Enterprise link building is the process of acquiring links to a large, enterprise company’s website to improve its visibility and rankings in search engines.

Enterprise companies get a lot of links naturally. While they may have some challenges with link building, these companies also have a ton of opportunities because of who they are and how much money is at stake.

Links play a role in many of Google’s systems including Experience Expertise Authoritativeness Trustworthiness (E-E-A-T). As Google says:

Google’s algorithms identify signals about pages that correlate with trustworthiness and authoritativeness. The best known of these signals is PageRank, which uses links on the web to understand authoritativeness.

Links are still an important ranking factor in Google. I ran a study to measure the impact of links and removed good links using the disavow tool. The pages lost both rankings and traffic.

Let’s look at what it takes to do link-building in an enterprise environment.

Getting buy-in and budget

• Paste your domain into Site Explorer
• Go to the Best by links report
• Add a “404 not found” HTTP response filter

I usually sort this by “Referring domains.”

So for this example, let’s say I do 250 redirects that on average have 10 RDs. That’s 250 x 10 x $400 = $800,000 as a value I can use to pitch for the redirect project. It’s typically a large enough number for the project to get attention and resources.

Prioritization

Coordination

You have a lot of different options for link building in an enterprise environment. If you’re not sure where to start, I’d check out the Links section in Opportunities report in Site Explorer. This report has shortcuts to other reports with filters applied, that help you with some common tasks.

Here are some of the things you might want to try.

Create linkable assets

In SEO, we use the terms “linkable asset” or “link bait” to refer to content that is strategically crafted to attract links. Such linkable assets can take on many different forms:

• Industry surveys
• Studies and research
• Online tools and calculators
• Awards and rankings
• How-to guides and tutorials
• Definitions and coined terms
• Infographics, GIFographics, and “Map-o-graphics”

You can also use any industry-famous employees or thought leaders you have to create interesting quotes that might be linked.

There’s also a phenomenon where high-ranking pages get linked to more over time. If your content is good enough to get you near the top, you’re more likely to get more links. Tim Soulo calls this the vicious circle of SEO.

For more ideas, check out our guide to enterprise content marketing.

Combine similar content to create a stronger page

Keyword cannibalization is when a search engine consistently swaps rankings between multiple pages or when multiple pages rank simultaneously for the same keyword but are similar enough to be consolidated. Consolidating similar content into comprehensive guides or pillar pages can improve your chances of ranking and earning links. To do that, you usually combine the content and redirect one page to the other.

Promote your content

Go after unlinked brand mentions

Unlinked brand mentions are online mentions (citations) of your brand—or anything directly related to your brand—that do not link back to your site.

Enterprise companies tend to get talked about a fair bit, and each one of those mentions offers a chance to get a link. Even if there’s not initially a link, it doesn’t hurt to ask for one. You can use Content Explorer to find these mentions on the web, and the inbuilt filter for highlighting unlinked domains to hone in on unlinked mentions.

You can also look for unlinked brand mentions of key employees, famous quotes of theirs, or statistics from your studies.

Recover links with link reclamation

Sites, and the web in general, are always changing. We ran a study that found that ~two-thirds of links to pages on the web disappeared in the nine-year period we looked at.

In many cases, your old URLs have links from other websites. If they’re not redirected to the current pages, then those links are lost and may no longer count for your pages.

It’s not too late to do these redirects, and you can quickly reclaim any lost value and help your content rank better.

Here’s how to find those opportunities:

• Paste your domain into Site Explorer
• Go to the Best by links report
• Add a “404 not found” HTTP response filter

I usually sort this by “Referring domains.”

I even created a script to help you match redirects. Don’t be scared away; you just have to download a couple of files and upload them. The Colab notebook walks you through it and takes care of the heavy lifting for you.

While this script could be run periodically, if you’re constantly having to do redirects, I would recommend that you automate the implementation. You could pull data from the Ahrefs API and visits from your analytics into a system. Then create logic like >3 RDs, >5 hits in a month, etc. and flag these to be redirected, suggest redirects, or even automatically redirect them.

If you had redirects in place for a year or more already, the value is likely already consolidated to the new pages. That’s what Google recommends and seemed to be true when we tested it. You could also add a flag for “was redirected” into the automation logic that checks if the page was previously redirected for a year to account for this.

Copy competitor links and strategies

What I would recommend instead is the Best by links report in Site Explorer.

This is going to show you the most linked pages on a website. For us, that’s our homepage, some of our free tools, and our blog and data studies.

