Connect with us


How to Implement an International SEO Strategy (Step-by-Step Guide)



How to Implement an International SEO Strategy (Step-by-Step Guide)

International SEO is the process of optimizing your website for users across multiple countries or languages. It’s crucial if you want to reach an international audience through organic search.

But creating an international SEO strategy can be daunting—even for professional SEOs.

In this guide, I’ll break down the process and walk you through it step by step.

Step 1. Know your markets

Many of you will know which markets you intend to target. This is often determined by non-SEO factors such as the ability to operate in specific markets.

Despite this, it’s worth understanding which markets hold the strongest potential for your business. Your business may:

  • Naturally decide to serve this market in future.
  • Be missing out on a market with huge search demand.
  • Be missing out on a market with low search competition.

You can get a rough idea of the markets with search potential by entering competitors into Ahrefs’ Site Explorer. Just check the graph that shows traffic share by country. 

Traffic share by country in Ahrefs' Site Explorer

You will, of course, need to dig deeper than this. But we’ll tackle that in the chapter on keyword research. For now, this should give you a good idea of potential markets.

Step 2. Understand the technical requirements

Before getting too carried away with detailed keyword research, you need to plan out your technical approach. Ensuring you have the right technical foundations is vital to every international SEO strategy.

Each market requires dedicated URLs

To target several markets effectively, each landing page requires a separate version of content sitting on dedicated URLs for each language. Having country-specific versions of the page is also recommended for a hyper-focused approach.

Dynamically translating copy that sits on the same URL is a no-go. Google recommends using dedicated URLs, as this allows its crawlers to efficiently discover, read, and index all versions of your content.

Deciding on the URL structure

There are several choices to consider when deciding on the URL structure. All viable options have pros and cons.



This option is very popular, most notably because users are familiar with the top-level domain of their country. This contributes to users having that feeling of being in the right place when they land on the page.

On the other hand, you’ll need to consider the cost of purchasing several domains. In the opinion of many SEOs, you’ll also be diluting your PageRank by splitting content across several domains. This is because you’ll need to build up SEO authority across multiple domains as opposed to a single, stronger domain.


  • Target country is clear to users
  • Ability to use localized hosting for enhanced page load times


  • Usually more costly, as you’ll need to purchase several domains
  • Maintaining several domains can be technically challenging
  • URL doesn’t specify the language (e.g., .ca could be for English or French speakers)



Subfolders are not only very popular among SEOs but also webmasters. This is because all of the content sits within a single domain.

It’s also much easier to create a new version of a page by simply changing the URL path (or slug) compared to rolling out a new page on a completely different hosting setup. Reporting is easier too, as you’ll only need to install your analytics tag on a single domain.


  • Relatively straightforward to set up
  • Customizable naming (e.g.,
  • Easier to track and report


  • Users may not be as familiar with URL structure



Subdomains are less popular but do have some unique benefits. The ability to use customizable naming conventions is a notable one. This is not achievable with ccTLDs.

The cons, however, are closely aligned with those of the ccTLD. Despite subdomains effectively being an extension of your main domain, Google will have to learn how to crawl these separately at first.


  • Ability to use localized hosting
  • Customizable naming (e.g.,


  • Maintaining several domains can be technically challenging
  • Users may not be as familiar with URL structure

Parameterized URL

Parameterized URLs

This option should be avoided at all costs. Parameterized URLs are not user-friendly and can confuse bots too.

This option is not recommended by Google for internationalization.

For these reasons, let’s take the parameterized URL option completely out of the equation.

Jamie’s Verdict

In my opinion, the cons of the subdomain option far outweigh the advantages. So for me, it is a straight shoot-out between ccTLDs and subfolders.

When starting from scratch, I personally prefer the subfolder option. For me, the benefits of hosting all content under the same domain should not be overlooked.

That said, it’s OK to prefer a different route, as many SEOs do. You won’t be penalized, as all three options are supported by Google. 

Consider creating multiple languages per country

If you are serving countries where the users’ first language can be one of several, you may need to consider providing content in multiple languages per country.

For example, say you are looking to serve all potential customers in Canada. You’ll need to target both English- and French-speaking users. As a result, you’ll need to roll out a French-Canadian version as well as an English-Canadian version.

