I have a wordpress website and it is connected to google search console. Very often atleast once a month i experience this issue.

Anonymous sitemaps containing fake links (just to drive traffic to attackers properties) are added to my domain.

Whenever i happen to check manually only i am able to detect and remove it.

On the wordpress site I have some basic security plugins setup and write protection enabled they are not helping for this issue.

If anyone can help how to stop the attacker from adding sitemaps without authentication will be a great help.

P.S: I got a google notification for accessing my property by an anonymous email once in the past, but when checked for any such users there was no one i could see in search console settings. But I had this problem even before getting this notification. enter image description here

Please refer the screenshot of all the sitemap that are added by attacker.

  • Someone is breaking into your WP site and adding things. You want to know how to stop them. Well, there is nothing in what you've posted that would help figure out what's happening or how they are getting in.
    – schroeder
    May 11 at 12:41
  • Change your WP passwords and your Google Search admin passwords. Enable 2FA.
    – schroeder
    May 11 at 12:42


Browse other questions tagged or ask your own question.