SEO
12 Reasons Your Website Can Have A High Bounce Rate

“Why do I have such a high bounce rate?”
It’s a question you’ll encounter on Twitter, Reddit, and your favorite digital marketing Facebook group.
It’s a question you may have even asked yourself. Heck, it could be the question that brought you to this article.
Whatever brought you here, rest assured: There is no “perfect” bounce rate.
But you don’t necessarily want one that’s too high.
Read on as we dig into what may be causing your high bounce rate and what you can do to fix it.
What Is A Bounce Rate?
As a refresher, Google refers to a “bounce” as “a single-page session on your site.”
Bounce rate refers to the percentage of visitors that leave your website (or “bounce” back to the search results or referring website) after viewing only one page on your site.
This can even happen when a user idles on a page for more than 30 minutes.
So, what is a high bounce rate, and why is it bad?
Well, “high bounce rate” is a relative term that depends on your company’s goals and what kind of site you have.
Low bounce rates can be a problem, too.
Data from Semrush suggests the average bounce rate ranges from 41% to 55%, with a range of 26% to 40% being optimal, and anything above 46% is considered “high.”
This aligns well with data from an earlier RocketFuel study, which found that most websites will see bounce rates between 26% to 70%:
Based on the data they gathered, RocketFuel provided a bounce rate grading system of sorts:
- 25% or lower: Something is probably broken.
- 26-40%: Excellent.
- 41-55%: Average.
- 56-70%: Higher than normal, but could make sense depending on the website.
- 70% or higher: Bad and/or something is probably broken.
How To Find Your Bounce Rate In Google Analytics
In Google Analytics 4, Google seems to have done away with bounce rate as we know it (more on this in a bit).
In Universal Analytics, you can find the overall bounce rate for your site in the Audience Overview tab.

You can find your bounce rate for individual channels and pages in the behavior column of most views in Google Analytics.

However, most organizations are currently transitioning to Google Analytics 4, affectionately known as GA4.
If your organization is in that boat, you may be wondering, “Where did the bounce rate go?”
Your eyes aren’t tricking you; Google indeed removed the bounce rate. Or, rather, they replaced it with a new and improved metric called “engagement rate.”
In GA4, you can find your site’s bounce rate engagement rate by navigating to Acquisition > User acquisition or Acquisition > Traffic acquisition.
Engagement rate fixes some of the pitfalls that plagued bounce rate as a metric. For one, it includes sessions where a visitor converted or spent at least 10 seconds on the page, even if they did not visit any other pages – two types of sessions that were not factored in previously.
As a result, you should see your bounce rate lower in GA4. Once you do a little bit of math, that is.
To calculate your new bounce rate, you simply subtract your engagement rate from 100%.