Another option is the Site Structure report in Site Explorer sorted by Referring domains or Referring pages.

This lets me quickly see that things like our blog, free tools, glossary, and training academy videos are all well linked.

Build internal links

I’ve always found internal links to be a powerful way to help pages rank higher.

Even these links may be difficult to get in an enterprise environment. Sometimes different people are responsible for different sections of the website, which can make internal linking time-consuming and may require meetings and a lot of follow up to get internal linking done.

On top of the political hurdles, the process for internal linking can be a bit convoluted. You either have to know the site well and read through various pages looking for link opportunities, or you can follow a process that involves a lot of scraping and crawling to find opportunities.

At Ahrefs, we’ve made this simple, scalable and accessible so anyone can find these opportunities. The easiest way to see internal link opportunities is with the Internal Link Opportunities report in Site Audit. We look at what your pages are ranking for and suggest links from other pages on your site that talk about those things.

I’d also recommend watching out for opportunities to use better link anchor text. It’s common for page creators to overuse generic link anchor text such as ‘learn more,’ ‘read more,’ or ‘click here.’ You can look for usage of this kind of generic copy in the Internal anchors report in Site Explorer.

Build links from other websites you own

Buy other companies websites

I wrote all about SEO for mergers and acquisitions. When you buy another company, you inherit their content and their links. This opens some nice options for consolidating content and links to stronger pages.

• Ahrefs’ Site Explorer – Shows you all links of any website or URL with an option to sort and filter them by many important SEO metrics.
• Ahrefs’ Content Explorer – A unique link prospecting tool, which helps you find thousands of relevant websites for link requests and guest posting. Also helps to discover linkable assets on any topic from all around the web.
• Ahrefs’ Web Explorer – Lets you search through our search engine’s (yep.com) entire database of pages, domains, and links using search operators.
• Ahrefs Alerts – Similar to Google Alerts but has more flexibility with SEO-related filters.
• Pitchbox / BuzzStream– Email outreach tools. There are many other tools that let you send personalized emails at scale, but these are popular with SEOs.
• Hunter.io / Voila Norbert – Email lookup services help you find contact details of websites at scale.

Also check out our guide to enterprise SEO tools.

Final thoughts

There’s so much at stake in enterprise SEO and so many opportunities. When a company and its people finally get behind SEO, they can dominate an industry.

If you have any tips, enterprise SEO experiences you’d like to share, or questions, let me know on X or LinkedIn.

WordPress plugins continue to be under attack by hackers using stolen credentials (from other data breaches) to gain direct access to plugin code.  What makes these attacks of particular concern is that these supply chain attacks can sneak in because the compromise appears to users as plugins with a normal update.

Supply Chain Attack

The most common vulnerability is when a software flaw allows an attacker to inject malicious code or to launch some other kind of attack, the flaw is in the code. But a supply chain attack is when the software itself or a component of that software (like a third party script used within the software) is directly altered with malicious code. This creates the situation where the software itself is delivering the malicious files.

The United States Cybersecurity and Infrastructure Security Agency (CISA) defines a supply chain attack (PDF):

“A software supply chain attack occurs when a cyber threat actor infiltrates a software vendor’s network and employs malicious code to compromise the software before the vendor sends it to their customers. The compromised software then compromises the customer’s data or system.

Newly acquired software may be compromised from the outset, or a compromise may occur through other means like a patch or hotfix. In these cases, the compromise still occurs prior to the patch or hotfix entering the customer’s network. These types of attacks affect all users of the compromised software and can have widespread consequences for government, critical infrastructure, and private sector software customers.”

For this specific attack on WordPress plugins, the attackers are using stolen password credentials to gain access to developer accounts that have direct access to plugin code to add malicious code to the plugins in order to create administrator level user accounts at every website that uses the compromised WordPress plugins.

Today, Wordfence announced that additional WordPress plugins have been identified as having been compromised. It may very well be the case that there will be more plugins that are or will be compromised. So it’s good to understand what is going on and to be proactive about protecting sites under your control.

More WordPress Plugins Attacked

Wordfence issued an advisory that more plugins were compromised, including a highly popular podcasting plugin called PowerPress Podcasting plugin by Blubrry.

