Connect with us


Traditional Way & Ahrefs’ Way



Traditional Way & Ahrefs' Way

Content maps help make sure your content serves a strategic role in nurturing your audience. It’s one of the best ways to keep your content aligned with your business goals.

I’ll cover two ways of creating content maps. The traditional way and the Ahrefs way. Both are tried and tested methods, but we like ours better—and I’ll explain why. Read on to learn both methods and choose the one that better suits your needs. We’ll talk about the following:

A content map is a document that lists stages of the buyer’s journey for every buyer persona and maps them with relevant content.

Example of Ahrefs' content map showing buyer's journey stages and persona

Example content map (from our content template). Different pieces of content have been assigned to various buyer’s journey stages for a particular buyer persona. Feel free to take a closer look at this inside our content map template.

The main reason for creating a content map is to make sure your brand’s content is accompanying each buyer persona throughout all stages of the marketing funnel—from attracting visitors to converting them and keeping them on board.

Here’s an additional reason. A sort of byproduct of creating a content map is getting an overview of your content inventory. This can help you spot gaps and find repurposing opportunities.

How to create a traditional content map (template included)

Follow these three steps to create your content map and fill any gaps with new content ideas.

1. Create buyer personas

A buyer persona is a semi-fictional person who represents the common characteristics of your customers (an archetype). Here’s an example buyer persona for our product:

Infographic of buyer persona "Anna Agency"

A buyer persona helps you visualize your customers’ buying journey, internalize who they are, and empathize with their challenges and goals.

Depending on your resources, there are two ways you can identify your customers to create a buyer persona:

  • The scientific way – Talk to potential customers. This can be your leads, social media followers, or simply people you know who may be interested in your product. You may also consider using services like SurveyMonkey, UserTesting, or Remesh to reach these people.
  • The educated-guess way – If for some reason you can’t talk to real people at this stage, you need to get creative. Use your competitors’ data or the industry data and “enrich” it with other sources. You may find that, for example, organic search is the #1 spending priority, according to a CMO survey.

To make your content mapping effective, you need to create a buyer persona for each type of customer. The more granular your typology is, the more customized your content. On the other hand, it will take you more time and resources to address all the personas’ goals and challenges compared to more generalized content.

Too many personas? Consider creating categories that connect personas with similar traits, e.g., business owners, in-house teams, freelancers, etc.

2. Use our template to map existing content for each persona

To make content mapping easier, I’ve prepared a simple template. (Click here to make your own editable copy in Google Sheets.)

All you need to do here is to fill in your existing content under the corresponding stage of the buyer’s journey (you can find some examples in the template). If you don’t have any content to map yet or want to start over, no worries—I’ll share some ideas to solve these issues in the next section.

As for the stages of the buyer’s journey, there are many different typologies out there. I’ve used the one from our guide to creating a winning content strategy. It may be slightly different than what you’re used to, so feel free to modify it accordingly.

If this stuff is totally new to you, don’t bother customizing those stages for now. The general idea is to create content that attracts visitors and gradually turns them into happy customers who are willing to come back to you. So here are short descriptions of the stages used in the template:

  1. Increase brand awareness – At this stage, the prospect is just becoming aware of their problem. They don’t know the solution yet and may not know your brand. This type of content doesn’t necessarily need to feature your product, as you’re basically trying to introduce your brand to potential customers.
  2. Create interest and desire – You can do so by teaching potential customers more about their problems and how your product or service can solve them.
  3. Nurture interest and entice the purchase – You can further educate potential customers about your product or service and why it’s the best solution for them.
  4. Retain customers and build brand loyalty – To do this, educate customers on how to get the most out of your product or service and clearly demonstrate its value. Additionally, in this stage, you can tackle topics that you know your customers care for but do not necessarily give you the opportunity to feature your product/service in any practical way.

As you write down your content pieces, you can come across some dilemmas.

  • The content fits multiple stages – You still have to choose one. Choose the one with the most dominant use case.
  • The content doesn’t fit anywhere – See if that piece of content can be updated so that you can classify it easier without losing its current value. Another scenario is that my template is too simplistic. If so, you may need to add the buyer’s journey stages.

