. They usually don’t give their customers any thought
Fucking Google maked my ass fried!I wondered why my sait wasnt in its index for 5 months!Someone around my competitors did all that!Hopefully everything got worked today!Thank you James!You are a fucking clever guy!
Is your chrome extension is published somewhere? Have the same problem…
I wonder how many scummy SEO people you just pissed off
Very good!
This is one of the most stupid post I have ever came through. And the most silliest and ignorant are those commenters who WOWed the post. I am very astound to find out that none of these commenter and the blogger has realised that you can not remove even your own content from the search engines index unless you have blocked them using noindex or robot.txt or using the 404 header method .
Holy sh**! Using this bug it could be destroy the Internet. WOW! Maybe this bug is sponsored by Microsoft and their MSN? Heheh. Cheers!
This method only sends a request for removal. Even if the request is granted, after some time Google re-indexes the removed site, section or page. This is why Google is telling : for permanent removal use robots.txt on your site. So nothing to worry about
Though, this was a loophole and they would actually accept your request to remove url from other site.
but the url will actually be removed only if you follow this
To remove a page or image, you must do one of the following:
Make sure the content is no longer live on the web. Requests for the page must return an HTTP 404 (not found) or 410 status code.
Block the content using a robots.txt file.
Block the content using a meta noindex tag.
It’s another case that, someone site is down and you could have got their site de indexed. Nice catch but i think it didn’t affect many people.
Man, you could have earned millions in just a few days! Please tell me, did you know that and just aren´t motivated by money or didn´t see you this opportunity of Your life?
Gosh!!! Was it that simple!!!. Sssshh!! If my clients come to know of this, they would happily remove all their competitors online. lol.
Thanks for the amazing find mate.
This is terrifying!! I can’t understand how things like that can still happen after so many years of development. I hope this is fixed.Thanks for reporting it.Great work
Amazing find. At least google have fixed it now, however it should never have been allowed to occur in the first place.
If you claim they fix it…how can we verify if it was for real!
Have always like to have a play with ULR prameters, But never thought a website like google would let you do it.
Another reason to qestion how safe is our data with google.
Please post the source code for your chrome-extension and also please make it available for download.
Please send me your chrome-extension, thanks.
This was a big loophole. I guess Google should reward you
It’s a pity I did not know about it BEFORE it was fixed
Would have some “fun”.
Interesting bug.
I can`t believe, you`re first to find it.
Wow, this was a big deal. I am sure Google fixed this pretty quick, and wiped their brows that it didn’t turn into a huge problem.
← Previous Comments
{ 1 trackback }