Security finding
The site links to, or loads a script from, a domain that lapsed or changed hands
Security Error Severity: High
Part of the audit Outbound link safety. Finding id: security.outboundDomainLapsed.
What it costs you
Whoever registers a lapsed domain decides what your link shows. For a script it is worse: the new owner's code runs on your pages, with access to everything a visitor types there.
What to do
Remove the script tag now. Replace or remove the links.
What it checks
- Link to an expired or resold domain
- Script loaded from an abandoned domain
How to fix it
Remove the script from the lapsed domain
- Delete the tag that loads [target]. A tag that repeats on every page sits in a template or in the tag manager.
- If the site still needs the library, download a known good copy and serve it yourself.
How to check: Recrawl: nothing on the site loads a script from [group key].
Replace or remove the link
- Point the link at the content's new home or at an archived copy, or remove it.
- A link that repeats on every page sits in a template; fix it there.
How to check: Recrawl: nothing on the site refers to [group key].
A real case
After the polyfill.io domain was bought by a new owner in February 2024, the script it served was changed to send visitors to other sites, on more than 100,000 websites that still loaded it.