While bounce rate is an important metric, I’m happy to see Google made this change.
Instead of focusing on the negative, it encourages us to focus on the positive: How many people are engaged with your site.
Plus, it’s a more accurate and relevant metric now.
In GA4, engagement rate counts a visitor as “engaged” if they visited 2+ pages, spent at least 10 seconds on your site or converted.
Now, let’s get back to what you came here for: Why your bounce rate is high and what you can do about it.
Possible Explanations For A High Bounce Rate
Below are 12 common causes of a high bounce rate, followed by five ways you can fix it.
1. Slow-To-Load Page
Google has a renewed focus on site speed, especially as a part of the Core Web Vitals initiative.
A slow-to-load page can be a huge problem for bounce rates.
Site speed is part of Google’s ranking algorithm. It always has been.
Google wants to promote content that provides a positive experience for users, and they recognize that a slow site can provide a poor experience.
Users want the facts fast – this is part of the reason Google has put so much work into featured snippets.
If your page takes longer than a few seconds to load, your visitors may get fed up and leave.
Fixing site speed is a lifelong journey for most SEO and marketing pros.
But the upside is that with each incremental fix, you should see an incremental boost in speed.
Review your page speed (overall and for individual pages) using tools like:
- Google PageSpeed Insights.
- Google Search Console PageSpeed reports.
- Lighthouse reports.
- Pingdom.
- GTmetrix.
They’ll offer you recommendations specific to your site, such as compressing your images, reducing third-party scripts, and leveraging browser caching.
2. Self-Sufficient Content*
Sometimes your content is efficient enough that people can quickly get what they need and bounce!
This can be a wonderful thing.
Perhaps you’ve achieved the content marketer’s dream and created awesome content that wholly consumed them for a handful of minutes in their lives.
Or perhaps you have a landing page that only requires the user to complete a short lead form.
To determine whether bounce rate is nothing to worry about, you’ll want to look at the Time Spent on Page and Average Session Duration metrics in Google Analytics.
You can also conduct user experience testing and A/B testing to see if the high bounce rate is a problem.
If the user is spending a couple of minutes or more on the page, that sends a positive signal to Google that they found your page highly relevant to their search query.
If you want to rank for that particular search query, that kind of user intent is gold.
If the user is spending less than a minute on the page (which may be the case of a properly optimized landing page with a quick-hit CTA form), consider enticing the reader to read some of your related blog posts after filling out the form.
*This is an example where GA4’s engagement rate may be a superior metric to UA’s bounce rate. In GA4, this type of session would not count as a bounce and would instead count as “engaged.”
3. Disproportional Contribution By A Few Pages
If we expand on the example from the previous section, you may have a few pages on your site that are contributing disproportionally to the overall bounce rate for your site.
Google is savvy at recognizing the difference between these.
If your single CTA landing pages reasonably satisfy user intent and cause them to bounce quickly after taking an action, but your longer-form content pages have a lower bounce rate, you’re probably good to go.
However, you will want to dig in and confirm that this is the case or discover if some of these pages with a higher bounce rate shouldn’t be causing users to leave en masse.
Open up Google Analytics. Go to Behavior > Site Content > Landing Pages, and sort by Bounce Rate.
Consider adding an advanced filter to remove pages that might skew the results.
For example, it’s not necessarily helpful to agonize over the one Twitter share with five visits that have all your social UTM parameters tacked onto the end of the URL.
My rule of thumb is to determine a minimum threshold of volume that is significant for the page.
Choose what makes sense for your site, whether it’s 100 visits or 1,000 visits, and then click on Advanced and filter for Sessions greater than that.
In GA4, navigate to Acquisition > User acquisition or Acquisition > Traffic acquisition. From there, click on “Add filter +” underneath the report title.
Create a filter by selecting “Session default channel grouping” (or “Session medium” or “Session source / medium” etc.). Then check the box for “Organic Search” in the Dimension values menu.
Click the blue Apply button. Once you’re back in the report, click on the blue plus sign to open up a new menu.
Navigate to Page/screen and select Landing page.
4. Misleading Title Tag And/Or Meta Description
Ask yourself: Is the content of your page accurately summarized by your title tag and meta description?
If not, visitors may enter your site thinking your content is about one thing, only to find that it isn’t, and then bounce back to whence they came.
Whether it was an innocent mistake or you were trying to game the system by optimizing for keyword clickbait (shame on you!), this is, fortunately, simple enough to fix.
Either review the content of your page and adjust the title tag and meta description accordingly. Or, rewrite the content to address the search queries you want to attract visitors for.
You can also check what kind of meta description Google has auto-generated for your page for common searches – Google can change your meta description, and if they make it worse, you can take steps to remedy that.
5. Blank Page Or Technical Error
If your bounce rate is exceptionally high and you see that people are spending less than a few seconds on the page, it’s likely your page is blank, returning a 404, or otherwise not loading properly.
Take a look at the page from your audience’s most popular browser and device configurations (e.g., Safari on desktop and mobile, Chrome on mobile, etc.) to replicate their experience.
You can also check in Search Console under Coverage to discover the issue from Google’s perspective.
Correct the issue yourself or talk to someone who can – an issue like this can cause Google to drop your page from the search results in a hurry.
6. Bad Link From Another Website
You could be doing everything perfectly on your end to achieve a normal or low bounce rate from organic search results and still have a high bounce rate from your referral traffic.
The referring site could be sending you unqualified visitors, or the anchor text and context for the link could be misleading.
Sometimes this is a result of sloppy copywriting.
The writer or publisher linked to your site in the wrong part of the copy or didn’t mean to link to your site at all.
Reach out to the author of the article first. If they don’t respond or they can’t update the article after publishing, then you can escalate the issue to the site’s editor or webmaster.
Politely ask them to remove the link to your site – or update the context, whichever makes sense.
(Tip: You can easily find their contact information with this guide.)
Unfortunately, the referring website may be trying to sabotage you with some negative SEO tactics out of spite or just for fun.
For example, they may have linked to your “Guide To Adopting A Puppy” with the anchor text of FREE GET RICH QUICK SCHEME.
You should still reach out and politely ask them to remove the link, but if needed, you’ll want to update your disavow file in Search Console.
Disavowing the link won’t reduce your bounce rate, but it will tell Google not to take that site’s link into account when it comes to determining the quality and relevance of your site.
7. Affiliate Landing Page Or Single-Page Site*
If you’re an affiliate, the whole point of your page may be to deliberately send people away from your website to the merchant’s site.
In these instances, you’re doing the job right if the page has a higher bounce rate.
A similar scenario would be if you have a single-page website, such as a landing page for your ebook or a simple portfolio site.
It’s common for sites like these to have a very high bounce rate since there’s nowhere else to go.
Remember that Google can usually tell when a website is doing a good job satisfying user intent even if the user’s query is answered super quickly (sites like WhatIsMyScreenResolution.com come to mind).
