In the cybersecurity scenarios we usually encounter, we would hardly take into consideration SEO and Google’s search results. But if a malicious actor had the ability to remove from the search results of the most famous search engine in the world all the pages of a company, what economic and reputational damage could they cause? This is what emerged at the end of July 2025, when an investigation revealed a vulnerability that allowed anyone, with an incredibly simple technique, to de-index specific pages from Google’s results.

The Vulnerability

Google offers a public feature called Refresh Outdated Content. It exists so that non-owners can request Google to update or remove search results that reference pages which are gone (404) or that have changed substantially—think of a page where sensitive data was removed but Google’s snippet still shows it. The idea is good: keep results fresh and accurate.

Attackers discovered that if they submitted a look-alike URL—same address but with different capitalization in its “slug”—Google’s systems could mistakenly remove the real, still-live page from the index after seeing a 404 on the fake, capitalized version. In practice, this meant a determined actor could file a bogus “refresh” and make a working article effectively vanish from search. (Freedom of the Press)

Vulnerability Disclosure

Freedom of the Press Foundation (FPF) describes how their article about a tech executive’s alleged censorship efforts was repeatedly knocked out of Google. Each time they re-indexed the page, new requests arrived targeting slightly different, oddly capitalized versions of the URL—nine requests against FPF’s story and 21 against two of Poulson’s posts over a six-week period. It was a game of search-result Whac-A-Mole until FPF pressed Google for answers. Google told FPF the issue affected only a “tiny fraction” of sites, but importantly confirmed a fix and said it had re-listed wrongly impacted pages. When attackers tried the same trick on August 1, the request was denied, indicating the fix was live.

SEO trade coverage suggests the problem wasn’t isolated. Search Engine Journal reported accounts of hundreds of articles being de-indexed via the same public tool, and walked through how the capitalization quirk played into the removal process. While Google says the scope was small, the impact for victims was anything but. (Search Engine Journal)

Why Google even has a tool like this

For context, Google runs two families of removal/update features:

• Refresh Outdated Content (public): for non-owners to nudge Google when a page is gone or substantially changed. It should not remove live pages with unchanged content.
• Search Console Removals (owners): for site owners to temporarily hide their own URLs and review removal history (including reports from non-owners). This is also where you can spot—and cancel—bad requests targeting your site.

The bug lived in the way Google validated public requests in the presence of uppercase/ lowercase in the URL. Google stated that it corrected the behavior; the technical details are not public, but the further attempts described by FPF turn out to be rejected after the fix.

URLs are case sensitive in the path part: for Google /POST and /post are two different URLs. If your server treats these variants as equivalent, it is good practice to enforce a uniform format (usually lowercase) to help the engines understand that it is the same page.

Moreover, it is possible to strengthen consistency by indicating the preferred version with the rel="canonical" tag and with 301 redirects from non-canonical variants to the definitive one.

If you run a website (owner, marketer, comms lead)

1. Check whether you were targeted.
   Open Google Search Console → Index → Removals and scan for “Outdated Content” requests affecting your domain. If you see an “Approved” request for a page that’s live, cancel it, then Request Indexing for the URL (URL Inspection → Request indexing). This puts the page back in the queue to be re-added.
2. Harden your URLs against the exploit class.
   Even though Google says it’s fixed, you can reduce future risk by enforcing lowercase URLs on your site. That means redirecting any uppercase or mixed-case paths to the lowercase canonical (via your CMS settings or a simple web-server rewrite). Consistent, canonical URLs help search engines—and make capitalization tricks much less effective.
3. Monitor automatically.
   Set a weekly (or automated) check for:
   • Top pages disappearing from organic traffic in analytics
   • Index coverage changes in Search Console
   • Anomalous Removals entries
   Catching a drop quickly lets you reindex the page and investigate before it hurts leads or reputation.
4. Use canonical signals.
   Where possible, keep a single, consistent version of each URL: one protocol (HTTPS), one host (with or without “www”), lowercase path, and a rel=“canonical” pointing to that version. Consistency reduces the odds of edge-case indexing issues when tools or bots encounter variants. (General best practice; consistent with the issues surfaced here.)
5. Have a fast “recovery playbook.”
   If a critical page vanishes:

• Verify it returns HTTP 200 and loads normally.
• In Search Console, cancel any incorrect Outdated Content removals and Request Indexing.
• Consider publishing a short update or republishing to trigger a fresh crawl.
• If abuse continues, document it (screenshots, timestamps) and contact your Google support channel or community forum with details.

What about other engines

Remember this episode is about search visibility, not whether content exists on the web. If a story feels “missing,” try:

• Another search engine (they ranked the missing pages while Google didn’t).
• Going direct: paste the full URL or visit the site’s own search.
• Checking the site’s sitemap (often at /sitemap.xml) or the Internet Archive.

Conclusions

Despite a large share of traffic nowadays being generated through social networks, search engines still play a fundamental role in the dissemination of relevant content. In the already fragile discovery of content, especially for journalism, watchdog and SMEs, the risk is that even a mechanism designed to clean up obsolete results can turn into a tool of censorship. And so, in addition to the well-known attempts at XSS, SQL injection, bruteforce, CVE exploitation, SEO too becomes an attack surface for malicious actors of any kind.