{"slug": "the-ai-summary-said-it-s-not-a-scam-the-springboard-was-your-site-s-search-box", "title": "The AI Summary Said \"It's Not a Scam.\" The Springboard Was Your Site's Search Box", "summary": "A developer warns that AI search summaries can be manipulated by attackers who plant fake claims on legitimate websites via site-search spam. The attack exploits indexed search result pages on trusted domains, causing AI overviews to repeat false statements like 'XX is not a scam.' The developer recommends immediate defenses such as noindex tags and 404-on-zero-hits to prevent sites from being used as springboards for AI-generated misinformation.", "body_md": "Last August, a man planning a cruise googled Royal Caribbean's customer service number. Google's AI Overview served him a phone number at the top of the results. He called it, handed over his card details, and the number belonged to scammers. Similar cases hit Southwest Airlines searches. That variant, fake support numbers planted where AI summaries would pick them up, got plenty of coverage.\n\nLast week, Japan's Metropolitan Police announced a quieter variant that I think deserves more attention from developers, because the attack surface sits on legitimate sites: the search box. Possibly the one on yours.\n\nHere's the scene the police described: someone gets invited into an investment group on social media. Before sending money, they do the sensible thing and search the group's name. The results show \"XX is not a scam\" and \"I made money with XX.\" The AI summary at the top of the page agrees: \"XX is not a scam.\" Reassured, they transfer the money.\n\nThe victim's verification habit -- \"let me search before I trust this\" -- has been folded into the trap.\n\nWhen I read the report, my first question was: how? I work on LLMO (optimizing sites to get cited by AI search) day to day, so I suspected one of the search-pollution techniques floating around SEO circles. The trail led to something older and dumber than I expected: site-search spam, documented by the Japanese SEO firm JADE back in February 2023.\n\nThis post covers the mechanism, why AI summaries repeat the lie, and the defenses you can ship this week (noindex, `X-Robots-Tag`\n\n, 404-on-zero-hits).\n\nMost sites with a search box return results at a URL like `/search?q=keyword`\n\n. Two properties of a typical implementation set up the attack:\n\n`<title>`\n\nor `<h1>`\n\n(\"Search results for 'keyword' | Acme Corp\")The attack:\n\n`acme.com/search?q=XX+is+not+a+scam`\n\n. No need to touch the search box. The URL alone does the job.The victimized site was never breached. No malware, no intrusion, no tools. The attacker built a URL and placed a link. When I first understood this, I said \"wait, that's it?\" out loud. What's being exploited is not a vulnerability. It's a spec.\n\nTo the person searching, it looks like Acme Corp's website says \"not a scam.\" The trust the domain spent years earning gets subleased to a stranger's sentence.\n\nAI Overviews and similar features are structurally close to RAG: retrieve pages relevant to the query from the search index, then compose an answer from them. The internals aren't public, but the dependency is observable: the summary is built downstream of the index.\n\nThe AI has no way to smell the setup. What it retrieved is, as far as it can tell, text on a trusted domain. It doesn't verify claims; it weighs source authority and cross-source agreement. So if an attacker seeds the same sentence into search URLs on several reputable domains, the AI sees multiple independent authoritative sources agreeing.\n\nThat's the ugly part: the more seriously an AI weights authority signals, the better this attack works on it. The diligent ones are the easiest marks.\n\nThe pipeline is simple: search index upstream, AI summary downstream. Poison the upstream and the downstream poisons itself. You could wait for AI vendors to filter better (Google said it \"took action\" on the fake phone numbers; new ones kept popping up), or you could close the reflection surface on your own site, which is faster and actually under your control.\n\nCan your site be used as a springboard? Three checks:\n\n```\n# 1. Are your search result pages indexed? (in Google)\nsite:example.com inurl:search\nsite:example.com inurl:\"?s=\"\n\n# 2. Indexed under suspicious phrases?