If you’re interested, you can adjust your bounce rate so it makes more sense for the goals of your website.
For Single Page Apps (or SPAs), you can adjust your analytics settings to see different parts of a page as a different page, adjusting the bounce rate to better reflect the user experience.
*This is another example where GA4’s engagement rate may be a superior metric to UA’s bounce rate. If you’ve set it up so that a click on your affiliate link is considered a conversion event, this type of session would not count as a bounce and would instead count as “engaged.”
8. Low-Quality Or Underoptimized Content
Visitors may be bouncing from your website because your content is just plain bad.
Take a long, hard look at your page and have your most judgmental and honest colleague or friend review it.
(Ideally, this person either has a background in content marketing or copywriting, or they fall into your target audience).
One possibility is that your content is great, but you just haven’t optimized it for online reading – or for the audience that you’re targeting.
- Are you writing in simple sentences (think high school students versus PhDs)?
- Is it easily scannable with lots of header tags?
- Does it cleanly answer questions?
- Have you included images to break up the copy and make it easy on the eyes?
Writing for the web is different than writing for offline publications.
Brush up your online copywriting skills to increase the time people spend reading your content.
The other possibility is that your content is poorly written overall or simply isn’t something your audience cares about.
Consider hiring a freelance copywriter (like me!) or content strategist who can help you transform your ideas into powerful content that converts.
9. Bad Or Obnoxious UX
Are you bombarding people with ads, pop-up surveys, and email subscribe buttons?
CTA-heavy features like these may be irresistible to the marketing and sales team, but using too many of them can make a visitor run for the hills.
Google’s Core Web Vitals are all about user experience – not only are they ranking factors, but they impact your site visitors’ happiness, too.
Is your site confusing to navigate?
Perhaps your visitors are looking to explore more, but your blog is missing a search box, or the menu items are difficult to click on a smartphone.
As online marketers, we know our websites in and out.
It’s easy to forget that what seems intuitive to us is anything but to our audience.
Make sure you’re avoiding these common design mistakes, and have a web or UX designer review the site and let you know if anything pops out to them as problematic.
10. The Page Isn’t Mobile-Friendly
While SEOs know it’s important to have a mobile-friendly website, the practice isn’t always followed in the real world.
Google announced its switch to mobile-first indexing way back in 2017, but many websites today still wouldn’t be considered mobile-friendly.
Websites that haven’t been optimized for mobile don’t look good on mobile devices – and they don’t load too fast, either.
That’s a recipe for a high bounce rate.
Even if your website was implemented using responsive design principles, it’s still possible that the live page doesn’t read as mobile-friendly to the user.
Sometimes, when a page gets squeezed into a mobile format, it causes some of the key information to move below the fold.
Now, instead of seeing a headline that matches what they saw in search, mobile users only see your site’s navigation menu.
Assuming the page doesn’t offer what they need, they bounce back to Google.
If you see a page with a high bounce rate and no glaring issues immediately jump out to you, test it on your mobile phone.
You can also check for mobile issues in Google Search Console and Lighthouse.
11. Content Depth*
Google can give people quick answers through featured snippets and knowledge panels; you can give people deep, interesting, interconnected content that’s a step beyond that.
Make sure your content compels people to click to explore other pages on your site if it makes sense.
Provide interesting, relevant internal links, and give them a reason to stay.
And for the crowd that wants the quick answer, give them a TL;DR summary at the top.
*This is another example where GA4’s engagement rate may be a superior metric to UA’s bounce rate. If your content is deeply engrossing, people will keep reading after the 10-second mark, leading GA4 to count their session as “engaged” instead of a bounce.
12. Asking For Too Much
Don’t ask someone for their credit card number, social security, grandmother’s pension, and children’s names right off the bat (or ever, in some of those examples) – your user doesn’t trust you yet.
People are ready to be suspicious, considering how many scam websites are out there.
Being presented with a big pop-up asking for info will cause a lot of people to bounce immediately.
Your job is to build trust with your visitors.
Do so, and you’ll both be happier. Your visitor will feel like they can trust you, and you’ll have a lower bounce rate.
Either way, if it makes users happy, Google likes it.
Pro Tips For Reducing Your Bounce Rate
Regardless of the reason behind your high bounce rate, here’s a summary of best practices you can implement to bring it down.
Make Sure Your Content Lives Up To The Hype
Together, you can think of your title tag and meta description as your website’s virtual billboard on Google.
Whatever you’re advertising in the SERPs, your content needs to match.
Don’t call your page an “ultimate guide” if it’s a short post with three tips.
Don’t claim to be the “best” vacuum if your user reviews show a three-star rating.
You get the idea.
Also, make your content readable:
- Break up your text with lots of white space.
- Add supporting images.
- Use short sentences.
- Spellcheck is your friend.
- Use a good, clean design.
- Don’t bombard visitors with too many ads.
Keep Critical Elements Above The Fold
Sometimes, your content matches what you advertise in your title tag and meta description. It’s just that your visitors can’t tell at first glance.
When people arrive on a website, they make an immediate first impression.
You want that first impression to validate whatever they thought they were going to see when they arrived.
A prominent H1 should match the title they read on Google.
If it’s an ecommerce site, a photo should match the product description they saw on Google.
Also, make sure these elements aren’t obscured by pop-ups or advertisements.
Speed Up Your Site
When it comes to SEO, faster is always better.
Keeping up with site speed is a task that should remain firmly stuck at the top of your SEO to-do list.
There will always be new ways to compress, optimize, and otherwise accelerate load time. For now, make sure to:
- Compress all images before loading them to your site, and only use the maximum display size necessary.
- Review and remove any external or load-heavy scripts, stylesheets, and plugins. If there are any you don’t need, remove them. For the ones you do need, see if there’s a faster option.
- Tackle the basics: Use a CDN, minify JavaScript and CSS, and set up browser caching.
- Check Lighthouse for more suggestions.
Minimize Non-Essential Elements
Don’t bombard your visitors with pop-up ads, in-line promotions, and other content they don’t care about.
Visual overwhelm can cause visitors to bounce.
What CTA is the most important for the page?
Compellingly highlight that.
For everything else, delegate it to your sidebar or footer.
Edit, edit, edit!
Help People Get Where They Want To Be Faster
Want to encourage people to browse more of your site?
Make it easy for them.
- Leverage on-site search with predictive search, helpful filters, and an optimized “no results found” page.
- Rework your navigation menu and A/B test how complex vs. simple drop-down menus affect your bounce rate.
- Include a Table of Contents in your long-form articles with anchor links taking people straight to the section they want to read.
Conclusion
Remember: Bounce rates are just one metric.
A high bounce rate doesn’t mean the end of the world.
Some well-designed, effective webpages have high bounce rates – and that’s okay.
Bounce rates can be a measure of how well your site is performing, but it’s good to keep them in context.
Hopefully, this article helped you diagnose what’s causing your high bounce rate, and you have a good idea of how to fix it.
Not sure where to start?
Make your site useful, user-focused, and fast – good sites attract good users.
More Resources:
Featured Image: Cagkan Sayin/Shutterstock
SEO
The Lean Guide (With Template)

