Website Audit | Non-profit | GTA
How We Found 3-Year-Old Spam Links Hiding on a Non-Profit’s Website
A GTA non-profit working on food security asked us for an independent review of its website. It was already paying a web agency every month to look after the site. Our audit found hidden links to Viagra spam pages that had been sitting on the site for about three years.
Findings from our backend audit of the site, September 2026. The board had been told only two staff accounts had admin access.
The Challenge
The board had decided to become independent of its web vendor. Before switching, it wanted the plain truth about its website: who has access, what is installed, and what risks it carries. Nobody inside the organization could answer those questions with confidence.
What We Did
We gave the board an independent, written picture of its website:
- Reviewed the theme, plugins, users, software versions, backups and security settings
- Found hidden spam links that had been on the site for about three years
- Listed every admin account and who it belonged to: 8 in total, 5 held by outside vendors
- Wrote an ownership and access plan so every account stays in the non-profit’s own name
- Explained hosting options in plain English, with costs, so the board could decide
The Result
For the first time, the board had a clear, written view of its website: what was wrong, who had access, and what to fix first. The spam links and unknown accounts were flagged with a step-by-step plan to clean them up.
Why It Matters for You
Paying for website maintenance is not the same as having someone check your site. If nobody has reviewed your admin accounts or hidden links lately, a second set of eyes can save your reputation with donors, partners and search engines.
Common Questions
How do spam links end up on a website?
Usually through an outdated plugin or theme, or a weak login. Attackers add hidden links that visitors can’t see but search engines can. They can sit there for years and hurt your reputation and rankings.
How can I check my site for hidden spam links?
Search Google for site:yourdomain.com plus words like viagra or casino. Check the Security Issues report in Google Search Console. If you find anything, ask your web team for a full scan.
Who should own our website accounts?
Your organization should. Keep the domain, hosting and admin logins in the organization’s name and email, review admin accounts every few months, and remove anyone who no longer needs access.
Services behind these results
Talk to Kumar
This isn’t a sales call. It’s a 20-minute strategy session where Kumar personally walks you through exactly where your search visibility is leaking and what it would realistically take to fix it.
No automated PDF. No pitch deck. No junior account rep. Just Kumar, your numbers and goals.
No shortcuts. No black-hat. Clear monthly updates.