Simple capitalization hack let anyone erase sites from Google Search

Google has fixed a vulnerability in its public Remove Outdated Content tool that allowed anyone to scrub active webpages from Search results. The issue came to light after the Freedom of the Press Foundation documented repeated takedowns of a U.S. reporter’s work; Google confirmed the repair in June 2024.

What happened

The tool accepts URLs that no longer exist or contain content that has been removed. Attackers discovered that submitting the same address with altered capitalization triggered a 404 error, convincing Google to deindex every version of the page.

The Foundation’s report says more than 400 articles disappeared from Search between 2023 and early 2024, each removal logged as “Approved” inside Google Search Console.

Timeline

18 April 2024 - Google Search Liaison Danny Sullivan acknowledged the bug in a Search Console Help thread.
Before 7 June 2024 - Google deployed a fix and restored all affected URLs.
7 June 2024 - Freedom of the Press Foundation published its findings; Google said only a “tiny fraction” of sites were hit.

Why it matters

Because the Remove Outdated Content tool requires no login, anyone could target a competitor, critic, or journalist. The flaw exposed how case sensitivity in URL handling can bypass ownership checks, creating a new vector for censorship or reputation attacks.

Mitigation for publishers

Implement server-side redirects to force mixed-case requests to lowercase, preventing false 404 responses.
Monitor Google Search Console for unexpected “Approved” removals of live content.
Use the authenticated URL removal options in Search Console, which verify site ownership, instead of the public tool.

Outlook

Google says no further action is needed for sites previously affected, but the episode highlights the need for tighter validation on public removal forms. Publishers may see a brief traffic rebound as reinstated pages regain their search positions.

Sources

Freedom of the Press Foundation, 7 June 2024 - Full report
Google Search Console Help Community, 18 April 2024 - Thread acknowledging the bug
Email statement from Google to Freedom of the Press Foundation, quoted 7 June 2024.