A competitive analysis (or market competitive analysis) is a process where you collect information about competitors to gain an edge over them and get more customers.
However, the problem is that “traditional” competitive analysis is overkill for most businesses — it requires impractical data and takes too long to complete (and it’s very expensive if you choose to outsource).
A solution to that is a lean approach to the process — and that’s what this guide is about.
In other words, we’ll focus on the most important data you need to answer the question: “Why would people choose them over you?”. No boring theory, outtakes from marketing history, or spending hours digging up nice-to-have information.
In this guide, you will find:
- A real-life competitive analysis example.
- Templates: one for input data and one for a slide deck to present your analysis to others.
- Step-by-step instructions.
Our template consists of two documents: a slide deck and a spreadsheet.
The Slide deck is the output document. It will help you present the analysis to your boss or your teammates.
The spreadsheet is the input document. You will find tables that act as the data source for the charts from the slide deck, as well as a prompt to use in ChatGPT to help you with user review research.


We didn’t focus on aesthetics here; every marketer likes to do slide decks their own way, so feel free to edit everything you’ll find there.
With that out of the way, let’s talk about the process. The template consists of these six tasks:
- Identify your direct competitors.
- Compare share of voice.
- Compare pricing and features.
- Find strong and weak points based on reviews.
- Compare purchasing convenience.
- Present conclusions.
Going forward, we’ll explain why these steps matter and show how to complete them.
Direct competitors are businesses that offer a similar solution to the same audience.
They matter a lot more than indirect competitors (i.e. businesses with different products but targeting the same audience as you) because you’ll be compared with them often (e.g. in product reviews and rankings). Plus, your audience is more likely to gravitate towards them when considering different options.
You probably have a few direct competitors in mind already, but here are a few ways to find others based on organic search and paid search ads.
Our basis for the analysis was Landingi, a SaaS for building landing pages (we chose that company randomly). So in our case, we found these 3 direct competitors.