3. Fill in any gaps in the buyer’s journey

Chances are that while making your content map, you will find gaps in your buyer’s journey: places where there is no content or not enough content to serve a given journey stage. In that case, there are basically four methods for filling those gaps with relevant content ideas. 

Do keyword research

Keyword research is the process of understanding the language your target customers use when searching for your products, services, and content. It then involves analyzing, comparing, and prioritizing the best keyword opportunities for your website.

For example, we can assume that our persona, Anna Agency, needs to figure out SEO tactics for clients from different industries. Keyword research will help us discover those industries, see search demand for related topics, and quickly gauge potential traffic.

To do this, we just need a seed keyword (e.g., “seo”) to view related topics and then we can fine-tune the search using various filters.

In the example below, I’m using the “for” modifier word. I’m also including queries that have more than 200 monthly searches and excluding words that are irrelevant—all in Ahrefs’ Keywords Explorer.

Matching terms report results

We can further narrow down that list by using other filters. For example, we can filter by Keyword Difficulty (KD) to see keywords that we can potentially rank for with less effort. Or we can use the Traffic Potential (TP) filter to hide keywords with low traffic.

Matching terms report results filtered by KD

Then, we can generate even more keyword ideas by using other modifier keywords that signal educational intent. Here are some of these words: how, guide, resource, ideas, tips, etc.

Matching terms report results with Include filter applied

Last but not least, Ahrefs has a separate report for all of the questions related to a given topic that people type in Google, and it’s just one click away from the report we’ve been using so far.

Matching terms report results; notably, "Questions" tab selected

Analyze competitors

One way to draw inspiration from your competitors is to manually check their websites for topic ideas. That’s a lot of man-hours.

Here’s how you can streamline this process with Ahrefs.

First of all, start by listing your competitors and doing basic market research. You can always double-check your competitor list by plugging your URL in Ahrefs’ Site Explorer and going to the Competing Domains report.

Competing Domains report results

Now you can take the list of competitors to the Content Gap report to reveal the keywords that your competitors rank for but you don’t. These will be your new content opportunities. You can then filter that list to make it more manageable.

Content Gap report results

In the Content Gap report, you can filter out branded keywords for more clarity.

Additionally, you can easily discover your competitors’ best content. There are a few ways to do that, depending on your marketing objectives.

If you want to create content that is designed to rank on search engines and bring you organic traffic, try the Top pages report.

Top pages report results

This report not only shows you the content and its traffic but also changes in traffic over time. This allows you to spot declining and trending topics.

But if it’s links that you’re after, you can use the Best by links or Best by links’ growth reports.

Best by links report results

Finally, if you need social shares the most, go to our Top Content report to uncover content where your competitors got the most Twitter and Pinterest shares.

This report can also be used as a proxy for understanding what types of content resonate with your competitors’ target audiences because it also shows how many websites linked to that content and which parts were the most valuable (by viewing the anchors they linked with).

Top Content report results

Apart from social media stats, this report offers insights into the reason why people linked to the content. You can click the “Details” button to uncover link anchors.

Study your niche

Another way of discovering relevant topics to enrich your content map is paying attention to what other people say in places where your industry and/or your target audience hangs out; for example, groups on social media, magazines, personal blogs, and communities.

A lot of the time, you will find information that overlaps with keyword research. But other times, you will come across hidden gems, such as:

  • The next big thing people are talking about but no one has written a comprehensive guide for.
  • Topics underserved by your competitors.
  • Things your target audience wants to learn more about (and how they want to learn about said things).
  • What language your target audience uses to express their goals and challenges.

For example, one of our best-performing articles, “How to Submit Your Website to Google,” was inspired by a printed magazine titled “How to set up an online business” that was found in an airport bookstore. 

SERP overview for "submit to search engines"

If you think that’s too much manual work, you can try an audience research tool like SparkToro. Just plug in topics your target audience frequently talks about to discover related topics and hashtags (among many other things).

SparkToro results in "bar graph" form for this search term: seo, marketing

On top of topic ideas, SparkToro can also help you with identifying their demographics and discovering what media your target audience consumes.

Survey your audience

Try the obvious—just ask your audience what type of content will make their life easier.

If you already have some blog/newsletter subscribers on board, this step is as easy as preparing a questionnaire and sending it. Alternatively, you can display a short questionnaire on your site.

