Hidden orphan page: reachable but linked from nowhere
An injected page hides by being in no sitemap and linked from no page. squirrel finds crawled pages with zero inbound links and no sitemap entry.
What a hidden orphan page is
A hidden page is one that answers a request but appears nowhere in the site’s own structure: no internal link points at it and no sitemap lists it. It is live to anyone holding the URL and invisible to the owner browsing their own site.
That is exactly how injected phishing and spam pages survive. A legitimate unlisted landing page has the same shape, which is why the rule separates the two by whether the page also carries other compromise signals. Note that this is a different question from links/orphan-pages, which counts pages with too few inbound links for discoverability.
What squirrel checks
The rule is site-wide. It builds the set of sitemap URLs from every discovered sitemap, counts inbound internal links for every crawled page, then evaluates each page. The homepage is never flagged, and neither is the page the audit started from: the URL you gave and where its redirects landed (a root that redirects to /en/ or to a sign-in page). Pages whose status code is outside 200 to 299 are ignored.
A page is hidden when it has zero inbound internal links and, if the site has a sitemap at all, is absent from it. When the site has no sitemap, absence from it means nothing, so zero inbound links alone qualifies. Each hidden page is then correlated with the page-level integrity signals for that page.
- Skipped when the crawl produced fewer pages than
minPages. Message:Need >=3 pages for hidden-page analysis. - Pass when no page is hidden. Message:
No hidden pages (all crawled pages are linked or in a sitemap). orphan-pagefails for hidden pages that carry at least one page-level integrity signal. Message:2 hidden page(s) carrying compromise signals — likely injected, with up to five paths listed.orphan-page-reviewreports info for hidden pages with no other signal. Message:4 hidden page(s): in no sitemap and linked from nowhere (review).
URLs are normalised before comparison on both sides. Severity is warning, weight 6.
How to fix it
Open each listed page. If you created it, add it to the sitemap so it is at least visible to you, or link it from somewhere in the site. If you did not, treat the site as compromised: remove the page, audit recently modified files and read the access logs.
A crawl that starts from a sitemap it cannot reach, or one that stops before it walks the whole site, produces hidden pages that are only artefacts of the crawl. Check the crawl coverage before acting on a long list.
| Rule ID | integrity/orphan-page |
| Category | Site Integrity |
| Scope | Site-wide |
| Severity | warning |
| Weight | 6/10 |
Options
| Option | Type | Default | Description |
|---|---|---|---|
minPages | integer, 2 or more | 3 | Minimum crawled pages before hidden-page analysis runs |
Configuration example
[rule_options."integrity/orphan-page"]
minPages = 10Enable / disable
Disable this rule
[rules]
disable = ["integrity/orphan-page"]Disable all Site Integrity rules
[rules]
disable = ["integrity/*"]Enable only this rule
[rules]
enable = ["integrity/orphan-page"]enable replaces the default ["*"], so this is the only rule selected. Leave disable out: a rule that matches any disable pattern is skipped even when enable names it. Only an enabled setting under a rule’s own [rule_options] table overrides both lists.
Related rules
- links/orphan-pages: the discoverability version, counting pages with too few inbound links.
- integrity/template-discontinuity: whether a hidden page even uses your theme.
- integrity/seo-doorway: what injected hidden pages usually contain.
- crawl/sitemap-coverage: the gap between what you crawl and what the sitemap lists.
Site Integrity findings ship in every audit next to the SEO, performance and agent experience rules. See Website security scan with AI for how an agent works through a report.
Glossary: Hacked site signals, Orphan page.
References
Check your site
Run squirrel audit https://example.com and open the Site Integrity section of the report. Every hidden page is listed by path, split by whether it carries other compromise signals. Signed-out local audits need no account and cost nothing. Signed-in audits spend credits.