Can I just create language-specific versions?

It’s perfectly within Google’s guidelines to only target users by language. For some types of content, you may even get away with this approach. I recommend searching your top keywords to see how the best ranking results approach this.

Taking on a language-first approach may be the perfect starting point for your business, particularly if you are tight on resources. You’ll be working with fewer pages, which also results in less of a chance of things breaking.

That said, most businesses have specific countries in mind. Rolling out country-specific content is the most optimal approach. This allows you to focus your content around the country that you intend to target. 

For starters, you’ll want to serve your products or services in the right currency. Furthermore, you can tweak the terminology used, as this varies from country to country (even when the language remains the same).

Why you should create separate pages for each target market

These nuances not only matter for users but are also something that Google could pick up too. After all, it’s Google’s job to serve the most relevant result for each user.

Install a Content Delivery Network

Now that you are serving users in multiple countries, there’s never been a more crucial time to implement a Content Delivery Network (CDN). In the era of Core Web Vitals being a ranking factor, users having a slow experience when loading your site from abroad can impact your rankings.

CDNs utilize a group of distributed servers, ensuring your users load the page from a localized server as opposed to a single, centralized server. This helps to keep page load times down, resulting in a more satisfying user experience.

How a CDN works

Step 3. Conduct keyword research for your chosen markets

Now that we have the plans in place for the technical foundations, the next step is to carry out keyword research in each of our chosen markets. This is recommended, even if you decide to only roll out your international strategy in a single language.

Earlier on, I mentioned that terminology varies from country to country, even if the language remains the same. This, in turn, will have an impact on the keywords your potential customers are searching for.

Search volume will also differ from country to country, as population and search demand vary. This is something we’ll need to take into consideration when making projections based on keyword data.

For example, using Ahrefs’ Keywords Explorer, we can see that the U.K. holds the highest search volume for the term “home insurance” with 67K monthly searches.

Estimated search volume for "home insurance" in the U.K.

These keywords will also impact on-page optimization, which I’ll talk about more in step #4.

What if I need keyword research in a foreign language?

Having worked agency-side in SEO for several years, I have often found myself in such a situation. Utilizing SEO specialists who are native speakers always results in the best end product. If you’ve yet to onboard in-house native specialists, I highly recommend leaning on your network and scouting through LinkedIn to find the right specialist for you.

This often ends up as the most cost-effective solution too. Using native specialists will save you from spending lots of time trying to work out what those keywords in your list even mean.

How about using auto-translation tools?

I’d avoid directly translating keywords from your native language into a foreign language. Often, translation tools do not take nuance into consideration. This will leave you with a list of keywords that your customers may not even be searching for (or even make any sense for that matter).

Don’t have the budget to hire a local SEO?

If you don’t have the budget to hire a local specialist to produce keyword research, translation tools will come in handy. As previously mentioned, translation tools aren’t always that accurate. So in this instance, they should only be used as a guide to help get you started.

Here’s an example. Let’s assume my business provides home insurance in the U.K. and is considering the potential of serving customers in Spain.

Using Google Translate to convert my top English keywords into Spanish, I now paste these translations into Ahrefs’ Keywords Explorer.

Checking Spanish keywords in Ahrefs' Keywords Explorer

Jackpot! Despite the tool only returning a couple of keywords, one of them— “seguro de hogar”—has over 6,100 monthly searches in Spain.

Estimated search volume in Spain for "seguro de hogar"

Reminder: Be cautious when using auto-translate tools. My starting keyword of “seguro de hogar” works a treat in mainland Spain. However, it is not as common in the Spanish-speaking countries of Latin America.

Clicking on this keyword, I see that Keywords Explorer now provides me with the best starting point for my keyword research in Spanish. We now have a range of related keywords that I can use to expand my list.

Keyword ideas from "seguro de hogar"

Scrolling down, I can also see the top-ranking URLs for this keyword. These will come in handy, as I can now plug these URLs into Ahrefs’ Site Explorer to see what keywords my potential competitors are ranking for.

SERP overview for "seguro de hogar"

Step 4. Localize copy and the optimization of each landing page

Involving a native expert at this stage is imperative. You may be able to get away with saving some budget by conducting the keyword research yourself. When it comes to creating the content, however, there are no tricks to keep up your sleeve.

