OpenX Case History: Two Sites Using OpenX Suspected of Black Hat Tricks

OpenX is an internet ad delivery system. It is sophisticated and powerful, but is it reliable? It is free to use but could you lose money using it?

I was using OpenX to deliver ads on two sites. Everything worked well for over a year. I never experienced any performance problems. Then suddenly and without warning traffic crashed to nearly zero! Below are two graphs from Google Analytics data showing the crashes.

Site 1

Site 2

The first thing I did was check to see if the sites were still online. I figured they probably were online because the traffic hadn't dropped to zero. Yes, they were still up.

Next I looked at my Google rankings and saw that I still had the same SERPs (#1) as before, but beside the links in the results to my sites, there was a warning:

"This site may harm your computer."

I had never found this warning on any of my sites in the last ten years, so I didn't know what to do.

I have several other sites but none of them use OpenX, so I suspected OpenX could be the problem. (Their traffic remained the same as usual during the same period.)

So I did a Google search to see if other webmasters had a problem with OpenX. Does it cause Google to think your site is downloading malicious software onto other people's computers?

I found one discussion where a poster said there were security issues.

We’re moving away from Openx because of this. It’s a mission to fix and it doesn’t seem OpenX is serious about it. It’s happened about 3 times to us. Now we’ve upgraded, applied all the security measures and it still happened.

I had not made any changes to either site just before Google issued the security warning. I had not changed any OpenX settings, either. No new ads had been added to the system.

I hadn't changed advertisers--I didn't drop a reliable, trusted advertiser for a less reputable one. The ads being delivered on the second site were basic, clean Amazon.com ads for books. Nothing else. Amazon is about as clean and trusted an advertiser as there is. Nothing black hat there.

I was using OpenX as an ad rotator for about a dozen different ads to books. I had put the Amazon ad code in the web pages like most webmasters, but then I got what looked like a Google affiliate penalty, and my rankings went down. After removing the in-page ad code and setting up OpenX to deliver the ads, my original rankings came back, and I continued to make money from Amazon sales commissions.

Does OpenX cause traffic to drop? It seems impossible to know for sure. There are three obvious possible root causes of the major security warning problem:

1) OpenX has a security flaw which malicious programmers can exploit;

2) Google's algorithm to detect sites with malicious software is flawed; or,

3) The site that Google relies on as the authority about bad sites has a flawed algo.

Because I had no way of knowing for sure, had already lost money, and had no idea how long it would take for Google to lift the warning--during which time I would continue to lose money--I decided to stop using OpenX.

I hadn't installed the latest update of OpenX which could have had security fixes, but I also didn't know if the latest fixes would solve the problem. What was I supposed to say to Google? "I installed their security updates but I can't test them so I don't know if they'll work."

How to get the warning removed by Google

I had to add both sites to my Webmaster Tools account. Google immediately showed a notice for both sites saying they had been flagged with the security warning. It also provided dialog boxes to request a review after changes had been made.

I removed the OpenX code from all pages on both sites and reuploaded everything. Then I made the simple review request which allowed me to include a few comments about the changes I'd just made.

It took only a minute to do that but I didn't know how quickly a large company like Google would respond--Google didn't say--so I just had to wait and see. Fortunately within about 12 hours Google removed the warning from one site and within about 24 hours the second warning had been lifted. Presumably it knows from its own internal data how devastating the warning is so it responds quickly.

It's not called a Google Penalty because rankings remain the same. But it is as bad as or even worse than a rankings penalty, because almost everybody sees the warning and stays away from your site!

I have many sites and don't track all of them very carefully all the time, because there are rarely any problems. But I also realize anything can happen online at any time for any reason. I caught this problem after a random stats review.

The warning was first visible in Google Results late in the week, and I didn't check stats over the weekend. I saw it first thing Monday morning and made the fix immediately.

Traffic quickly returned to normal as you can see from the graphs.

Conclusion

If webmasters are using OpenX, I'd strongly advise them to watch their stats like a hawk.

One webmaster alleges it's a recurring issue:

An update has been made to this post after another security hole has been discovered in OpenX, allowing hackers to inject malicious code again. Source: OpenX Vulnerability: “This Site May Harm Your Computer”