These are the newly discovered compromised plugins announced by Wordfence:

• WP Server Health Stats (wp-server-stats): 1.7.6
  Patched Version: 1.7.8
  10,000 active installations
• Ad Invalid Click Protector (AICP) (ad-invalid-click-protector): 1.2.9
  Patched Version: 1.2.10
  30,000+ active installations
• PowerPress Podcasting plugin by Blubrry (powerpress): 11.9.3 – 11.9.4
  Patched Version: 11.9.6
  40,000+ active installations
• Latest Infection – Seo Optimized Images (seo-optimized-images): 2.1.2
  Patched Version: 2.1.4
  10,000+ active installations
• Latest Infection – Pods – Custom Content Types and Fields (pods): 3.2.2
  Patched Version: No patched version needed currently.
  100,000+ active installations
• Latest Infection – Twenty20 Image Before-After (twenty20): 1.6.2, 1.6.3, 1.5.4
  Patched Version: No patched version needed currently.
  20,000+ active installations

These are the first group of compromised plugins:

• Social Warfare
• Blaze Widget
• Wrapper Link Element
• Contact Form 7 Multi-Step Addon
• Simply Show Hooks

More information about the WordPress Plugin Supply Chain Attack here.

What To Do If Using A Compromised Plugin

Some of the plugins have been updated to fix the problem, but not all of them. Regardless of whether the compromised plugin has been patched to remove the malicious code and the developer password updated, site owners should check their database to make sure there are no rogue admin accounts that have been added to the WordPress website.

The attack creates administrator accounts with the user names of “Options” or “PluginAuth” so those are the user names to watch for. However, it’s probably a good idea to look for any new admin level user accounts that are unrecognized in case the attack has evolved and the hackers are using different administrator accounts.

Site owners that use the Wordfence free or Pro version of the Wordfence WordPress security plugin are notified if there’s a discovery of a compromised plugin. Pro level users of the plugin receive malware signatures for immediately detecting infected plugins.

The official Wordfence warning announcement about these new infected plugins advises:

“If you have any of these plugins installed, you should consider your installation compromised and immediately go into incident response mode. We recommend checking your WordPress administrative user accounts and deleting any that are unauthorized, along with running a complete malware scan with the Wordfence plugin or Wordfence CLI and removing any malicious code.

Wordfence Premium, Care, and Response users, as well as paid Wordfence CLI users, have malware signatures to detect this malware. Wordfence free users will receive the same detection after a 30 day delay on July 25th, 2024. If you are running a malicious version of one of the plugins, you will be notified by the Wordfence Vulnerability Scanner that you have a vulnerability on your site and you should update the plugin where available or remove it as soon as possible.”

Read more:

WordPress Plugins Compromised At The Source – Supply Chain Attack

3 More Plugins Infected in WordPress.org Supply Chain Attack Due to Compromised Developer Passwords

Featured Image by Shutterstock/Moksha Labs

Enterprise technical SEO is the practice of optimizing a large, enterprise company’s website to help search engines find, crawl, understand, and index your pages. It helps increase visibility and rankings in search engines.

Enterprise websites are where technical SEO shines. There’s so much money at stake. One mistake can keep millions of pages out of the index or remove an entire site from search results. One fix can potentially be worth millions of dollars in revenue.

Let’s look at what it takes to be successful at technical SEO in an enterprise environment.

Enterprise sites can have complex infrastructures and a lot of legacy systems in place. You’ll have to work with a lot of teams, work through a lot of issues, and work hard on getting buy-in.

Working with others

Technical SEOs will likely work with a lot of dev teams, but you may end up working with all kinds of teams in different area like products or services, international because of hreflang, taxonomists and/or ontologists for website structure, infrastructure, CMS teams, or even security for things that get indexed but shouldn’t be.

You’ll probably have to create a lot of reports for a lot of different teams and executives. Check out our guide on enterprise SEO metrics and reporting for some tips.

Organizational improvements

Many teams start off doing ad-hoc work, but eventually things start to centralize, you create standards and processes (SOPs), and eventually you start to get more buy-in by being more proactive and doing things like training other teams.

A lot of this progression depends on a leader who can be successful, visible, and sell SEO in the organization. They will likely spend as much, or more time promoting successes as they will doing the work.

They may have to create SEO forecasts, have lots of executive meetings to show results, train other teams, create those SOPs, send newsletters to keep others informed, etc.

For technical SEOs in particular, make sure you also promote the work of the developers and teams you work with. If you can get them visibility and a promotion, you’ll have an advocate for SEO who is bought in and will be more likely to work with you on future projects.

Professional development

Take advantage of any funds you’re given for SEO courses, conferences, etc. I highly recommend attending Ahrefs Evolve if you get a chance. If you want to be a manager, you may also look into managerial or leadership courses.