Look at keyword overlap
Keyword overlap uncovers sites that target the same organic keywords as you. Some sites will compete with you for traffic but not for customers (e.g. G2 may share some keywords with Landingi but they’re a different business). However, in many cases, you will find direct competitors just by looking at this marketing channel.
- Go to Ahrefs’ Site Explorer and enter your site’s address.
- Scroll down to Organic competitors.
- Visit the URLs to pick 3 – 5 direct competitors.


To double-check the choice of competitors, we also looked at who was bidding for search ads on Google.
See who’s advertising
If someone is spending money to show ads for keywords related to what you do, that’s a strong indication they are a direct competitor.
- Go to Ahrefs’ Keywords Explorer.
- Type in a few broad keywords related to your niche, like “landing page builder” or “landing page tool”.
- Go to the Ads history report.
- Visit the sites that have a high presence of ads in the SERPs (Search Engine Result Pages).


Once you’re done checking both reports, write down competitors in the deck.
You can also take screenshots of the reports and add them to your deck to show the supporting data for your argument.


Share of voice is a measure of your reach in any given channel compared to competitors.
A bigger share of voice (SOV) means that your competitors are more likely to reach your audience. In other words, they may be promoting more effectively than you.
In our example, we found that Landingi’s SOV was the lowest in both of these channels.
Organic:


And social media:


Here’s how we got that data using Ahrefs and Brand24.
Organic share of voice
Before we start, make sure you have a project set up in Ahrefs’ Rank Tracker.


Now:
- Go to Ahrefs’ Competitive Analysis and enter your and your competitors’s sites as shown below.


- On the next screen, set the country with the most important market for your business and set the filters like this:


- Select keywords that sound most relevant to your business (even if you don’t rank for them yet) and Add them to Rank Tracker.


- Go to Rank Tracker, open your project, and look for Competitors/Overview. This report will uncover automatically calculated Share of Voice.


- Add the numbers in corresponding cells inside the sheet and paste the graph inside the slide deck.


It’s normal that the numbers don’t add up to 100%. SOV is calculated by including sites that compete with you in traffic but are not your direct competitors, e.g. blogs.
Social share of voice
We can also measure our share of voice across social media channels using Brand24.
- Go to Brand24.
- Start a New project for your brand and each competitor. Use the competitors’ brand name as the keyword to monitor.
- Go to the Comparison report and compare your project with competitors.


- Take a screenshot of the SOV charts and paste them into the slide deck. Make sure the charts are set to “social media”.


Consumers often choose solutions that offer the best value for money — simple as that. And that typically comes down to two things:
- Whether you have the features they care about. We’ll use all features available across all plans to see how likely the product is to satisfy user needs.
- How much they will need to pay. Thing is, the topic of pricing is tricky: a) when assessing affordability, people often focus on the least expensive option available and use it as a benchmark, b) businesses in the SaaS niche offer custom plans. So to make things more practical, we’ll compare the cheapest plans, but feel free to run this analysis across all pricing tiers.
After comparing our example company to competitors, we found that it goes head-to-head with Unbounce as the most feature-rich solution on the market.


Here’s how we got that data.
- Note down your and your competitors’ product features. One of the best places to get this information is pricing pages. Some brands even publish their own competitor comparisons — you may find them helpful too.
- While making the list, place a “1” in the cell corresponding to the brand that offers the solution.


- Enter the price of the cheapest plan (excluding free plans).


- Once finished, copy the chart and paste it inside the deck.
User reviews can show incredibly valuable insight into your competitors’ strong and weak points. Here’s why this matters:
- Improving on what your competitors’ customers appreciate could help you attract similar customers and possibly win some over.
- Dissatisfaction with competitors is a huge opportunity. Some businesses are built solely to fix what other companies can’t fix.
Here’s a sample from our analysis:


And here’s how we collated the data using ChatGPT. Important: repeat the process for each competitor.
- Open ChatGPT and enter the prompt from the template.


- Go to G2, Capterra, or Trustpilot and find a competitor’s reviews with ratings from 2 – 4 (i.e. one rating above the lowest and one below the highest possible). Reason:
businesses sometimes solicit five-star reviews, whereas dissatisfied customers tend to leave one-star reviews in a moment of frustration. The most actionable feedback usually comes in between.
- Copy and paste the content of the reviews into ChatGPT (don’t hit enter yet).
- Once you’re done pasting all reviews, hit enter in ChatGPT to run the analysis.


- Paste the graphs into the deck. If you want the graphs to look different, don’t hesitate to ask the AI.
There’s a faster alternative, but it’s a bit more advanced.
Instead of copy-pasting, you can use a scraping tool like this one to get all reviews at once. The downside here is that not all review sources will a have scraping tool available.
Lastly, we’ll see how easy it is to actually buy your products, and compare the experience to your competitors.
This is a chance to simplify your checkout process, and even learn from any good habits your competitors have adopted.
For example, we found that our sample company had probably nothing to worry about in this area — they ticked almost all of the boxes.


Here’s how to complete this step:
- Place a “1” if you or any of your competitors offer convenience features listed in the template.
- Once done, copy the chart and paste it into the deck.
This is the part of the presentation where you sum up all of your findings and suggest a course of action.
Here are two examples:
- Landingi had the lowest SOV in the niche, and that is never good. So the conclusion might be to go a level deeper and do an SEO competitive analysis, and to increase social media presence by creating more share-worthy content like industry surveys, design/CRO tips, or in-house data studies.
- Although the brand had a very high purchasing convenience score, during the analysis we found that there was a $850 gap between the monthly full plan and the previous tier. The conclusion here might be to offer a custom plan (like competitors do) to fill that gap.
We encourage you to take your time here and think about what would make the most sense for your business.
Tip
It’s good to be specific in your conclusions, but don’t go too deep. Competitive analysis concerns many aspects of the business, so it’s best to give other departments a chance to chime in. Just because your competitors have a few unique features doesn’t necessarily mean you need to build them too.
Final thoughts
A competitive analysis is one of the most fruitful exercises in marketing. It can show you areas for improvement, give ideas for new features, and help you discover gaps in your strategy. It wouldn’t be an exaggeration to say that it’s fundamental to running a successful business.
Just don’t forget to balance “spying” on your competitors with innovation. After all, you probably don’t want to become an exact copy of someone else’s brand.
In other words, use competitive analysis to keep up with your competitors, but don’t let that erase what’s unique about your brand or make you forget your big vision.
Got comments or questions? Ping me on X.
SEO
Critical WordPress Form Plugin Vulnerability Affects Up To +200,000 Installs

Security researchers at Wordfence detailed a critical security flaw in the MW WP Form plugin, affecting versions 5.0.1 and earlier. The vulnerability allows unauthenticated threat actors to exploit the plugin by uploading arbitrary files, including potentially malicious PHP backdoors, with the ability to execute these files on the server.
MW WP Form Plugin
The MW WP Form plugin helps to simplify form creation on WordPress websites using a shortcode builder.
It makes it easy for users to create and customize forms with various fields and options.
The plugin has many features, including one that allows file uploads using the [mwform_file name=”file”] shortcode for the purpose of data collection. It is this specific feature that is exploitable in this vulnerability.
Unauthenticated Arbitrary File Upload Vulnerability
An Unauthenticated Arbitrary File Upload Vulnerability is a security issue that allows hackers to upload potentially harmful files to a website. Unauthenticated means that the attacker does not need to be registered with the website or need any kind of permission level that comes with a user permission level.
These kinds of vulnerabilities can lead to remote code execution, where the uploaded files are executed on the server, with the potential to allow the attackers to exploit the website and site visitors.
The Wordfence advisory noted that the plugin has a check for unexpected filetypes but that it doesn’t function as it should.
According to the security researchers:
“Unfortunately, although the file type check function works perfectly and returns false for dangerous file types, it throws a runtime exception in the try block if a disallowed file type is uploaded, which will be caught and handled by the catch block.
…even if the dangerous file type is checked and detected, it is only logged, while the function continues to run and the file is uploaded.
This means that attackers could upload arbitrary PHP files and then access those files to trigger their execution on the server, achieving remote code execution.”
There Are Conditions For A Successful Attack
The severity of this threat depends on the requirement that the “Saving inquiry data in database” option in the form settings is required to be enabled in order for this security gap to be exploited.
The security advisory notes that the vulnerability is rated critical with a score of 9.8 out of 10.
Actions To Take
Wordfence strongly advises users of the MW WP Form plugin to update their versions of the plugin.
The vulnerability is patched in the lutes version of the plugin, version 5.0.2.
The severity of the threat is particularly critical for users who have enabled the “Saving inquiry data in database” option in the form settings and that is compounded by the fact that no permission levels are needed to execute this attack.
Read the Wordfence advisory:
Featured Image by Shutterstock/Alexander_P
SEO
How SEOs Make the Web Better

SEOs catch flak for ruining the web, but they play a crucial role in the search ecosystem, and actually make the internet better for everyone.
Let’s get the criticism out of the way. There are bad actors in SEO, people who seek to extract money from the internet regardless of the cost to others. There are still scams and snake oil, posers and plagiarists. Many parts of the web have become extremely commercialized, with paid advertising and big brands displacing organic and user-generated content.
But while there are situations where SEOs have made things worse, to fixate on them is to ignore the colossal elephant in the room: in the ways that really matter, the web is the best it’s ever been:
- It’s the easiest it has ever been to find information on the internet. Searchers have a staggering array of tutorials, teardowns, and tips at their fingertips, containing information that is generally accurate and helpful—and this was not always the case.
- Bad actors have a smaller influence over search. Search is less of a Wild West than it used to be. Once-scam-ridden topics are subject to significant scrutiny, and the problems and loopholes in search that need fixing today—like big brands and generic content receiving undue prominence—are smaller and less painful than the problems of the past.
- More people use search to their benefit. Online content is the most accessible it has ever been, and it’s easier than ever to grow a local business or expand into international markets on the back of search.
SEOs have played a crucial role in these improvements, poking and prodding, building and—sometimes—breaking. They are Google power users: the people who push the system to extremes, but in doing so, catalyze the change needed to make search better for everyone.
Let’s explore how.
SEOs are much-needed intermediaries between Google and the rest of the world, helping non-technical people acquire and benefit from search engine traffic.
There is a huge amount of valuable information locked up in the heads of people who have no idea how to build a website or index a blog post. A carpet fitter with a bricks-and-mortar business might have decades of experience solving costly problems with uneven subfloors or poor moisture management, but no understanding of how to share that information online.
SEOs provide little nudges towards topics that people care about and writing that’s accessible to people and robots. They help solve technical problems that would hinder or completely block a site from appearing in search results. They identify opportunities for companies to be rewarded for creating great content.
It’s a win-win: businesses are rewarded with traffic, searchers have their intent satisfied, and the world is made a little richer for the newfound knowledge it contains.
SEOs do many things to actively make the web a better place, tending to their own plot of the Google garden to make sure it flourishes.
Take, for example, the myriad standards and guidelines designed to make the web a more accessible place for users. The implementation of these standards—turning theoretical guidelines into real, concrete parts of the web—often happens because of the SEO team.
Technical SEOs play a big part in adhering to the Web Content Accessibility Guidelines, a set of principles designed to ensure online content is “perceivable, operable, understandable, and robust” for every user. Every SEO’s fixation with Core Web Vitals fuels a faster, more efficient web. Content teams translate Google’s helpful content guidelines into useful words and images on a page.
(Case in point: check out Aleyda Solis’ Content Helpfulness Analyzer.)


There is a lot of overlap between “things that help users” and “things that improve search performance.” Even if the motive behind these changes is as simple as generating more traffic, a well-optimized website is, generally speaking, one that is also great for real human beings trying to engage with it.
The biggest criticism leveled at SEOs is that they break things. And they do! But that breakage acts as a type of pressure testing that strengthens the system as a whole.
Abuse of spintax and keyword stuffing forced Google to develop a better understanding of on-page content. Today, that loophole is closed, but more importantly, Google is much better at understanding the contents of a page and its relationship to a website as a whole.
Hacks like hiding keywords with white text on a white background (or moving them beyond the visible bounds of the screen) forced Google to expand its understanding of page styling and CSS, and how on-page information interacts with the environment that contains it.
Even today’s deluge of borderline-plagiarised AI content is not without benefit: it creates a very clear incentive for Google to get better at rewarding information gain and prioritizing publishers with solid EEAT credentials. These improvements will make tomorrow’s version of search much better.
This isn’t just Google fixing what SEOs broke: these changes usually leave lasting benefits that extend beyond any single spam tactic and make search better for all of its users.


This is not to argue that blackhat SEO is desirable. It would be better to make these improvements without incurring pain along the way. But Search is huge and complicated, and Google has little incentive to spend money proactively fixing problems and loopholes.
If we can’t solve every issue before it causes pain, we should be grateful for a correction mechanism that prevents it—and more extreme abuse—from happening in the future. SEOs break the system, and in doing so, make future breakages a lot less severe.
Some SEOs take advantage of the loopholes they discover—but many don’t. They choose to raise these issues in public spaces, encourage discussion, and seek out a fix, acting like a proxy quality assurance team.
At the small end of the spectrum, SEOs often flag bugs with Google systems, like a recent error in Search Console reporting flagged independently by three separate people, or Tom Anthony famously catching an oversight in Google’s Manual Actions database. While these types of problems don’t always impact the average user’s experience using Google, they help keep search systems working as intended.
At the other end of the scale, this feedback can extend as far as the overarching quality of the search experience, like AJ Kohn writing about Google’s propensity to reward big brands over small brands, or Lily Ray calling out an uptick in spam content in Google Discover.
SEOs are Google’s most passionate users. They interact with it at a scale far beyond the average user, and they can identify trends and changes at a macroscopic level. As a result, they are usually the first to discover problems—but also the people who hold Google to the highest standard. They are a crucial part of the feedback loop that fuels improvements.
Lastly, SEOs act as a check-and-balance, gathering firsthand evidence of how search systems operate, letting us differentiate between useful advice, snake oil, and Google’s PR bluster.
Google shares lots of useful guidance, but it’s important to recognize the limits of their advice. They are a profit-seeking company, and Search requires opacity to work—if everyone understood how it worked, everyone would game it, and it would stop working. Mixed in with the good advice is a healthy portion of omission and misdirection.
Google Search plays a vital role in controlling the flow of the web’s information—it is simply too important for us to leave its mechanics, biases, and imperfections unexplored. We need people who can interrogate the systems just enough to separate fact from fiction and understand how the pieces fit together.
We need people like Mic King, and his insanely detailed write-up of SGE and RAG; Britney Muller and her demystification of LLMs; the late Bill Slawki’s unfaltering patent analysis; or our own Patrick Stox’s efforts in piecing together how search works.


Final thoughts
The web has problems. We can and should expect more from Google Search. But the problems we need to solve today are far less severe and painful than the problems that needed solving in the past; and the people who have the highest expectations, and will be most vocal in shaping that positive future, are—you guessed it—SEOs.
To SEOs: the cause of (and solution to) all of the web’s problems.
-
SOCIAL6 days ago
Musk regrets controversial post but won’t bow to advertiser ‘blackmail’
-
SEO7 days ago
SEO Salary Survey 2023 [Industry Research]
-
MARKETING7 days ago
Revolutionizing Auto Retail: The Game-Changing Partnership Between Amazon and Hyundai
-
SEO6 days ago
A Year Of AI Developments From OpenAI
-
PPC6 days ago
5 Quick Tips to Increase Referral Traffic
-
SEO4 days ago
GPT Store Set To Launch In 2024 After ‘Unexpected’ Delays
-
SEARCHENGINES4 days ago
Google Core Update Done Followed By Intense Search Volatility, New Structured Data, Google Ads Head Steps Down & 20 Years Covering Search
-
SOCIAL5 days ago
Is this X’s (formerly Twitter) final goodbye to big advertisers? It looks like it
You must be logged in to post a comment Login