But if you’re just starting out, you can use an agile market research software like SurveyMonkey to get your questionnaire in front of the right eyes.

Here are a few questions you can ask:

  • What would you like to learn about on this blog?
  • What’s the biggest priority in your job?
  • In the last months, what was your biggest challenge?
  • Do you plan on buying our product in the near future?
  • How did you discover our blog?
  • What’s your favorite source of information about ___?

And that’s about it when it comes to the “traditional” approach to content mapping. Here’s what we, at Ahrefs, do differently and why we do it that way.

The alternative approach – How we map content at Ahrefs

The traditional way of content mapping matches content to a single stage of the funnel. But that one-to-one match isn’t always the case. So we use a different approach that helps us create product-led content that brings over 273K visits from search to our blog every month.

Site Explorer overview for Ahrefs' blog

A little bit of theory

The thing is that a single article can serve various purposes. It can attract a potential customer and help to retain an existing customer.

Table showing four questions with corresponding answers that are used to decide which stage(s) of the marketing funnel a blog article serves

Moreover, in some cases, a single article can take the user down the entire funnel—from learning about a solution to purchasing the solution.

Let’s take our guide on how to rank higher on Google as an example. In six easy steps, it explains how to improve rankings of underperforming keywords and get more traffic as a result.

So let’s say someone Googles “how to rank higher on google.” That person is pretty much right at the top of the funnel because they’re aware of their problem but don’t know the solution yet. They may not have heard of Ahrefs and may have zero knowledge of SEO.

Being at the first stage of the funnel, they come across our guide. As the guide walks them through the process, it may also walk them through the entire funnel. They learn the solution (SEO) and learn that they need a tool like Ahrefs to implement the solution.

Besides, ask yourself this: Can you remember the last time branded content made you buy something? Was it one or more content pieces? Was your “buyer journey” linear or more complex? You may find that the map is not the territory.

The “business potential” framework

Because it seems that the models of the buyer’s journey aren’t always useful, we map content based on a scale of how crucial our product is in solving a given problem.

Business potential: Table with scores 3 to 0. And explanation of criteria to meet each score

Let’s look at the business potential (BP) scale in detail and see some examples for each of the scores. If you want to dive deeper into this framework, you can skim through the articles below to see how our product is featured (or why it can’t be featured).

So if you want to create a content map with the use of our framework, it’s a really simple one—just the topic and its BP score.

Additionally, you can complement that with some SEO metrics (like traffic potential) if search engines are an essential marketing channel to you. So it can look something like this:

Topic Business potential Organic traffic potential
13 Best Marketing Blogs to Follow (For Marketers of All Levels) 0 300
Marketing Objectives: How to Set Them Right (With Examples) 1 1200
‘Not Provided’ in Google Analytics: How to Reclaim Your Keyword Data 2 800
What Is SEO Content? How to Write Content That Ranks 3 900

That said, there are still some similarities between our model and the traditional model. For example, we also use buyer personas. We don’t use them to “customize” every topic, though. We use them to understand who we are talking to so we can align the style and depth of the content.

For example, we’re trying to avoid marketing jargon, as we’re not targeting our content to marketing academics but rather marketing practitioners who are not always experts in this field.

You will find these tools helpful in creating and populating your content map:

  • Ahrefs – SEO tools like ours are indispensable if you want to learn what people look for online, how often, and what words they use in their searches.
  • Google Sheets – This is for using our content mapping template.
  • Diagramming tool – Some examples include Lucidchart or MindMeister, which are great for creating buyer’s journey diagrams/maps. This is an additional (and harder) step you can take in content mapping. Do this if you want to better understand and/or visualize the buyer’s journey in your particular case.
  • Survey tool – Tools such as Google Forms, SurveyMonkey, or Survicate can be used for getting feedback about your content.
  • Audience research tool – Try SparkToro or Brandwatch for finding the topics that make your audience tick.

Final thoughts

Let’s complete this guide by discussing some advantages and disadvantages of these two content mapping methods:

Traditional content mapping   Ahrefs’ content mapping  
Pros Cons Pros Cons
Customizes content for specific personas Too “square” buckets  Easy to implement  Can lead to missed opportunities where product-led content can’t be applied
Easier to spot gaps in the buyer’s journey Can become too complicated (too time consuming) Enhances product marketing Frequent product placement can lead to readers’ fatigue in owned marketing channels 
Can be used for all content formats and channels Uses a simplified model of user behavior Best for blogging, video blogging and, generally, longer content formats 

So can we take the best of both worlds and create a hybrid? I think so. One way is to insert the business score into the stages of the buyer’s journey.