A big part of technical SEO will be setting up your crawls and monitoring for issues. While it would be great if you could get everything technically perfect, it’s rarely realistic on enterprise websites.

One of the things I like about Ahrefs’ Site Audit is that you can choose to ignore issues that you don’t find important.

You can also add any custom issues that you want. We have every data point for the pages and links configurable as issues, as well as changes between dates. You can even change the prioritization level for each issue.

You might also want to break down issues by CMS or even by template so you know exactly which group each issue belongs to and can see when they resolve the issues. This can be done with segments in Site Audit.

You can help a lot of other teams with their data needs. You will likely be asked for things like checking for scripts or outdated file versions, words you’re not supposed to mention, extracting authors, publish dates, update dates, or other useful data.

In many crawlers, you’ll need to do this setup before crawling, but in Ahrefs Site Audit you can actually search within the HTML or text after the crawl has already happened.

For your crawling, you have a few options.

Normal crawls

Catch issues before they launch

You can also use Ahrefs’ Site Audit to crawl staging and dev environments to check for any issues before they’re launched to the public.

Catch any issues faster with crawl sampling

You can run Ahrefs’ Site Audit for a custom list of pages daily and get alerted to any changes. Using a sample across different templates or systems, you can find issues faster.

You could also run a smaller crawl on any section that made any new pushes to production.

The fastest way to catch changes: always-on crawling

IndexNow is allowing us to add a real-time option, and at the same time we will be able to save resources for our users and ourselves.

For sites using IndexNow and the new always-on option in Site Audit, we’ll be able to notify users of issues shortly after they make updates to their pages.

This is how that will look:

I can’t think of a system that would be better than this. A practically real-time monitoring and alerting system. As a technical SEO, this is a dream come true for me.

Check out our study on technical SEO issues. We ran audits on over 1,000,000 websites to see the most common issues.

You have to prioritize tasks and focus on the most significant issues. I typically use an impact / effort matrix as a visual to help others understand what I consider the most important tasks. Here’s what that looks like:

You will likely have to work with any dev teams for a better effort prediction, but in my experience I’ve found they appreciate it if you take a first pass at estimating the effort involved. Then give them the opportunity to make adjustments based on how much effort they think it will take.

You may have major incidents and end up in what are sometimes called fire drills or war room situations where stakeholders are gathered to work through a problem. In this case, something likely went horribly wrong and is costing the company a lot of money. This will always override any other priorities.

I doubt there’s a major website that is technically perfect. If there was, I’d be concerned they were wasting resources on things that don’t matter over things that do.

What’s interesting about enterprise, is that sometimes you have to make decisions that aren’t necessarily ideal. For instance, you might have some pages or sections of the site with issues that never get fixed because doing so is more expensive than the work involved. The return on investment (ROI) just isn’t there.

Instead of doing what is right, sometimes you’ll have to choose the least bad option. You won’t have control of everything. Just do the best you can and when you have the opportunity, make the most future-proof decisions you can.

I wanted to cover some projects to help you get started with technical SEO in an enterprise. Of course you may want to start with a technical SEO audit first in order to identify the issues.

Check indexing

You probably have some pages indexed that shouldn’t be, and many pages noindexed that should be indexed. Canonicalization is another issue to check to make sure the version of a page you want indexed is the one that is indexed.

First, check the Indexability report in Site Audit for “Noindex page” warnings.

Google can’t index pages with this warning, so it’s worth checking they’re not pages you want indexed.

You can also check the Site Structure report in Site Explorer for any pages with organic traffic that shouldn’t have traffic.

Recover links with link reclamation

Sites, and the web in general, are always changing. We ran a study that found that ~two-thirds of links to pages on the web disappeared in the nine-year period we looked at.

In many cases, your old URLs have links from other websites. If they’re not redirected to the current pages, then those links are lost and may no longer count for your pages.

It’s not too late to do these redirects, and you can quickly reclaim any lost value and help your content rank better. I normally assign a dollar amount like $400 per referring domain in order to make a business case for this.

Here’s how to find those opportunities:

• Paste your domain into Site Explorer
• Go to the Best by links report
• Add a “404 not found” HTTP response filter

I usually sort this by “Referring domains.”

I even created a script to help you match redirects. Don’t be scared away; you just have to download a couple of files and upload them. The Colab notebook walks you through it and takes care of the heavy lifting for you.

