Search Integrity
SEO incident monitoring Catch a hack before it costs you rankings and revenue.
Search Integrity in QueryRev AI watches every verified site for the incidents that cost search presence: injected spam pages, a malware flag in Google, an expiring certificate or domain, a rogue noindex or redirect. Each one becomes a Protect decision with its evidence, the revenue at risk, a playbook and a verified recovery.
A case, start to finish
A sample outdoor shop is hit by a Japanese keyword hack: spam pages appear under its domain overnight. Follow the incident in four steps: what was detected, what is at stake, the governed response, and the check that closes it.
QueryRev does not clean servers. The playbook tells your developer or host what to remove, and QueryRev carries out only the changes your emergency policies allow, each one in the Change Ledger.
What it gives you
An alert says something happened. A Protect decision says what happened, what it puts at risk, what to do next and how the recovery will be checked.
Evidence, not an alarm
Each incident opens with what was seen: the URLs, the queries, the diff of the page, the list entry. Duplicates collapse into one incident per root cause, so one hack is one decision, not forty alerts.
Revenue at Risk, labelled
What the affected pages earned is known, from Analytics 4 or your revenue source. What is at stake if their rankings fall is modeled and shown as a range. Revenue Intelligence never adds the two together.
Closed only when verified
An incident closes when the signal is gone on a fresh crawl and render, a Web Risk flag has cleared and the spam queries have left Search Console. The verification stays with the decision.
Three layers
Detect, respond, and shield where you choose.
Detection runs on every verified site. The response is governed by your policy. The shield is opt-in, site by site, and works through the edge you already run.
The layers advance by themselves while in view. Hover or focus to pause, or choose a layer.
Signals computed from your own data and public records. A model may explain a signal; it never decides that a site is hacked.
- Hack spam and cloaking · Spam pages, or one page for Google and another for people
- Injected links and scripts · Each page compared with its last known state
- Malware and phishing flags · Read from Google Web Risk every day
- Unexpected changes to protected pages · Changes not made through QueryRev
- A rogue noindex, robots.txt rule or redirect · Sabotage or an accident, caught the same way
- Certificate and domain expiry · Certificates from 30 days ahead, domains from 60
- Unexpected certificates for your domain · From Certificate Transparency logs
- Security headers on key templates · Advice, never an alarm
- Uptime of revenue pages · A light probe of the pages that earn
A playbook for every signal, and emergency policies you approve in advance. Every change QueryRev makes is in the Change Ledger.
- Roll a page back to its last good state · From the Change Ledger, under an emergency policy
- Remove an injected link · Under an emergency policy you approved
- Restore robots.txt, or remove a rogue noindex or redirect · Back to the last state in the ledger
- Pause QueryRev’s own changes on a compromised site · Automatic while a Critical hack signal is open
- Verify the recovery before the incident closes · Re-crawl, re-render, Web Risk and Search Console
No firewall of our own: QueryRev works through your own Cloudflare account, under your policy, and every change can be undone.
- Your Cloudflare, with your approval · Under Attack mode, managed WAF rules, country and network rules, AI crawler rules
- Payment-page scripts · An inventory, and an alert on any new or changed one
- Look-alike domains · Watched, with a takedown playbook
- An exposure check · A short, fixed list of commonly leaked files
For agencies
One hacked client can cost an agency the account. The portfolio view shows every client site by signal, and Critical and High incidents reach you in the app and by email at once.
The whole portfolio at a glance
Each client site against each signal, with the revenue at risk where an incident is open. A site you manage for a client is checked like your own, once it is verified.
Alerts that stay few
Signals with one root cause are one incident. A hack that injects a thousand pages is one Protect decision for the client, not a thousand rows.
A recovery you can show
The evidence, the response and the verified close are kept with the decision, ready for the client report. Agencies get one queue across every client workspace.
In the loop
Search Integrity is not a separate tool. Each incident runs through the QueryRev AI platform like any other work: Search Intelligence holds the baseline a hack is seen against, Revenue Intelligence says what is at stake, and the incident becomes a Protect decision in the same queue.
The response goes through governed execution: an emergency policy is a policy you approved in advance, and nothing changes on your site outside it. Verification decides when the incident is over, and the protected revenue it records is labelled modeled. It is priced inside the plans, by managed URLs, sites and client workspaces, never per check.
Standards
Built on the rules search engines and auditors use.
Google Search Essentials
Checks based on its spam policies: hacked content, cloaking and sneaky redirects.
Google Web Risk
Whether Google lists a page of your site for malware or phishing.
OWASP Secure Headers
Header checks on key templates, based on the project’s recommended headers.
PCI DSS v4.0.1 · 6.4.3 and 11.6.1
Evidence for the payment-page script reviews your assessor carries out.
Certificate Transparency · RDAP
Certificates issued for your domain, and its expiry or registrar changes.
Questions
Short answers first. Ask anything else at business@queryrev.com.
What is Search Integrity in QueryRev AI?
Search Integrity watches each verified site for the incidents that cost search presence and revenue: injected spam pages, a malware flag, an expiring certificate or domain, a rogue noindex. Each one becomes a Protect decision with its evidence, the revenue at risk, a playbook and a verification rule.
How does QueryRev detect that a site has been hacked?
From data, never from a model’s guess. Search Console is compared with the site’s own baseline, sitemap and crawl; pages are rendered as a search engine and as a person and compared; changes are checked against the Change Ledger; and Google Web Risk, DNS, TLS, RDAP and Certificate Transparency are read every day. The checks are passive and run only on sites you have verified.
Does QueryRev block attacks or clean malware?
No. QueryRev runs no firewall, CDN or bot network of its own, does not clean malware from servers and does not run active vulnerability scans. It detects incidents early, explains them, and guides or carries out a governed response. With the opt-in Cloudflare connector, it changes settings in your own Cloudflare account, with your approval.
What can QueryRev change on my site during an incident?
Only what your policy allows. Emergency policies you approve in advance can roll a page back to its last good state from the Change Ledger, remove an injected link or restore robots.txt, and each change is recorded with its before and after. While a Critical hack signal is open, QueryRev also pauses its own changes on that site.
Does QueryRev certify PCI DSS compliance?
No. QueryRev never certifies compliance of any kind. For a store that opts in, it keeps an inventory of the scripts on payment pages and alerts on any new or changed script or security header, at least every week. That record is evidence for the PCI DSS 6.4.3 and 11.6.1 reviews your assessor carries out.
How is the revenue at risk worked out?
What the affected pages earned is known, read from Analytics 4 or your revenue source. What is at stake if their rankings fall is modeled from that history and shown as a range. After a verified recovery, the protected revenue is recorded and labelled modeled. The kinds are never added together.
Keep exploring