For example, you can require a score of 2 or 3 for content designed to entice people to make a purchase. Topics with scores 0 and 1 are OK as long as they are either in the interest, desire, or retain stages.

Whether that hybrid model works well enough is a conclusion I’ll leave you to make.

What’s next after mapping content? Try our resources on content marketing to learn things like content strategy, content creation, promotion, and repurposing.

Got questions or comments? Ping me on Twitter.

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address


The Lean Guide (With Template)



The Lean Guide (With Template)

A competitive analysis (or market competitive analysis) is a process where you collect information about competitors to gain an edge over them and get more customers.

However, the problem is that “traditional” competitive analysis is overkill for most businesses — it requires impractical data and takes too long to complete (and it’s very expensive if you choose to outsource). 

A solution to that is a lean approach to the process — and that’s what this guide is about. 

In other words, we’ll focus on the most important data you need to answer the question: “Why would people choose them over you?”. No boring theory, outtakes from marketing history, or spending hours digging up nice-to-have information.

In this guide, you will find:

  • A real-life competitive analysis example.
  • Templates: one for input data and one for a slide deck to present your analysis to others.
  • Step-by-step instructions.

Our template consists of two documents: a slide deck and a spreadsheet. 

The Slide deck is the output document. It will help you present the analysis to your boss or your teammates.

The spreadsheet is the input document. You will find tables that act as the data source for the charts from the slide deck, as well as a prompt to use in ChatGPT to help you with user review research.

Competitive analysis template — spreadsheet sneak peek.Competitive analysis template — spreadsheet sneak peek.

We didn’t focus on aesthetics here; every marketer likes to do slide decks their own way, so feel free to edit everything you’ll find there. 

With that out of the way, let’s talk about the process. The template consists of these six tasks: 

  1. Identify your direct competitors. 
  2. Compare share of voice. 
  3. Compare pricing and features.
  4. Find strong and weak points based on reviews.
  5. Compare purchasing convenience.
  6. Present conclusions.

Going forward, we’ll explain why these steps matter and show how to complete them. 

1. Identify your direct competitors

Direct competitors are businesses that offer a similar solution to the same audience. 

They matter a lot more than indirect competitors (i.e. businesses with different products but targeting the same audience as you) because you’ll be compared with them often (e.g. in product reviews and rankings). Plus, your audience is more likely to gravitate towards them when considering different options. 

You probably have a few direct competitors in mind already, but here are a few ways to find others based on organic search and paid search ads

Our basis for the analysis was Landingi, a SaaS for building landing pages (we chose that company randomly). So in our case, we found these 3 direct competitors. 

Slide 1 — direct competitors.Slide 1 — direct competitors.

Look at keyword overlap

Keyword overlap uncovers sites that target the same organic keywords as you. Some sites will compete with you for traffic but not for customers (e.g. G2 may share some keywords with Landingi but they’re a different business). However, in many cases, you will find direct competitors just by looking at this marketing channel. 

  • Go to Ahrefs’ Site Explorer and enter your site’s address. 
  • Scroll down to Organic competitors
  • Visit the URLs to pick 3 – 5 direct competitors.
Top organic competitors data from Ahrefs.Top organic competitors data from Ahrefs.

To double-check the choice of competitors, we also looked at who was bidding for search ads on Google.

See who’s advertising 

If someone is spending money to show ads for keywords related to what you do, that’s a strong indication they are a direct competitor. 

  • Go to Ahrefs’ Keywords Explorer.
  • Type in a few broad keywords related to your niche, like “landing page builder” or “landing page tool”. 
  • Go to the Ads history report. 
  • Visit the sites that have a high presence of ads in the SERPs (Search Engine Result Pages). 
Ads history report in Ahrefs' Keywords Explorer.Ads history report in Ahrefs' Keywords Explorer.

Once you’re done checking both reports, write down competitors in the deck. 

You can also take screenshots of the reports and add them to your deck to show the supporting data for your argument. 

