Lately, when we review a prospect's website, we keep finding the same thing at the very bottom of the page: a small link back to the company that built it. Sometimes it's a friendly "Website by" credit. Sometimes it's a keyword-packed link in tiny gray text. And sometimes it's hidden so well that the business owner has no idea it's there.
On its own, a footer link is a small thing. But it's often a sign of something bigger: a website that was set up to benefit the people who built it, not just the business that paid for it.
Your website is one of your most valuable marketing assets. It should work for you. Here's what to look for to make sure it does, starting with that footer.
The footer link: harmless credit or free backlink?
Let's be fair up front. Designer credits have been around as long as websites have. A visible "Website by Company Name" line, added with the client's knowledge, is common and generally harmless. Many businesses are happy to give their developer a nod.
The problem is how some of these links are placed and why. Every site a developer builds can become one more backlink pointing to their own website. Multiply that by dozens or hundreds of client sites, and some developers see it as a free link-building program, paid for by their clients' websites.
That's where it crosses the line. Watch for links that are:
- Hidden. Text styled to be invisible: the same color as the background, shrunk to a tiny font, or tucked behind other elements.
- Keyword-stuffed. Instead of the company name, the link reads something like "Best Web Design Company Near Me" or "Affordable SEO Services." That's an attempt to rank for those terms, not to give credit.
- Added without permission. The client never agreed to it and doesn't know it's there.
- Passing ranking value. The link isn't marked with a
nofolloworsponsoredtag, so it's meant to pass SEO credit to the developer.
What Google says
Google's spam policies define link spam as links created mainly to manipulate search rankings. Their list of examples specifically includes widely distributed links in the footers or templates of various sites, and hidden or keyword-rich links embedded across many sites.
Google also says these links are fine when they carry a [rel="nofollow"] or [rel="sponsored"] attribute. In other words, a properly tagged credit link is not a problem. An untagged, keyword-heavy, or hidden one is.
Why it matters to you
In practice, Google mostly ignores or discounts these links, so the developer usually gets little benefit. The bigger risk sits with you:
Hidden links and text violate Google's spam policies on their own, and that's a mark against your site, not the developer's.
Outbound links on every page to a business you don't control add clutter and send visitors away from your site.
It's a trust issue. If someone added links to your site without telling you, it's fair to ask what else was set up for their benefit instead of yours.
How to check your own site in five minutes
You don't need to be a developer to spot most of these links. Try this:
- Scroll to the bottom of your homepage and a few inner pages. Look for any credit line, logo, or link to a company that isn't yours.
- Select all the text in the footer (click and drag, or press Ctrl+A / Cmd+A). Hidden text often shows up once it's highlighted.
- View the page source. Right-click the page and choose "View Page Source," then press Ctrl+F / Cmd+F and search for
href. Look for links pointing to domains you don't recognize, especially near the bottom of the code. - Look for hiding tricks near those links, such as [
display:none,visibility:hidden,font-size:0]or a text color that matches the background. - Check the link's tags. A legitimate credit link should include [
rel="nofollow"]or [rel="sponsored"]. If it doesn't, it's set up to pass ranking value.
For a deeper look, SEO crawling tools like Screaming Frog can list every outbound link on your site. If you find something you didn't approve, ask your developer to remove it or tag it properly. If you no longer work with them, any qualified web professional can take it out.
The bigger issue: who actually owns your website?
A sneaky footer link is annoying. Losing control of your website is far worse. When we look closer at sites with questionable links, we often find ownership problems too. These are the ones that hurt most when you try to switch providers.
Your domain is registered in the agency's name. If the domain belongs to them, so does your web address, your email, and years of search history. Getting it back can mean weeks of back-and-forth, or worse.
Hosting is in their account. Fine while things are good. But if the relationship ends badly, your site could go offline or be held until you pay.
Analytics and Search Console belong to them. If Google Analytics or Google Search Console was set up under the agency's account, years of data about your customers and traffic may not leave with you.
They own your Google Business Profile. Your profile drives calls, directions, and reviews. You should be the primary owner, with your agency added as a manager.
Ad accounts are in their name. Google Ads and Meta ad accounts hold your campaign history and audiences. You should own them and grant access, not the other way around.
You don't have an admin login. If you can't get into your own site without calling someone, you don't really control it.
Theme and plugin licenses are under their account. When the agency's license lapses or they cancel it, your site stops getting updates and security patches.
It's built on a proprietary platform. Some agencies build on their own in-house system. It may work fine, but you often can't take the site with you if you leave.
None of these are automatically signs of bad intent. Plenty of agencies set things up in their own accounts simply because it's faster. But you should know where everything lives and have the access to take it with you.
What else might be hiding in your code
Footer links aren't the only things developers leave behind. A few more to watch for:
- Old tracking scripts. Analytics tags or ad pixels from a previous agency may still be collecting data from your visitors. That slows your site down and can raise privacy concerns if you don't know where that data goes.
- Pirated ("nulled") themes or plugins. Some developers cut costs with cracked versions of paid software. These are a well-known source of malware and injected spam links, and they never get security updates.
- The agency's name in your metadata. Look for their name in the author or generator tags, or in your site's structured data (schema), where your business name should be.
- Staging sites left open to Google. Test copies of your site, often on the agency's own domain, sometimes get indexed. That creates duplicate content that competes with your real site.
- Outdated software. A site that was built and never maintained can fall years behind on updates, leaving security holes open.
Read the fine print
Many of these issues trace back to the original contract. Before you sign with a web provider (or the next time you renew), look for:
- A clear ownership clause. The contract should state that you own the website, its content, the domain, and all related accounts once you've paid.
- Credit-link terms. If the agency wants a footer credit, it should be spelled out, and you should be able to say no.
- Handoff terms. What happens if you part ways? You should get your files, logins, and accounts transferred without extra fees or delays.
- Licensing details. Find out which themes, plugins, fonts, and images are licensed, and whose name those licenses are in.
If a provider pushes back on any of these, that tells you something.
Your website ownership checklist
Use this quick checklist to see where you stand:
[ ] My domain is registered in my business's name, and I have the registrar login.
[ ] I have access to my hosting account, or know exactly who manages it.
[ ] I have an administrator login to my website.
[ ] I'm an owner (not just a user) of Google Analytics and Google Search Console.
[ ] I'm the primary owner of my Google Business Profile.
[ ] My ad accounts are in my business's name.
[ ] I know which themes and plugins are licensed, and the licenses are mine.
[ ] There are no hidden or keyword-stuffed links in my footer.
[ ] Any credit link was approved by me and tagged nofollow or sponsored.
[ ] There are no old tracking scripts from past vendors on my site.
[ ] My contract says I own my website and all related accounts.
If you couldn't check every box, don't panic. Most of these are easy to fix once you know about them.
How we handle it at Bonafide
We believe your website should work for you, full stop. That's why:
You own everything we build. Your domain, hosting, analytics, and accounts are set up in your name, and we're added as a user.
We never add hidden links. We don't add credit links to client sites at all.
You always have the keys. You get admin access to your site and every account tied to it.
Leaving is easy. If we ever part ways, we'll hand over everything you need.
Not sure what's on your site?
We're happy to take a look. Contact us for a free website ownership review, and we'll tell you exactly what we find, including any hidden links, account access issues, or leftover code. No pressure, and no strings attached.
