A Visitor Clicking Your Own Work Was Landing on a Template Marketplace
Following last week's cleanup of placeholder text, this is the finding from the same pass that actually mattered. Two designs in the catalog were publishing the theme author's affiliate links on live actor websites.
What was happening
One design carried three outbound links with a referral tag on them. One of those was wrapped around a portfolio thumbnail. A visitor clicking on an actor's own work landed on the theme vendor's marketplace listing, and the vendor was credited for the referral.
The same design credited its author in the footer and attributed one of the testimonials on the page to a person at the theme marketplace. A second design carried a referral tag of its own.
Why this is worse than lorem ipsum
Placeholder text makes a site look unfinished. This is different in kind. It takes traffic that arrived for the actor, sends it somewhere else, and monetizes it for a third party the actor has never heard of. It also puts a link from a professional portfolio to a template shop, which tells anybody who follows it exactly how the site was made.
None of it was visible from the admin. There is no screen in any website builder that says "this design links out to its author". You would only find it by reading the design's source, or by clicking your own thumbnails and watching where you end up.
What was changed
- Every referral link stripped, keeping the anchor text where there was any, so no wording disappeared from the page.
- The vendor credit in the footer now renders your name.
- The testimonial attributed to the marketplace now renders your account's own name.
- Six fake email addresses across six designs are now bound to your contact address, encoded so scrapers get less out of them, and guarded so nothing renders at all when you have not set one.
- A hardcoded street address and a Skype handle removed. Neither had a source on the platform, so binding them was not an option.
The general lesson
A purchased theme is somebody else's code running on your website, and it is written to serve the person who sold it. That is not usually malicious, and here it was not: the affiliate tag was in the demo the theme shipped with, and every buyer who did not strip it published it. It is simply what happens when nobody reads a design end to end.
Which is now something we do, automatically, on every design. That check is the subject of the next article.
Related: brand identity, and a professional email address. New here? Create a free actor website.