With local nuance and terminology varying quite considerably, the user on the other end is likely to notice if you’ve cut any corners with the content production. Not understanding local terminology could be costly.

This is not only important for user experience but also for Google too. It’s Google’s job to serve users with the pages that offer the best experience to them. Therefore, Google will prefer to serve content that is relevant to both the country and language of the user.

Anything that can be localized should be localized. In addition to on-page copy and metadata, this can also include:

  • Currencies
  • Time zones
  • Phone numbers (where possible)
  • Office address (where possible)

Step 5. Get your internal linking right

One of the easiest mistakes to make when rolling out content internationally is internally linking to the wrong version. Not only can this lead to your users landing on the wrong version, but it may also send conflicting signals to Google.

Always internally link to the correct market

What if I only have a limited number of pages to link to for a specific market?

If you are asking yourself this question, it may be too soon to launch in this market. Launching into a brand-new market with only a small number of pages will limit your path to results. 

Launching with a wider range of content will better help Google associate your website and brand with the market you intend to launch within. As a general rule, I’d recommend ensuring you have enough content to link to via your header and footer navigation when launching.

Include a navigation menu to switch between market versions

Even with the most effective geo-targeting in place, there may be the odd instance where a user lands on the wrong version. Providing dedicated navigation to switch back to the right version could be the difference between losing and gaining a potential customer.

Via the header of the Ahrefs website, for example, you can easily switch the language.

Language selector on

Step 6. Help Google serve the right version

Even with the on-page signals that Google picks up through our content, it can still be confusing for Google to understand which pages to serve for a specific market.

Implementing hreflang is essential

Hreflang is a piece of code that usually sits in the backend of a page (or sometimes via sitemaps). It’s essentially a mapping process, providing Google with a list of the alternative URLs for a specific page.

This helps Google to understand:

  • Which market the current page intends to target.
  • Alternative options for users in other markets.
  • A version to serve by default for users searching from markets without a dedicated page (optional).

Implementing hreflang will not only enhance user experience but also let your rankings benefit from close duplicates (in particular, the versions that use the same language).

While PageRank isn’t passed through the hreflang, Google will use the most authoritative version in the searched language to determine the ranking position. When a user then conducts the search, Google will serve the most relevant version for that user.

There’s no doubt that hreflang can quickly become one of the most complex areas of SEO. No need to fear—our Joshua Hardwick has compiled a dedicated beginner’s guide to hreflang

Ahrefs’ Site Audit is the perfect place to review your hreflang implementation. First, you’ll need to run an audit on your website.

Once your audit is complete, head to the Localization report to uncover any errors.

Hreflang issues in Ahrefs' Site Audit

Avoid geo-redirection

Redirecting users based on their IP address or by cookies should be completely avoided. This will not only frustrate users but also cause further confusion for bots. 

Google will more frequently crawl content via a U.S. IP address. Therefore, you may be redirecting Google away from any non-U.S. content. Bypassing the redirect for the Googlebot user agent is also not advised. It’s important to ensure Googlebot has the exact same experience as your users.

Don’t just take it from me. Google advises against this too:

These redirections could prevent users (and search engines) from viewing all the versions of your site.

The documentation expands on this further by saying:

Don’t use IP analysis to adapt your content. IP location analysis is difficult and generally not reliable. Furthermore, Google may not be able to crawl variations of your site properly. Most, but not all, Google crawls originate from the US, and we don’t attempt to vary the location to detect site variations.

As an alternative solution to IP redirection, you may wish to prompt a user, who appears to be in the wrong location, to review their version of the site via navigation. Here’s how Apple implemented its prompt.

Apple's solution to geo-targeting

Step 7. Build your backlink profile within each of your targeted countries

Regardless of whether you have a strong presence in your home market, you’ll also need to build authority in the new markets that you wish to roll out within. 

A backlink from a highly authoritative site in the U.S. may not hold the same weight in Mexico, for example.

Quite often, this step is overlooked. Despite appearing last in this guide, it should not be written off. 

It’s quite common for webmasters to follow the previous steps correctly, only to overlook this last step and end up with traffic that correlates with their lack of localized links. 

