Strange Links Appearing in Your Articles? Check AdSense Ad Intents Before Assuming Malware

A client recently showed me ordinary words inside published articles turning into unfamiliar links, with related-topic chips appearing underneath. It looked like the sort of spam injection that often follows a compromised WordPress plugin. The links were not in the posts, though, and the raw page response was clean. Google AdSense was adding them in the browser.

The feature is called Ad intents. Google describes it as an intent-driven Auto ads format that can place links, anchors, and chips into existing text and pages. When a visitor interacts with one, it opens a dialog containing relevant results and ads. That can be legitimate monetisation, but it can also look alarming when nobody working on the website expects editorial text to change.

The quickest way to tell what you are looking at

Do not start deleting plugins or restoring backups because a screenshot looks suspicious. First work out which layer created the link.

1. Check the saved article. Open the post in the CMS or query it through the platform API. Search for the linked phrase and destination. If the link exists in the saved content, it came from an editor, importer, plugin, or database change.
2. Check the raw HTTP response. Use “View Source” or fetch the page without executing JavaScript. If the article text is present but the unexpected link is absent, something is modifying the page after load.
3. Inspect the live DOM. Browser developer tools show the document after scripts have run. Ad intent links commonly appear in generated elements such as google-anno, while the associated links or chips lead into a Google-rendered dialog rather than to an unknown publisher domain.
4. Temporarily block the advertising script. Re-test in a clean browser with the AdSense script blocked. If the links disappear while the article remains intact, you have isolated the responsible layer without changing production.

That difference between stored content, raw HTML, and the live DOM is the key. A database injection normally survives in the first two. A client-side advertising format can exist only in the third.

What Ad intents can add

Google's AdSense documentation says the format scans pages for opportunities related to the content. Depending on the enabled options and page, it may add:

• links around words or phrases inside body copy;
• anchors placed around the page;
• chips showing related terms below paragraphs;
• a dismissible dialog with organic results and ads after a visitor clicks.

Google also documents ad intent links and ad intent chips separately. The exact treatment can vary because the links are generated dynamically from the page text. That is why one editor may not see the same additions another person captured.

How to disable Ad intents without removing ordinary ads

If the format does not suit the site's editorial experience, turn off that format rather than removing AdSense entirely:

1. Open AdSense and go to Ads.
2. Choose the site and edit its Auto ads settings.
3. Open Intent-driven formats.
4. Disable Ad intents, or disable only the individual link, anchor, or chip options you do not want.
5. Apply the change and allow time for the new configuration to propagate.

Google's current Auto ads settings guide is the best place to confirm the labels because dashboard wording can change. After saving, check several affected articles in a fresh session. Cached scripts or an already-open tab can otherwise make a correct change look ineffective.

When you should still investigate a compromise

Finding Ad intents explains only links that match this behaviour. Continue with a proper integrity check if any of these are true:

• the spam exists in the CMS, database, REST API, or raw HTML;
• links point directly to unrelated third-party domains without a Google dialog;
• the page contains unfamiliar server-side scripts, administrators, plugins, or scheduled tasks;
• search engines receive different content from ordinary visitors;
• the additions remain after Ad intents is disabled and the browser cache is cleared.

For WordPress, I would then compare core and plugin files against known checksums, review privileged users, inspect recently changed PHP and JavaScript, and check whether the database contains the injected fragments. Those are evidence-gathering steps, not reasons to reinstall the site blindly.

The broader lesson

A strange link on a page is a symptom, not a diagnosis. The reliable sequence is to compare the stored content, server response, and post-JavaScript DOM, then disable one suspected layer at a time. In this case, that approach separates an unexpected advertising feature from a security incident quickly and avoids a destructive cleanup for malware that was never there.

If a website is changing in ways nobody can explain, I can trace the responsible layer and make the smallest safe fix before the situation turns into guesswork.