Site integrity rules: hacked pages, phishing, cloaking

Audit rules for signs of a hacked site: injected and doorway pages, phishing kits, fake login overlays, obfuscated scripts, cloaking and malicious URLs.

Site Integrity rules answer a question audit tools usually skip: is this site hacked? A compromised page is an anomaly by construction, off-theme, hidden from your own navigation, impersonating a brand, or carrying an obfuscated payload. squirrelscan already has every page’s DOM, scripts, links and sitemap from the crawl, so most of these rules look for those patterns without any extra request. Two read the results of an opt-in step that does send requests, and both are off by default: Cloaking re-fetches a capped set of suspicious paths as Googlebot, and Known malicious URL checks your URLs and outbound links against threat feeds.

Correlation gating (low false positives)

A single suspicious signal is rarely proof of compromise: a big inline script, one off-theme page, or a brand mention can all be innocent. So high-severity integrity findings require at least two corroborating signals on the same page (for example brand-impersonation and an obfuscated script). A lone signal is reported as info for review, not flagged as a failure. This is what keeps a legitimate “we integrate with Calendly” page from ever tripping the brand-impersonation rule.

These rules run locally, no login required.

Run only these rules

squirrel audit https://example.com --rule-include integrity

Where to start

These carry the highest severity and weight in the category.

Kit signature: matching a page against known phishing kits: A phishing kit reuses the same markup and strings on every site it lands on. squirrel matches each page against bundled kit signatures.
Known malicious URL: checking against threat feeds: A page can be listed by Safe Browsing before you notice anything wrong. squirrel checks your URLs and outbound links against reputation feeds.
Cloaking: showing Googlebot a different page: An injected payload can hide from you by branching on user-agent or a query token. squirrel re-fetches suspicious paths and compares the responses.
Brand impersonation: a sign-in page that is not the brand’s: A ‘Sign in with Google’ control pointing at a host that is not Google is a phishing pattern. squirrel checks where credential controls actually go.
Fake authentication overlay: full-screen login iframes: A fixed, full-viewport, high z-index iframe with an auth identifier is a credential-harvesting overlay. squirrel measures the geometry and the intent.

Rules

Rule	What it flags	Severity	Scope
Brand impersonation: a sign-in page that is not the brand’s	A ‘Sign in with Google’ control pointing at a host that is not Google is a phishing pattern. squirrel checks where credential controls actually go.	warning	Page
Cloaking: showing Googlebot a different page	An injected payload can hide from you by branching on user-agent or a query token. squirrel re-fetches suspicious paths and compares the responses.	error	Site-wide
Doorway page: injected affiliate spam on a legitimate site	An off-topic, keyword-stuffed affiliate post is how a compromise monetises your domain’s authority. squirrel checks the title, the density and the body.	warning	Page
Fake authentication overlay: full-screen login iframes	A fixed, full-viewport, high z-index iframe with an auth identifier is a credential-harvesting overlay. squirrel measures the geometry and the intent.	warning	Page
Hidden orphan page: reachable but linked from nowhere	An injected page hides by being in no sitemap and linked from no page. squirrel finds crawled pages with zero inbound links and no sitemap entry.	warning	Site-wide
Kit signature: matching a page against known phishing kits	A phishing kit reuses the same markup and strings on every site it lands on. squirrel matches each page against bundled kit signatures.	error	Page
Known malicious URL: checking against threat feeds	A page can be listed by Safe Browsing before you notice anything wrong. squirrel checks your URLs and outbound links against reputation feeds.	error	Site-wide
Obfuscated inline script: spotting an injected payload	A large inline script with high entropy and eval or anti-tamper markers is rarely something a site ships on purpose. squirrel measures all three.	warning	Page
Template discontinuity: a page that is not on your theme	An injected standalone page loads none of your site’s CSS, hosts or chrome. squirrel fingerprints every page and scores it against the site baseline.	warning	Site-wide

Key terms

Cloaking: Serving search engines or particular user agents different content from what visitors see, a Google spam policy violation.
Doorway page: A page made to rank for a query and funnel visitors elsewhere, often many near-identical pages per keyword or city.
Hacked site signals: The traces a compromise leaves on a site: injected pages off the theme, phishing kits, obfuscated scripts and known malicious URLs.
Orphan page: A page that no other crawled page links to, so crawlers and readers only reach it through a sitemap or a direct URL.

Content flags hidden text and keyword stuffing on pages you published yourself. Links reports orphan pages from the link graph, the same signal Hidden orphan page reads as a possible injection.

Learn more

Website security scan with AI, the hygiene an AI-assisted security audit finds and how an agent patches it
Security headers checker
Sample report, with the Site Integrity section on a real site

Disable all Site Integrity rules

[rules]
disable = ["integrity/*"]

Edit this page