 Slide 2 — direct competitors by organic traffic. Slide 2 — direct competitors by organic traffic.

2. Compare share of voice

Share of voice is a measure of your reach in any given channel compared to competitors. 

A bigger share of voice (SOV) means that your competitors are more likely to reach your audience. In other words, they may be promoting more effectively than you. 

In our example, we found that Landingi’s SOV was the lowest in both of these channels. 


Slide 3 — share of voice on Google Search.Slide 3 — share of voice on Google Search.

And social media:

 Slide 4 — share of voice on social media. Slide 4 — share of voice on social media.

Here’s how we got that data using Ahrefs and Brand24.

Organic share of voice 

Before we start, make sure you have a project set up in Ahrefs’ Rank Tracker

Create a new project in Ahrefs' Rank Tracker.Create a new project in Ahrefs' Rank Tracker.


  • Go to Ahrefs’ Competitive Analysis and enter your and your competitors’s sites as shown below. 
Create a new project in Ahrefs' Rank Tracker.
Create a new project in Ahrefs' Rank Tracker.
  • On the next screen, set the country with the most important market for your business and set the filters like this:
Content gap analysis filter setup.Content gap analysis filter setup.
  • Select keywords that sound most relevant to your business (even if you don’t rank for them yet) and Add them to Rank Tracker
Common keywords found via Ahrefs' Competitive Analysis.Common keywords found via Ahrefs' Competitive Analysis.
  • Go to Rank Tracker, open your project, and look for Competitors/Overview. This report will uncover automatically calculated Share of Voice
Organic share of voice data in Ahrefs.Organic share of voice data in Ahrefs.
  • Add the numbers in corresponding cells inside the sheet and paste the graph inside the slide deck. 
Filling the share of voice template with data.Filling the share of voice template with data.

It’s normal that the numbers don’t add up to 100%. SOV is calculated by including sites that compete with you in traffic but are not your direct competitors, e.g. blogs. 

Social share of voice 

We can also measure our share of voice across social media channels using Brand24.

  • Go to Brand24.
  • Start a New project for your brand and each competitor. Use the competitors’ brand name as the keyword to monitor. 
  • Go to the Comparison report and compare your project with competitors. 
Using Brand24's Comparison tool for competitive analysis.Using Brand24's Comparison tool for competitive analysis.
  • Take a screenshot of the SOV charts and paste them into the slide deck. Make sure the charts are set to “social media”.
Social media tab in share of voice report.Social media tab in share of voice report.

3. Compare pricing and features

Consumers often choose solutions that offer the best value for money — simple as that. And that typically comes down to two things: 

  • Whether you have the features they care about. We’ll use all features available across all plans to see how likely the product is to satisfy user needs.
  • How much they will need to pay. Thing is, the topic of pricing is tricky: a) when assessing affordability, people often focus on the least expensive option available and use it as a benchmark, b) businesses in the SaaS niche offer custom plans. So to make things more practical, we’ll compare the cheapest plans, but feel free to run this analysis across all pricing tiers.

After comparing our example company to competitors, we found that it goes head-to-head with Unbounce as the most feature-rich solution on the market. 

Slide 5 — features vs. pricing.Slide 5 — features vs. pricing.

Here’s how we got that data. 

  • Note down your and your competitors’ product features. One of the best places to get this information is pricing pages. Some brands even publish their own competitor comparisons — you may find them helpful too. 
  • While making the list, place a “1” in the cell corresponding to the brand that offers the solution.
Filling data in the spreadsheet.Filling data in the spreadsheet.
  • Enter the price of the cheapest plan (excluding free plans). 
Adding pricing data inside the spreadsheet.Adding pricing data inside the spreadsheet.
  • Once finished, copy the chart and paste it inside the deck. 

4. Find strong and weak points based on user reviews

User reviews can show incredibly valuable insight into your competitors’ strong and weak points. Here’s why this matters:

  • Improving on what your competitors’ customers appreciate could help you attract similar customers and possibly win some over.
  • Dissatisfaction with competitors is a huge opportunity. Some businesses are built solely to fix what other companies can’t fix. 

Here’s a sample from our analysis: 

 Slide 6 — likes and dislikes about Competitors. Slide 6 — likes and dislikes about Competitors.

