Link Hijacking

Link hijacking is an attack in which someone takes control of where a published link leads, without changing the link itself. The attacker claims the domain, profile, subdomain, or redirect the link points to, then serves their own content there. Visitors still click a link from a trusted source, so they trust the attacker’s page.

How Link Hijacking Works

Most link hijacking starts with a link that nobody maintains. The link keeps living on a page, in an email, or on a printed QR code long after its target is gone.

1. A site links to a domain, social profile, or hosted file.
2. The target lapses: the domain expires, the profile is deleted, or the cloud resource is removed.
3. The link becomes a broken link, usually unnoticed.
4. An attacker finds it, registers the free name, and publishes content there.
5. The old link now delivers the attacker’s page, with your site’s credibility attached.

Security researcher EdOverflow described the pattern in 2017 under the name broken link hijacking (BLH): it “exists whenever a target links to an expired domain or page.”

Types of Link Hijacking

• Broken link hijacking. An outbound link points to an expired domain or a deleted account. A footer icon linking to a removed X or Instagram handle is the classic case: anyone can register the handle and pose as the brand.
• External script hijacking. A page loads JavaScript from a domain that has expired. Whoever re-registers it runs code inside your page. This is the most severe form, because it allows cross-site scripting.
• Subdomain takeover. A CNAME record such as blog.example.com still points to a removed hosting account. MDN Web Docs notes that an attacker can then “create their own virtual host with that provider” and claim the subdomain.
• Short link and redirect hijacking. A short link points to a vendor whose domain lapsed, or someone takes over the account and swaps the destination.
• SEO hijacking. An attacker buys an expired domain to inherit its backlinks and rankings. Google calls this expired domain abuse and has listed it as a spam policy since March 2024.

Why Link Hijacking Matters

Link hijacking turns your own trust signals against your audience. The link sits on your site, in your newsletter, or under your logo, so visitors have no reason to doubt it.

• Phishing and fraud. A hijacked support link can collect logins or payments.
• Code execution. A hijacked script can read form fields and session data on your pages.
• Brand impersonation. A claimed social handle can message your followers as you.
• Search damage. Your pages link out to spam, and old backlinks feed a stranger’s rankings.

Link rot makes the problem grow over time. Every link that decays without being removed is a potential hijack target.

How to Detect and Prevent Link Hijacking

Prevention comes down to knowing every external target you link to and removing links before their targets lapse.

1. Crawl outbound links. Flag links that return DNS errors, 404s, or parked-domain pages.
2. Check unregistered targets. Run a WHOIS lookup on any domain that fails to resolve. If it is available, remove the link immediately.
3. Audit social links. Load every profile URL in your footer, bio pages, and email signatures.
4. Delete DNS first. When retiring a hosted service, remove the DNS record before the hosting account, as MDN recommends.
5. Pin third-party scripts. Add Subresource Integrity, so the browser refuses a changed file:

<script src="https://cdn.example.com/widget.js"
        integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
        crossorigin="anonymous"></script>

1. Keep redirects under your control. Use short links on a domain you own, so you can repoint them when a destination dies. Run suspect URLs through a redirect checker to see every hop before the final page.

Link Hijacking vs Open Redirect

Both abuse trusted links, but the weak point differs. Link hijacking exploits a target you stopped owning. An open redirect exploits a redirect endpoint you still own that accepts any destination as a parameter. Fixing one does nothing for the other.

Frequently Asked Questions

What is broken link hijacking?

Broken link hijacking is the most common form of link hijacking. It happens when a site links to an expired domain or deleted account, and an attacker claims that name. The link on the original site then delivers the attacker’s content. It needs no hacking of the original site at all.

What is a link hijacking attack?

A link hijacking attack is any attempt to take over the destination of an existing link. Attackers scan sites for outbound links that fail to resolve, register the free domains or handles, and wait for traffic. Bug bounty hunters report these issues often, because they are cheap to find and easy to prove.

What is SEO hijacking?

SEO hijacking is taking over another site’s search reputation for your own pages. The most common method is buying an expired domain that still has strong backlinks and filling it with unrelated or affiliate content. Google treats this as expired domain abuse under its spam policies, and such sites can be demoted or removed from results.

What is the difference between link rot and link hijacking?

Link rot is a link that stops working because its target disappeared. Link hijacking is what happens when someone else claims that dead target. Every hijacked link was a rotten link first, which is why fixing rot quickly is the main defense.

How do you improve link security?

Link security means controlling who can reach a link and where it leads. Audit outbound links quarterly, retire DNS records before hosting, and pin external scripts with Subresource Integrity. For links you share, add access rules and a fallback URL so expired links land on a page you own.

To add passwords, expiry dates, and owned fallback pages to your shared links, see linkutm’s link protection.