So don’t forget to build your backlink profile and digital presence within all markets targeted, not just your home market.

Key takeaways

  • Use the URL structure that fits your needs best (avoiding URL parameters at all costs)
  • Localize your strategy as much as you can, from keyword research to content optimization
  • Utilize hreflang to send clear signals to Google
  • Site speed matters for users in all countries; installing a CDN is a must
  • Continue to grow the quality of your backlink profile in all markets

Have any questions? Which URL structure do you prefer? Ping me on Twitter and let me know.

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address


The Lean Guide (With Template)



The Lean Guide (With Template)

A competitive analysis (or market competitive analysis) is a process where you collect information about competitors to gain an edge over them and get more customers.

However, the problem is that “traditional” competitive analysis is overkill for most businesses — it requires impractical data and takes too long to complete (and it’s very expensive if you choose to outsource). 

A solution to that is a lean approach to the process — and that’s what this guide is about. 

In other words, we’ll focus on the most important data you need to answer the question: “Why would people choose them over you?”. No boring theory, outtakes from marketing history, or spending hours digging up nice-to-have information.

In this guide, you will find:

  • A real-life competitive analysis example.
  • Templates: one for input data and one for a slide deck to present your analysis to others.
  • Step-by-step instructions.

Our template consists of two documents: a slide deck and a spreadsheet. 

The Slide deck is the output document. It will help you present the analysis to your boss or your teammates.

The spreadsheet is the input document. You will find tables that act as the data source for the charts from the slide deck, as well as a prompt to use in ChatGPT to help you with user review research.

Competitive analysis template — spreadsheet sneak peek.Competitive analysis template — spreadsheet sneak peek.

We didn’t focus on aesthetics here; every marketer likes to do slide decks their own way, so feel free to edit everything you’ll find there. 

With that out of the way, let’s talk about the process. The template consists of these six tasks: 

  1. Identify your direct competitors. 
  2. Compare share of voice. 
  3. Compare pricing and features.
  4. Find strong and weak points based on reviews.
  5. Compare purchasing convenience.
  6. Present conclusions.

Going forward, we’ll explain why these steps matter and show how to complete them. 

1. Identify your direct competitors

Direct competitors are businesses that offer a similar solution to the same audience. 

They matter a lot more than indirect competitors (i.e. businesses with different products but targeting the same audience as you) because you’ll be compared with them often (e.g. in product reviews and rankings). Plus, your audience is more likely to gravitate towards them when considering different options. 

You probably have a few direct competitors in mind already, but here are a few ways to find others based on organic search and paid search ads

Our basis for the analysis was Landingi, a SaaS for building landing pages (we chose that company randomly). So in our case, we found these 3 direct competitors. 

Slide 1 — direct competitors.Slide 1 — direct competitors.

Look at keyword overlap

Keyword overlap uncovers sites that target the same organic keywords as you. Some sites will compete with you for traffic but not for customers (e.g. G2 may share some keywords with Landingi but they’re a different business). However, in many cases, you will find direct competitors just by looking at this marketing channel. 

  • Go to Ahrefs’ Site Explorer and enter your site’s address. 
  • Scroll down to Organic competitors
  • Visit the URLs to pick 3 – 5 direct competitors.
Top organic competitors data from Ahrefs.Top organic competitors data from Ahrefs.

To double-check the choice of competitors, we also looked at who was bidding for search ads on Google.

See who’s advertising 

If someone is spending money to show ads for keywords related to what you do, that’s a strong indication they are a direct competitor. 

  • Go to Ahrefs’ Keywords Explorer.
  • Type in a few broad keywords related to your niche, like “landing page builder” or “landing page tool”. 
  • Go to the Ads history report. 
  • Visit the sites that have a high presence of ads in the SERPs (Search Engine Result Pages). 
Ads history report in Ahrefs' Keywords Explorer.Ads history report in Ahrefs' Keywords Explorer.

Once you’re done checking both reports, write down competitors in the deck. 

You can also take screenshots of the reports and add them to your deck to show the supporting data for your argument. 

 Slide 2 — direct competitors by organic traffic. Slide 2 — direct competitors by organic traffic.

2. Compare share of voice

Share of voice is a measure of your reach in any given channel compared to competitors. 