\nsite:example.com scam\nsite:example.com refund\n# 3. Do your search result pages carry noindex?\ncurl -sI \"https://example.com/search?q=test\" | grep -i x-robots-tag\n\n# No header? Check the HTML meta tag\ncurl -s \"https://example.com/search?q=test\" | grep -i '<meta name=\"robots\"'\n```\n\n`site:`\n\nqueries are a quick smoke test; Google doesn't guarantee exhaustive results. For a definitive answer, open Search Console and check Indexing > Pages and Performance > Pages for URLs containing `/search`\n\nor `?s=`\n\n.\n\nAlso look at your search results template: does it reflect the query into `<title>`\n\nor `<h1>`\n\n? Reflection plus indexability is the combination that makes you a target.\n\nOne reassurance: client-side search (JS filtering in the browser, common on static sites) doesn't have this attack surface at all, because the server never returns different HTML per query.\n\nTwo viable strategies, based on JADE's recommendations:\n\n| Measure | Effect | Caveat |\n|---|---|---|\n`<meta name=\"robots\" content=\"noindex\">` |\nReliably keeps result pages out of the index | Neutralized if robots.txt blocks the page |\n`X-Robots-Tag: noindex` header |\nSame, applied at infra level without touching templates | Same caveat |\n| noindex (or 404) on zero-hit queries | Keeps search-page SEO traffic while blocking spam | 404 can hurt UX for legitimate zero-hit queries |\n`robots.txt` `Disallow: /search`\n|\nSuppresses crawling | Incomplete alone -- blocked URLs can still get indexed via external links |\n\nChoosing is simple:\n\nThere is one trap worth internalizing: **noindex only works if the crawler can read the page.** Block the URL in robots.txt and the crawler never sees your noindex, which un-neutralizes the whole defense. Google's docs state it outright: for noindex to be effective, the page must not be blocked by robots.txt. Never combine the two on the same URL.\n\nImplementation examples.\n\nWordPress search pages (`?s=`\n\n) get noindex by default if you run Yoast or similar. On a bare theme, use the `wp_robots`\n\nfilter (WordPress 5.7+, plays nicely with core and plugin output):\n\n```\n// functions.php\nadd_filter('wp_robots', function ($robots) {\n    if (is_search()) {\n        $robots['noindex'] = true;\n    }\n    return $robots;\n});\n```\n\nNext.js (App Router):\n\n``` js\n// app/search/page.tsx\nexport const metadata = {\n  robots: { index: false, follow: true },\n};\n```\n\nAt the infra layer, nginx. Two gotchas in this snippet: it matches path-style search URLs (`/search`\n\n), not query-style (`?s=`\n\n); for those you'd branch on `$arg_s`\n\ninstead. And nginx's `add_header`\n\nhas inheritance rules that bite: a single `add_header`\n\ninside a location cancels all headers defined at upper levels, so re-declare your security headers there.\n\n```\nlocation /search {\n    add_header X-Robots-Tag \"noindex\" always;\n    # re-declare upper-level add_header lines (security headers etc.) here\n    proxy_pass http://app;\n}\n```\n\nEven setting the scam angle aside, noindexing search result pages is standard SEO hygiene: it prevents duplicate-content bloat and crawl budget waste. This is a good excuse to finally do it.\n\nIf you run a site, try `site:yourdomain inurl:search`\n\ntoday. If anything comes back, the defense section above is your afternoon. Is your search box carrying someone's \"it's not a scam\"?", "url": "https://wpnews.pro/news/the-ai-summary-said-it-s-not-a-scam-the-springboard-was-your-site-s-search-box", "canonical_source": "https://dev.to/kenimo49/the-ai-summary-said-its-not-a-scam-the-springboard-was-your-sites-search-box-3iao", "published_at": "2026-07-28 01:28:17+00:00", "updated_at": "2026-07-28 02:01:17.352389+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-products", "developer-tools"], "entities": ["Royal Caribbean", "Southwest Airlines", "Google", "JADE"], "alternates": {"html": "https://wpnews.pro/news/the-ai-summary-said-it-s-not-a-scam-the-springboard-was-your-site-s-search-box", "markdown": "https://wpnews.pro/news/the-ai-summary-said-it-s-not-a-scam-the-springboard-was-your-site-s-search-box.md", "text": "https://wpnews.pro/news/the-ai-summary-said-it-s-not-a-scam-the-springboard-was-your-site-s-search-box.txt", "jsonld": "https://wpnews.pro/news/the-ai-summary-said-it-s-not-a-scam-the-springboard-was-your-site-s-search-box.jsonld"}}