And here’s how we collated the data using ChatGPT. Important: repeat the process for each competitor.

  • Open ChatGPT and enter the prompt from the template.
ChatGPT prompt for competitive analysis.ChatGPT prompt for competitive analysis.
  • Go to G2, Capterra, or Trustpilot and find a competitor’s reviews with ratings from 2 – 4 (i.e. one rating above the lowest and one below the highest possible). Reason:

businesses sometimes solicit five-star reviews, whereas dissatisfied customers tend to leave one-star reviews in a moment of frustration. The most actionable feedback usually comes in between.

  • Copy and paste the content of the reviews into ChatGPT (don’t hit enter yet). 
  • Once you’re done pasting all reviews, hit enter in ChatGPT to run the analysis.
Sample of ChatGPT output with charts.Sample of ChatGPT output with charts.
  • Paste the graphs into the deck. If you want the graphs to look different, don’t hesitate to ask the AI. 

There’s a faster alternative, but it’s a bit more advanced. 

Instead of copy-pasting, you can use a scraping tool like this one to get all reviews at once. The downside here is that not all review sources will a have scraping tool available. 

5. Compare purchasing convenience

Lastly, we’ll see how easy it is to actually buy your products, and compare the experience to your competitors. 

This is a chance to simplify your checkout process, and even learn from any good habits your competitors have adopted.

For example, we found that our sample company had probably nothing to worry about in this area — they ticked almost all of the boxes. 

Slide 7 — purchasing convenience.Slide 7 — purchasing convenience.

Here’s how to complete this step:

  • Place a “1” if you or any of your competitors offer convenience features listed in the template. 
  • Once done, copy the chart and paste it into the deck.

Step 6. Present conclusions

This is the part of the presentation where you sum up all of your findings and suggest a course of action. 

Here are two examples: 

  • Landingi had the lowest SOV in the niche, and that is never good. So the conclusion might be to go a level deeper and do an SEO competitive analysis, and to increase social media presence by creating more share-worthy content like industry surveys, design/CRO tips, or in-house data studies.
  • Although the brand had a very high purchasing convenience score, during the analysis we found that there was a $850 gap between the monthly full plan and the previous tier. The conclusion here might be to offer a custom plan (like competitors do) to fill that gap. 

We encourage you to take your time here and think about what would make the most sense for your business. 


It’s good to be specific in your conclusions, but don’t go too deep. Competitive analysis concerns many aspects of the business, so it’s best to give other departments a chance to chime in. Just because your competitors have a few unique features doesn’t necessarily mean you need to build them too.

Final thoughts 

A competitive analysis is one of the most fruitful exercises in marketing. It can show you areas for improvement, give ideas for new features, and help you discover gaps in your strategy. It wouldn’t be an exaggeration to say that it’s fundamental to running a successful business. 

Just don’t forget to balance “spying” on your competitors with innovation. After all, you probably don’t want to become an exact copy of someone else’s brand. 

In other words, use competitive analysis to keep up with your competitors, but don’t let that erase what’s unique about your brand or make you forget your big vision. 

Got comments or questions? Ping me on X

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading


Critical WordPress Form Plugin Vulnerability Affects Up To +200,000 Installs




Critical WordPress Form Plugin Vulnerability Affects Up To +200,000 Installs

Security researchers at Wordfence detailed a critical security flaw in the MW WP Form plugin, affecting versions 5.0.1 and earlier. The vulnerability allows unauthenticated threat actors to exploit the plugin by uploading arbitrary files, including potentially malicious PHP backdoors, with the ability to execute these files on the server.

MW WP Form Plugin

The MW WP Form plugin helps to simplify form creation on WordPress websites using a shortcode builder.

It makes it easy for users to create and customize forms with various fields and options.

The plugin has many features, including one that allows file uploads using the [mwform_file name=”file”] shortcode for the purpose of data collection. It is this specific feature that is exploitable in this vulnerability.

Unauthenticated Arbitrary File Upload Vulnerability

An Unauthenticated Arbitrary File Upload Vulnerability is a security issue that allows hackers to upload potentially harmful files to a website. Unauthenticated means that the attacker does not need to be registered with the website or need any kind of permission level that comes with a user permission level.

These kinds of vulnerabilities can lead to remote code execution, where the uploaded files are executed on the server, with the potential to allow the attackers to exploit the website and site visitors.

