/webmasters/community?hl=en
/webmasters/community?hl=en
6/18/15
Original Poster
Jeffrey R. Gentner, EA

message type [WNC-582900]. Unauthorized owner has gotten verification - HOW?

I received an email today that says:

Google has identified that Hugoh...@gmail.com has been added as an owner of Search Console account for http://www.xxxxx.org/.

Search Console owners have the power to change critical settings that influence the way Google Search interacts with your site or app. Be sure that only relevant people have this access, and that they are removed when they no longer need this access.


I do not know this person and the html file that was used for verification is NOT on my web site source details and it cannot be found by my web site host.

How can this happen and how do I get rid of this hacker?
Community content may not be verified or up-to-date. Learn more.
All Replies (17)
Matt Storms
6/18/15
Matt Storms
In the dashboard when you open GWT's do you see something like this:

If you do not have the ability to add or remove users then you need to have access to the master account the site was added to first. Then you can delete the users you do not want. Then you can delete the offending user. 


6/18/15
Original Poster
Jeffrey R. Gentner, EA
This is an OWNER added - not a user.  I get a message that the OWNER cannot be removed because the file used to verify the owner needs to be removed from the web site.  I have been on the phone with my web host and the file is NOT on my web site!
travler.
6/18/15
travler.
The verification method used by the 'new owner' is for sure an HTML file and not a meta tag?

You can check verification method used for that owner.

Try the steps at  https://support.google.com/webmasters/answer/2454036?hl=en The verification token must be there or you'd be able to remove the owner/ user.

To completely remove an owner and block access to Search Console, follow the steps below. In addition, you must also remove the verification token (for example, meta tag, HTML file, or DNS record) originally used to verify this account. If this account was verified using a Google Analytics tracking code, you should make sure that the user you want to unverify is no longer an administrator on the Analytics account. Otherwise, removal may not be permanent.
    1. On the Search Console home page, click Manage next to the site you want, and then clickAdd or remove users.
    2. Click the Manage site owners link.
    3. In the Verified owners section, click Unverify next to the owner you want to remove
See permissions, too:



6/19/15
Original Poster
Jeffrey R. Gentner, EA
Here is what the verification said:  

Meta tags, verification files, or DNS records are associated with this email address. To unverify this owner, you must remove the following from your site:

I cannot unverify it.  every time I try it says:  We weren't able to unverify hugoh...@gmail.com. Verification file still exists.

iiII have contacted my web host and they tell me that there is no such HTML file on my web site.  If this is so, why can't I unverify this hacker?

travler.
6/19/15
travler.
Don't have your website to check that file.

It's in the root folder. If it were NOT in the root folder then it would unverify.

It may be hidden - tabbed many times to the right, etc so it cannot easily be found.

Generally the root folder is public_html directory. But just confirm this with your host. Also, you should be able to access this file as (for example)

domain.com/google11e5844324b7354e.html

6/19/15
Original Poster
Jeffrey R. Gentner, EA
OK - I am going to try and keep this simple.

1)  I got an email this morning stating what was in my original post. (see above)

2) I am the ONLY owner of this web site, but somehow someone was able to get verified from Google using the html file mentioned in my earlier post. (above)

3) I have worked all day with the web site host and the FILE IS NOT found anywhere on my web site.

4) I cannot unverify this hacker - Google keeps giving me the message the the "Verification File Still Exists"  --- BUT IT DOES NOT.

5) According to my web host - the problem is on GOOGLE's side - how come I cannot unverify when I know there is NO FILE on my web site???

6)  Can someone please help me get rid of this hacker???

Thanks.
redleg -
6/19/15
redleg -
Well, that is very intriguing, when you posted the filename of the verification file above that is a live link and when I click it the link responds with an HTTP status code of 200 Success and returns  a valid verification file.  Typically if a URL does not exist on a site the site responds with a HTTP status code of 404 File not found.
StevieD_Web
6/19/15
StevieD_Web
what is your url?
StevieD_Web
6/19/15
StevieD_Web
I am assuming your site is 


where xx is a different letter of the alphabet

And this page 


Generates a 200 Found response on your site.

BTSOM just got a 200 response as well.

That is two of us.  Your host is an idiot and incompetent if they can't find the file on your server.


redleg -
6/19/15
redleg -
Check for a file named .htaccess in the root directory of the site and check the content of the file.  Typically the reason hackers try to verify ownership is so they can intercept/delete any warning messages Google might be trying to send the real site owner regards say something like a spam hack.  It would be prudent to try a couple of site: operator queries with common spam terms to check.  I would try something like

site:xxxxx.org (longchamp|prada|hermes|mulberry|moncler|"michael kors")

where xxxx.org is your actual domain  (no spaces between the site:  and your domain)  and see if you get any unexpected results.
6 MORE
Google user
7/1/15
Google user
Were these replies helpful?
How can we improve them?
 
This question is locked and replying has been disabled. Still have questions? Ask the Help Community.

Badges

Some community members might have badges that indicate their identity or level of participation in a community.

 
Google Employee — Google product team members and community managers
 
Community Specialist — Google partners who help ensure the quality of community content
 
Platinum Product Expert — Community members with advanced product knowledge who help other Google users and Product Experts
 
Gold Product Expert — Community members with in-depth product knowledge who help other Google users by answering questions
 
Silver Product Expert — Community members with intermediate product knowledge who help other Google users by answering questions
 
Product Expert Alumni — Former Product Experts who are no longer members of the program
Community content may not be verified or up-to-date. Learn more.

Levels

Member levels indicate a user's level of participation in a forum. The greater the participation, the higher the level. Everyone starts at level 1 and can rise to level 10. These activities can increase your level in a forum:

  • Post an answer.
  • Having your answer selected as the best answer.
  • Having your post rated as helpful.
  • Vote up a post.
  • Correctly mark a topic or post as abuse.

Having a post marked and removed as abuse will slow a user's advance in levels.

View profile in forum?

To view this member's profile, you need to leave the current Help page.

Report abuse in forum?

This comment originated in the Google Product Forum. To report abuse, you need to leave the current Help page.

Reply in forum?

This comment originated in the Google Product Forum. To reply, you need to leave the current Help page.

false
Search
Clear search
Close search
Google apps
Main menu
Search Help Center
true
83844
false