While this script could be run periodically, if you’re constantly having to do redirects, I would recommend that you automate the implementation. You could pull data from the Ahrefs API and visits from your analytics into a system. Then create logic like >3 RDs, >5 hits in a month, etc. and flag these to be redirected, suggest redirects, or even automatically redirect them.

If you had redirects in place for a year or more already, the value is likely already consolidated to the new pages. That’s what Google recommends and seemed to be true when we tested it. You could also add a flag for “was redirected” into the automation logic that checks if the page was previously redirected for a year to account for this.

Add internal links

I’ve always found internal links to be a powerful way to help pages rank higher.

Even these links may be difficult to get in an enterprise environment. Sometimes different people are responsible for different sections of the website, which can make internal linking time-consuming and may require meetings and a lot of follow up to get internal linking done.

On top of the political hurdles, the process for internal linking can be a bit convoluted. You either have to know the site well and read through various pages looking for link opportunities, or you can follow a process that involves a lot of scraping and crawling to find opportunities.

At Ahrefs, we’ve made this simple, scalable and accessible so anyone can find these opportunities. The easiest way to see internal link opportunities is with the Internal Link Opportunities report in Site Audit. We look at what your pages are ranking for and suggest links from other pages on your site that talk about those things.

Add schema markup

I’m a fan of schema markup as long as it gets you a search feature. Check out our guide to schema markup to see which ones you should be implementing. There are some cool tools now that can even suggest schema markup based on what is seen on the page.

Fix Page Experience

• Core web vitals. This is how fast your pages load.
• HTTPS. You want your pages to be secure. A surprising number of sites, >6%, redirect HTTPS to HTTP.
• Mobile-friendliness. Are your pages usable on mobile?
• Interstitials. You don’t want intrusive interstitials, or those that take up a good chunk of the screen.

We cover most of these in Site Audit. For example, we pull PageSpeed Insights data so you get actual Chrome User Experience Report (CrUX) metrics for Core Web Vitals as well as Lighthouse metrics in Site Audit.

We also flag mobile SEO issues.

General website health / maintenance

• Broken links. Find them and fix them.
• Redirect Chains. Google will follow up to 10 hops. I don’t worry until after 5 hops.
• Add sitemaps. I would make sure this is automated. If you are asked to manually create them, you can do it, but just know that if it’s manual these will rarely be kept up-to-date. If you’re creating them based on crawled pages, then it’s likely all search engines can crawl them anyway.

You may want to check if any of the chains are too long. Look for this in the “Issues” tab in the Redirects report.

Fix Hreflang issues

Hreflang helps show the right page to the right user in search. This can be crucial for enterprise companies to get right as the dropoff from bad pathing or annoying users can cost you a lot of money.

We flag a number of different hreflang issues in Site Audit.

There are also some nice visualizations to help you explain issues like this first-if-its-kind hreflang cluster visualization. It shows and tells you what is broken, making it much easier to explain to stakeholders than the typical spreadsheet.

Optimize crawl budget

Crawl budget can be a concern for larger sites with millions of pages or sites that are frequently updated. In general, if you have lots of pages not being crawled or updated as often as you’d like, then you may want to look into speeding up crawling.

Optimize ecommerce pages

Ecommerce SEO would be important for any sites selling products.

For enterprise sites, faceted navigation in particular can be tricky. Luckily we have a great guide on faceted navigation.

Fix JavaScript SEO issues

The bigger the site, the more likely you are to run into multiple tech stacks. Some of those may be JavaScript frameworks. These are relatively newer than CMSs and less understood by SEOs, so we have a guide on JavaScript SEO that covers many of the issues you’ll face and how to troubleshoot them, as well as how the rendering process works for Google.

Migrate other websites

A website migration is any significant change to a website’s domain, URLs, hosting, platform, or design. Big companies like to change these things and it creates havoc. Try to write any standards to keep things consistent and minimize the impact of changes.

Keep traffic during mergers and acquisitions

Enterprise companies buy other companies all the time. When I worked in enterprise SEO, I felt like I was constantly doing one website merger project or another. There’s a lot that can go wrong and a lot of money on the line. Check out our guide on SEO for mergers and acquisitions for more info.

Analyze log files

Pull data from APIs

Machine learning tasks

• Ahrefs’ Site Audit. It really is best-in-class. Check it out! We’re the most used cloud-based site audit tool. We crawl ~700 million pages a day.
• Google Search Console. It has several useful tools to check indexing, crawling, etc.

Also check out our guide to enterprise SEO tools.

Final thoughts

If you have any tips, enterprise SEO experiences you’d like to share, or questions, let me know on X or LinkedIn.