A bigger share of voice (SOV) means that your competitors are more likely to reach your audience. In other words, they may be promoting more effectively than you. 

In our example, we found that Landingi’s SOV was the lowest in both of these channels. 


Slide 3 — share of voice on Google Search.Slide 3 — share of voice on Google Search.

And social media:

 Slide 4 — share of voice on social media. Slide 4 — share of voice on social media.

Here’s how we got that data using Ahrefs and Brand24.

Organic share of voice 

Before we start, make sure you have a project set up in Ahrefs’ Rank Tracker

Create a new project in Ahrefs' Rank Tracker.Create a new project in Ahrefs' Rank Tracker.


  • Go to Ahrefs’ Competitive Analysis and enter your and your competitors’s sites as shown below. 
Create a new project in Ahrefs' Rank Tracker.
Create a new project in Ahrefs' Rank Tracker.
  • On the next screen, set the country with the most important market for your business and set the filters like this:
Content gap analysis filter setup.Content gap analysis filter setup.
  • Select keywords that sound most relevant to your business (even if you don’t rank for them yet) and Add them to Rank Tracker
Common keywords found via Ahrefs' Competitive Analysis.Common keywords found via Ahrefs' Competitive Analysis.
  • Go to Rank Tracker, open your project, and look for Competitors/Overview. This report will uncover automatically calculated Share of Voice
Organic share of voice data in Ahrefs.Organic share of voice data in Ahrefs.
  • Add the numbers in corresponding cells inside the sheet and paste the graph inside the slide deck. 
Filling the share of voice template with data.Filling the share of voice template with data.

It’s normal that the numbers don’t add up to 100%. SOV is calculated by including sites that compete with you in traffic but are not your direct competitors, e.g. blogs. 

Social share of voice 

We can also measure our share of voice across social media channels using Brand24.

  • Go to Brand24.
  • Start a New project for your brand and each competitor. Use the competitors’ brand name as the keyword to monitor. 
  • Go to the Comparison report and compare your project with competitors. 
Using Brand24's Comparison tool for competitive analysis.Using Brand24's Comparison tool for competitive analysis.
  • Take a screenshot of the SOV charts and paste them into the slide deck. Make sure the charts are set to “social media”.
Social media tab in share of voice report.Social media tab in share of voice report.

3. Compare pricing and features

Consumers often choose solutions that offer the best value for money — simple as that. And that typically comes down to two things: 

  • Whether you have the features they care about. We’ll use all features available across all plans to see how likely the product is to satisfy user needs.
  • How much they will need to pay. Thing is, the topic of pricing is tricky: a) when assessing affordability, people often focus on the least expensive option available and use it as a benchmark, b) businesses in the SaaS niche offer custom plans. So to make things more practical, we’ll compare the cheapest plans, but feel free to run this analysis across all pricing tiers.

After comparing our example company to competitors, we found that it goes head-to-head with Unbounce as the most feature-rich solution on the market. 

Slide 5 — features vs. pricing.Slide 5 — features vs. pricing.

Here’s how we got that data. 

  • Note down your and your competitors’ product features. One of the best places to get this information is pricing pages. Some brands even publish their own competitor comparisons — you may find them helpful too. 
  • While making the list, place a “1” in the cell corresponding to the brand that offers the solution.
Filling data in the spreadsheet.Filling data in the spreadsheet.
  • Enter the price of the cheapest plan (excluding free plans). 
Adding pricing data inside the spreadsheet.Adding pricing data inside the spreadsheet.
  • Once finished, copy the chart and paste it inside the deck. 

4. Find strong and weak points based on user reviews

User reviews can show incredibly valuable insight into your competitors’ strong and weak points. Here’s why this matters:

  • Improving on what your competitors’ customers appreciate could help you attract similar customers and possibly win some over.
  • Dissatisfaction with competitors is a huge opportunity. Some businesses are built solely to fix what other companies can’t fix. 

Here’s a sample from our analysis: 

 Slide 6 — likes and dislikes about Competitors. Slide 6 — likes and dislikes about Competitors.

And here’s how we collated the data using ChatGPT. Important: repeat the process for each competitor.