The Wordfence advisory noted that the plugin has a check for unexpected filetypes but that it doesn’t function as it should.

According to the security researchers:

“Unfortunately, although the file type check function works perfectly and returns false for dangerous file types, it throws a runtime exception in the try block if a disallowed file type is uploaded, which will be caught and handled by the catch block.

…even if the dangerous file type is checked and detected, it is only logged, while the function continues to run and the file is uploaded.

This means that attackers could upload arbitrary PHP files and then access those files to trigger their execution on the server, achieving remote code execution.”

There Are Conditions For A Successful Attack

The severity of this threat depends on the requirement that the “Saving inquiry data in database” option in the form settings is required to be enabled in order for this security gap to be exploited.

The security advisory notes that the vulnerability is rated critical with a score of 9.8 out of 10.

Actions To Take

Wordfence strongly advises users of the MW WP Form plugin to update their versions of the plugin.

The vulnerability is patched in the lutes version of the plugin, version 5.0.2.

The severity of the threat is particularly critical for users who have enabled the “Saving inquiry data in database” option in the form settings and that is compounded by the fact that no permission levels are needed to execute this attack.

Read the Wordfence advisory:

Update ASAP! Critical Unauthenticated Arbitrary File Upload in MW WP Form Allows Malicious Code Execution

Featured Image by Shutterstock/Alexander_P

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading


How SEOs Make the Web Better



How SEOs Make the Web Better

SEOs catch flak for ruining the web, but they play a crucial role in the search ecosystem, and actually make the internet better for everyone.

Let’s get the criticism out of the way. There are bad actors in SEO, people who seek to extract money from the internet regardless of the cost to others. There are still scams and snake oil, posers and plagiarists. Many parts of the web have become extremely commercialized, with paid advertising and big brands displacing organic and user-generated content.

But while there are situations where SEOs have made things worse, to fixate on them is to ignore the colossal elephant in the room: in the ways that really matter, the web is the best it’s ever been:

  • It’s the easiest it has ever been to find information on the internet. Searchers have a staggering array of tutorials, teardowns, and tips at their fingertips, containing information that is generally accurate and helpful—and this was not always the case.
  • Bad actors have a smaller influence over search. Search is less of a Wild West than it used to be. Once-scam-ridden topics are subject to significant scrutiny, and the problems and loopholes in search that need fixing today—like big brands and generic content receiving undue prominence—are smaller and less painful than the problems of the past.
  • More people use search to their benefit. Online content is the most accessible it has ever been, and it’s easier than ever to grow a local business or expand into international markets on the back of search.

SEOs have played a crucial role in these improvements, poking and prodding, building and—sometimes—breaking. They are Google power users: the people who push the system to extremes, but in doing so, catalyze the change needed to make search better for everyone.

Let’s explore how.

SEOs help regular people benefit from search

SEOs are much-needed intermediaries between Google and the rest of the world, helping non-technical people acquire and benefit from search engine traffic.

There is a huge amount of valuable information locked up in the heads of people who have no idea how to build a website or index a blog post. A carpet fitter with a bricks-and-mortar business might have decades of experience solving costly problems with uneven subfloors or poor moisture management, but no understanding of how to share that information online.

SEOs provide little nudges towards topics that people care about and writing that’s accessible to people and robots. They help solve technical problems that would hinder or completely block a site from appearing in search results. They identify opportunities for companies to be rewarded for creating great content.

It’s a win-win: businesses are rewarded with traffic, searchers have their intent satisfied, and the world is made a little richer for the newfound knowledge it contains.

SEOs turn helpful standards into real websites

SEOs do many things to actively make the web a better place, tending to their own plot of the Google garden to make sure it flourishes.

Take, for example, the myriad standards and guidelines designed to make the web a more accessible place for users. The implementation of these standards—turning theoretical guidelines into real, concrete parts of the web—often happens because of the SEO team.

Technical SEOs play a big part in adhering to the Web Content Accessibility Guidelines, a set of principles designed to ensure online content is “perceivable, operable, understandable, and robust” for every user. Every SEO’s fixation with Core Web Vitals fuels a faster, more efficient web. Content teams translate Google’s helpful content guidelines into useful words and images on a page.

(Case in point: check out Aleyda Solis’ Content Helpfulness Analyzer.)

Screenshot: Aleyda Solis' helpful content GPTScreenshot: Aleyda Solis' helpful content GPT

There is a lot of overlap between “things that help users” and “things that improve search performance.” Even if the motive behind these changes is as simple as generating more traffic, a well-optimized website is, generally speaking, one that is also great for real human beings trying to engage with it.

SEOs pressure-test Google’s systems

The biggest criticism leveled at SEOs is that they break things. And they do! But that breakage acts as a type of pressure testing that strengthens the system as a whole.

Abuse of spintax and keyword stuffing forced Google to develop a better understanding of on-page content. Today, that loophole is closed, but more importantly, Google is much better at understanding the contents of a page and its relationship to a website as a whole.

Hacks like hiding keywords with white text on a white background (or moving them beyond the visible bounds of the screen) forced Google to expand its understanding of page styling and CSS, and how on-page information interacts with the environment that contains it.

Even today’s deluge of borderline-plagiarised AI content is not without benefit: it creates a very clear incentive for Google to get better at rewarding information gain and prioritizing publishers with solid EEAT credentials. These improvements will make tomorrow’s version of search much better.

This isn’t just Google fixing what SEOs broke: these changes usually leave lasting benefits that extend beyond any single spam tactic and make search better for all of its users.

Illustration: how fixing problems leads to smaller future problems and improved search experienceIllustration: how fixing problems leads to smaller future problems and improved search experience

This is not to argue that blackhat SEO is desirable. It would be better to make these improvements without incurring pain along the way. But Search is huge and complicated, and Google has little incentive to spend money proactively fixing problems and loopholes.

If we can’t solve every issue before it causes pain, we should be grateful for a correction mechanism that prevents it—and more extreme abuse—from happening in the future. SEOs break the system, and in doing so, make future breakages a lot less severe.

SEOs are the internet’s quality assurance team

Some SEOs take advantage of the loopholes they discover—but many don’t. They choose to raise these issues in public spaces, encourage discussion, and seek out a fix, acting like a proxy quality assurance team.

At the small end of the spectrum, SEOs often flag bugs with Google systems, like a recent error in Search Console reporting flagged independently by three separate people, or Tom Anthony famously catching an oversight in Google’s Manual Actions database. While these types of problems don’t always impact the average user’s experience using Google, they help keep search systems working as intended.

At the other end of the scale, this feedback can extend as far as the overarching quality of the search experience, like AJ Kohn writing about Google’s propensity to reward big brands over small brands, or Lily Ray calling out an uptick in spam content in Google Discover.

SEOs are Google’s most passionate users. They interact with it at a scale far beyond the average user, and they can identify trends and changes at a macroscopic level. As a result, they are usually the first to discover problems—but also the people who hold Google to the highest standard. They are a crucial part of the feedback loop that fuels improvements.

SEOs act as a check-and-balance

Lastly, SEOs act as a check-and-balance, gathering firsthand evidence of how search systems operate, letting us differentiate between useful advice, snake oil, and Google’s PR bluster. 

Google shares lots of useful guidance, but it’s important to recognize the limits of their advice. They are a profit-seeking company, and Search requires opacity to work—if everyone understood how it worked, everyone would game it, and it would stop working. Mixed in with the good advice is a healthy portion of omission and misdirection.

Google Search plays a vital role in controlling the flow of the web’s information—it is simply too important for us to leave its mechanics, biases, and imperfections unexplored. We need people who can interrogate the systems just enough to separate fact from fiction and understand how the pieces fit together.

We need people like Mic King, and his insanely detailed write-up of SGE and RAG; Britney Muller and her demystification of LLMs; the late Bill Slawki’s unfaltering patent analysis; or our own Patrick Stox’s efforts in piecing together how search works.

Screenshot from Patrick Stox's presentation, How Search WorksScreenshot from Patrick Stox's presentation, How Search Works

Final thoughts

The web has problems. We can and should expect more from Google Search. But the problems we need to solve today are far less severe and painful than the problems that needed solving in the past; and the people who have the highest expectations, and will be most vocal in shaping that positive future, are—you guessed it—SEOs.

To SEOs: the cause of (and solution to) all of the web’s problems.

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading