A Visitor Counter From a Domain That Changed Hands

Pop-ups nobody put there

The owner of a bed and breakfast hears it from two guests in one week: the website showed them a pop-up advertisement, unrelated to the house, when they opened it on their phones.

She opens the site on her own computer and sees nothing wrong. Nobody has changed it in a year, and the person who built it moved away long ago.

The pages are untouched. What changed is something the pages fetch from elsewhere: a small visitor counter in the footer, added when the site was new.

A script from someone else's address

Most old counters came as one line of code, copied from the service and placed in the footer. That line tells every visitor's browser to fetch a script from the counter service's own domain and run it.

The script draws the counter and reports the visit back to the service. It runs inside your page with the same powers as your own code, so it can change anything a visitor sees.

That was never hidden. It was harmless as long as the domain belonged to the people who wrote the counter and wanted only to count.

What a borrowed script can do

A script loaded into your page can do almost anything your own code can:

• Show pop-ups and full-page advertisements over your content.
• Send visitors elsewhere, to another site, without a click.
• Change links on the page, the booking link included.
• Read what is typed into forms on the same page.
• Add hidden links that only search engines notice.
• Load more scripts from anywhere it likes.

The last is why these problems grow. One line in a footer can bring in a chain of code that nobody at the business has ever seen.

When the domain changed hands

Free counter services come and go. When one closes, its domain may be left to expire, and a lapsed domain still receiving requests from many sites is valuable to whoever registers it next.

The new owner needs no password and no access to your host. Every page still carrying the old line makes each visitor's browser ask their server for a script, and they decide what it contains.

Many show their pop-ups only to some visitors: phones, first visits or people arriving from search. The owner, who visits directly and often, is the person least likely to be shown one.

Finding every outside script

Open the home page in a browser, view its source and search for the word script. Note every address that is not your own domain. Repeat it on a booking page and an ordinary inner page.

The browser's developer tools show more. Their network view lists every file the page loads, from every domain, including scripts that other scripts brought in after the page opened.

Then look where people paste code: the header and footer of the theme, sidebar widgets, and any box in the site's settings for extra code. Old snippets hide there for years.

A worked example

An astronomy club's website, built by a member about eight years ago, lists meetings, observing nights and the club's loaner telescopes. A volunteer keeps it current through an older content system.

A new member reported being sent to an unfamiliar shopping site from the observing calendar. The volunteer saw nothing odd, so the club asked for the site to be checked.

The pages loaded eleven items from other domains. One was a counter whose service had closed and whose domain had a new owner; another was a guestbook whose domain showed only parked advertising.

Both went, along with a weather badge nobody needed. The sky forecast chart, the map and Analytics stayed, each still run by the people who made it.

The club now keeps a short list of what the site loads, who runs each item and why it is there. The volunteer checks it every autumn, before the long observing nights begin.

Checking each source

For every outside address, answer three questions: what it is, who runs it now, and whether the site still needs it.

Visit the domain itself. If it shows a parked page of advertisements, an unrelated business or nothing at all, the service behind your snippet has gone, whatever the snippet still does.

Then ask whether anyone still uses what it provides. Counters, badges, old sharing buttons and guestbooks often stay only because nobody took them out.

Fewer outside parties

Keep only the scripts the site needs, from services you can name, ideally ones you hold an account with and would hear from if anything changed.

A visit counter is rarely one of them now. Analytics counts visits more fully and shows the figures only to you, and a number in the footer tells guests nothing they came for.

Write the list down: each item, its domain, what it does, who added it and when. Whoever looks after the site next can then check it in minutes.

Telling guests and Google

Once the line is gone, the pop-ups stop for every visitor whose browser loads the corrected page.

Check Webmaster Tools for security warnings about the site. If Google flagged it, request a review there after the cleanup, so searchers stop seeing a warning before they click.

The guests who wrote deserve a short reply: what they saw, that it came from an outside counter, and that it has been removed. It tells them the site itself is sound.

The counter-case

Scripts from the large services most sites use, such as maps, video and Analytics itself, are far less likely to change hands than a free counter from ten years ago.

A site that loads only those, added recently and on purpose, may find little to remove. The list is still worth making, because it takes minutes and new snippets keep arriving.

But any site that nobody has examined in years should be checked line by line. The risk sits in exactly the code that nobody remembers adding.

Every outside script on one list

1. View the source of three typical pages.
2. Open the network view in the browser's developer tools.
3. List every outside domain the pages load from.
4. Visit each domain to see who runs it now.
5. Remove anything whose service has gone or is unused.
6. Check Webmaster Tools for security warnings.
7. Keep the list and review it every year.

Step four looks past the code. A snippet keeps pointing at its domain long after the company behind it has gone, and only a visit shows who answers there now.

Your own old addresses can pass to strangers the same way, which is the problem behind a new domain for every year of the event.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.