  • Open ChatGPT and enter the prompt from the template.
ChatGPT prompt for competitive analysis.ChatGPT prompt for competitive analysis.
  • Go to G2, Capterra, or Trustpilot and find a competitor’s reviews with ratings from 2 – 4 (i.e. one rating above the lowest and one below the highest possible). Reason:

businesses sometimes solicit five-star reviews, whereas dissatisfied customers tend to leave one-star reviews in a moment of frustration. The most actionable feedback usually comes in between.

  • Copy and paste the content of the reviews into ChatGPT (don’t hit enter yet). 
  • Once you’re done pasting all reviews, hit enter in ChatGPT to run the analysis.
Sample of ChatGPT output with charts.Sample of ChatGPT output with charts.
  • Paste the graphs into the deck. If you want the graphs to look different, don’t hesitate to ask the AI. 

There’s a faster alternative, but it’s a bit more advanced. 

Instead of copy-pasting, you can use a scraping tool like this one to get all reviews at once. The downside here is that not all review sources will a have scraping tool available. 

5. Compare purchasing convenience

Lastly, we’ll see how easy it is to actually buy your products, and compare the experience to your competitors. 

This is a chance to simplify your checkout process, and even learn from any good habits your competitors have adopted.

For example, we found that our sample company had probably nothing to worry about in this area — they ticked almost all of the boxes. 

Slide 7 — purchasing convenience.Slide 7 — purchasing convenience.

Here’s how to complete this step:

  • Place a “1” if you or any of your competitors offer convenience features listed in the template. 
  • Once done, copy the chart and paste it into the deck.

Step 6. Present conclusions

This is the part of the presentation where you sum up all of your findings and suggest a course of action. 

Here are two examples: 

  • Landingi had the lowest SOV in the niche, and that is never good. So the conclusion might be to go a level deeper and do an SEO competitive analysis, and to increase social media presence by creating more share-worthy content like industry surveys, design/CRO tips, or in-house data studies.
  • Although the brand had a very high purchasing convenience score, during the analysis we found that there was a $850 gap between the monthly full plan and the previous tier. The conclusion here might be to offer a custom plan (like competitors do) to fill that gap. 

We encourage you to take your time here and think about what would make the most sense for your business. 


It’s good to be specific in your conclusions, but don’t go too deep. Competitive analysis concerns many aspects of the business, so it’s best to give other departments a chance to chime in. Just because your competitors have a few unique features doesn’t necessarily mean you need to build them too.

Final thoughts 

A competitive analysis is one of the most fruitful exercises in marketing. It can show you areas for improvement, give ideas for new features, and help you discover gaps in your strategy. It wouldn’t be an exaggeration to say that it’s fundamental to running a successful business. 

Just don’t forget to balance “spying” on your competitors with innovation. After all, you probably don’t want to become an exact copy of someone else’s brand. 

In other words, use competitive analysis to keep up with your competitors, but don’t let that erase what’s unique about your brand or make you forget your big vision. 

Got comments or questions? Ping me on X

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading


Critical WordPress Form Plugin Vulnerability Affects Up To +200,000 Installs




Critical WordPress Form Plugin Vulnerability Affects Up To +200,000 Installs

Security researchers at Wordfence detailed a critical security flaw in the MW WP Form plugin, affecting versions 5.0.1 and earlier. The vulnerability allows unauthenticated threat actors to exploit the plugin by uploading arbitrary files, including potentially malicious PHP backdoors, with the ability to execute these files on the server.

MW WP Form Plugin

The MW WP Form plugin helps to simplify form creation on WordPress websites using a shortcode builder.

It makes it easy for users to create and customize forms with various fields and options.

The plugin has many features, including one that allows file uploads using the [mwform_file name=”file”] shortcode for the purpose of data collection. It is this specific feature that is exploitable in this vulnerability.

Unauthenticated Arbitrary File Upload Vulnerability

An Unauthenticated Arbitrary File Upload Vulnerability is a security issue that allows hackers to upload potentially harmful files to a website. Unauthenticated means that the attacker does not need to be registered with the website or need any kind of permission level that comes with a user permission level.

These kinds of vulnerabilities can lead to remote code execution, where the uploaded files are executed on the server, with the potential to allow the attackers to exploit the website and site visitors.

The Wordfence advisory noted that the plugin has a check for unexpected filetypes but that it doesn’t function as it should.

According to the security researchers:

“Unfortunately, although the file type check function works perfectly and returns false for dangerous file types, it throws a runtime exception in the try block if a disallowed file type is uploaded, which will be caught and handled by the catch block.

…even if the dangerous file type is checked and detected, it is only logged, while the function continues to run and the file is uploaded.

This means that attackers could upload arbitrary PHP files and then access those files to trigger their execution on the server, achieving remote code execution.”

There Are Conditions For A Successful Attack

The severity of this threat depends on the requirement that the “Saving inquiry data in database” option in the form settings is required to be enabled in order for this security gap to be exploited.

The security advisory notes that the vulnerability is rated critical with a score of 9.8 out of 10.

Actions To Take

Wordfence strongly advises users of the MW WP Form plugin to update their versions of the plugin.

The vulnerability is patched in the lutes version of the plugin, version 5.0.2.

The severity of the threat is particularly critical for users who have enabled the “Saving inquiry data in database” option in the form settings and that is compounded by the fact that no permission levels are needed to execute this attack.

Read the Wordfence advisory:

Update ASAP! Critical Unauthenticated Arbitrary File Upload in MW WP Form Allows Malicious Code Execution

Featured Image by Shutterstock/Alexander_P

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading


How SEOs Make the Web Better



How SEOs Make the Web Better

SEOs catch flak for ruining the web, but they play a crucial role in the search ecosystem, and actually make the internet better for everyone.

Let’s get the criticism out of the way. There are bad actors in SEO, people who seek to extract money from the internet regardless of the cost to others. There are still scams and snake oil, posers and plagiarists. Many parts of the web have become extremely commercialized, with paid advertising and big brands displacing organic and user-generated content.

But while there are situations where SEOs have made things worse, to fixate on them is to ignore the colossal elephant in the room: in the ways that really matter, the web is the best it’s ever been:

  • It’s the easiest it has ever been to find information on the internet. Searchers have a staggering array of tutorials, teardowns, and tips at their fingertips, containing information that is generally accurate and helpful—and this was not always the case.
  • Bad actors have a smaller influence over search. Search is less of a Wild West than it used to be. Once-scam-ridden topics are subject to significant scrutiny, and the problems and loopholes in search that need fixing today—like big brands and generic content receiving undue prominence—are smaller and less painful than the problems of the past.
  • More people use search to their benefit. Online content is the most accessible it has ever been, and it’s easier than ever to grow a local business or expand into international markets on the back of search.

SEOs have played a crucial role in these improvements, poking and prodding, building and—sometimes—breaking. They are Google power users: the people who push the system to extremes, but in doing so, catalyze the change needed to make search better for everyone.

Let’s explore how.

SEOs help regular people benefit from search

SEOs are much-needed intermediaries between Google and the rest of the world, helping non-technical people acquire and benefit from search engine traffic.

There is a huge amount of valuable information locked up in the heads of people who have no idea how to build a website or index a blog post. A carpet fitter with a bricks-and-mortar business might have decades of experience solving costly problems with uneven subfloors or poor moisture management, but no understanding of how to share that information online.

SEOs provide little nudges towards topics that people care about and writing that’s accessible to people and robots. They help solve technical problems that would hinder or completely block a site from appearing in search results. They identify opportunities for companies to be rewarded for creating great content.

It’s a win-win: businesses are rewarded with traffic, searchers have their intent satisfied, and the world is made a little richer for the newfound knowledge it contains.

SEOs turn helpful standards into real websites

SEOs do many things to actively make the web a better place, tending to their own plot of the Google garden to make sure it flourishes.

Take, for example, the myriad standards and guidelines designed to make the web a more accessible place for users. The implementation of these standards—turning theoretical guidelines into real, concrete parts of the web—often happens because of the SEO team.

Technical SEOs play a big part in adhering to the Web Content Accessibility Guidelines, a set of principles designed to ensure online content is “perceivable, operable, understandable, and robust” for every user. Every SEO’s fixation with Core Web Vitals fuels a faster, more efficient web. Content teams translate Google’s helpful content guidelines into useful words and images on a page.

(Case in point: check out Aleyda Solis’ Content Helpfulness Analyzer.)

Screenshot: Aleyda Solis' helpful content GPTScreenshot: Aleyda Solis' helpful content GPT

There is a lot of overlap between “things that help users” and “things that improve search performance.” Even if the motive behind these changes is as simple as generating more traffic, a well-optimized website is, generally speaking, one that is also great for real human beings trying to engage with it.

SEOs pressure-test Google’s systems

The biggest criticism leveled at SEOs is that they break things. And they do! But that breakage acts as a type of pressure testing that strengthens the system as a whole.

Abuse of spintax and keyword stuffing forced Google to develop a better understanding of on-page content. Today, that loophole is closed, but more importantly, Google is much better at understanding the contents of a page and its relationship to a website as a whole.

Hacks like hiding keywords with white text on a white background (or moving them beyond the visible bounds of the screen) forced Google to expand its understanding of page styling and CSS, and how on-page information interacts with the environment that contains it.

Even today’s deluge of borderline-plagiarised AI content is not without benefit: it creates a very clear incentive for Google to get better at rewarding information gain and prioritizing publishers with solid EEAT credentials. These improvements will make tomorrow’s version of search much better.

This isn’t just Google fixing what SEOs broke: these changes usually leave lasting benefits that extend beyond any single spam tactic and make search better for all of its users.

Illustration: how fixing problems leads to smaller future problems and improved search experienceIllustration: how fixing problems leads to smaller future problems and improved search experience

This is not to argue that blackhat SEO is desirable. It would be better to make these improvements without incurring pain along the way. But Search is huge and complicated, and Google has little incentive to spend money proactively fixing problems and loopholes.

If we can’t solve every issue before it causes pain, we should be grateful for a correction mechanism that prevents it—and more extreme abuse—from happening in the future. SEOs break the system, and in doing so, make future breakages a lot less severe.

SEOs are the internet’s quality assurance team

Some SEOs take advantage of the loopholes they discover—but many don’t. They choose to raise these issues in public spaces, encourage discussion, and seek out a fix, acting like a proxy quality assurance team.

At the small end of the spectrum, SEOs often flag bugs with Google systems, like a recent error in Search Console reporting flagged independently by three separate people, or Tom Anthony famously catching an oversight in Google’s Manual Actions database. While these types of problems don’t always impact the average user’s experience using Google, they help keep search systems working as intended.

At the other end of the scale, this feedback can extend as far as the overarching quality of the search experience, like AJ Kohn writing about Google’s propensity to reward big brands over small brands, or Lily Ray calling out an uptick in spam content in Google Discover.

SEOs are Google’s most passionate users. They interact with it at a scale far beyond the average user, and they can identify trends and changes at a macroscopic level. As a result, they are usually the first to discover problems—but also the people who hold Google to the highest standard. They are a crucial part of the feedback loop that fuels improvements.

SEOs act as a check-and-balance

Lastly, SEOs act as a check-and-balance, gathering firsthand evidence of how search systems operate, letting us differentiate between useful advice, snake oil, and Google’s PR bluster. 

Google shares lots of useful guidance, but it’s important to recognize the limits of their advice. They are a profit-seeking company, and Search requires opacity to work—if everyone understood how it worked, everyone would game it, and it would stop working. Mixed in with the good advice is a healthy portion of omission and misdirection.

Google Search plays a vital role in controlling the flow of the web’s information—it is simply too important for us to leave its mechanics, biases, and imperfections unexplored. We need people who can interrogate the systems just enough to separate fact from fiction and understand how the pieces fit together.

We need people like Mic King, and his insanely detailed write-up of SGE and RAG; Britney Muller and her demystification of LLMs; the late Bill Slawki’s unfaltering patent analysis; or our own Patrick Stox’s efforts in piecing together how search works.

Screenshot from Patrick Stox's presentation, How Search WorksScreenshot from Patrick Stox's presentation, How Search Works

Final thoughts

The web has problems. We can and should expect more from Google Search. But the problems we need to solve today are far less severe and painful than the problems that needed solving in the past; and the people who have the highest expectations, and will be most vocal in shaping that positive future, are—you guessed it—SEOs.

To SEOs: the cause of (and solution to) all of the web’s problems.

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading