The short answer
How do you vet a publisher for security relevance before placing a link?
Run five gates and reject the publisher if any one fails: the page is indexed and visible, it covers your subject, editorial standards are visible, sponsored content is labelled, and there is no link-farm footprint. Then count supporting signals. The gates matter because decay starts with the publisher: in Ahrefs' link rot study (2022), 47.7% of the links counted as lost sat on pages that had been dropped from its index.
Why does publisher relevance matter in security?
Security content has operational consequences: a wrong claim can lead to a broken defence or an unpatched system. Buyers and search engines both judge who links to you. A placement on an unrelated or low-standard site wastes budget, and it associates your brand with sites running link-farm patterns. Our note on link risk screening lists the patterns, and algorithmic demotion explains why such links lose value.
What are the five gates?
| Gate | What to check | Reject if |
|---|---|---|
| 1. Indexed and visible | The page and the site appear in search and rank for something | The page is not indexed, or the site has lost its organic visibility |
| 2. On topic | The page shares at least two of five layers with yours: threat, technology, sector, framework, role (see niche relevance) | The site mixes security with unrelated categories such as gambling or retail |
| 3. Editorial standards visible | Named authors with checkable backgrounds, an editorial policy, and corrections handled openly (editorial standards) | No bylines, no policy, or anonymous contributors |
| 4. Commercial content labelled | Sponsored or paid posts are marked, and links carry rel=“sponsored” or rel=“nofollow” where required | Paid placements pass as editorial |
| 5. No link-farm footprint | The site does not invite posts on any topic, does not repeat the same anchors, and does not publish at implausible volume | It accepts anything for a fee, or you find other sites’ paid links in its pages |
Google’s spam policies (2026b) list buying or selling links for ranking purposes as link spam, and say sponsorship links are acceptable when they carry rel=“nofollow” or rel=“sponsored”. Gates 4 and 5 are built on that.
What supporting signals should you count?
Once a publisher passes all five gates, count these:
- Real organic traffic, checked in a third-party tool and trending flat or up.
- A recent publishing history on your subject, so your piece does not sit alone.
- Technical depth: readers can verify claims, sources are named, and nothing is published that could help an attacker.
- A clean metrics history: no sudden jumps that look manufactured.
- Editorial independence: the publisher can decline your piece.
Our rule of thumb: accept at three or more, and look elsewhere below that. Claim strength: opinion.
Publisher vetting scorecard
Tick what is true for the specific publisher and page. Your ticks are saved in this browser only.
Text version of the scorecard. Gates: indexed and visible; on topic (two of five layers or more); editorial standards visible; commercial content labelled; no link-farm footprint. If any gate fails, reject. If all five pass, count the five supporting signals: three or more, accept; fewer than three, look elsewhere. The thresholds are our rule of thumb and the scorecard saves your ticks in your browser only.
What should you ask the publisher?
- Who edits this? A named editor or an editorial process.
- How do you label sponsored content? Ask which attributes the link will carry.
- What happens if the article is updated or removed? Some publishers charge for removal, which creates a durability risk. Information Security Buzz charges $100 to take an article down after publication (Information Security Buzz, 2024).
- What are your submission rules? Compare with the audit in Top Security Blogs. Rules about vendors vary widely.
What are the warning signs of a bad publisher?
- Mass unsolicited invitations to submit on any topic, often for a fee.
- Very fast publication with no editorial review. We give no fixed number of hours, since any threshold would be our opinion.
- Unrelated categories on the same site.
- Heavy sponsored footprints: many pages with paid links and the same style of anchor.
- No author profiles or authors who cannot be found elsewhere.
- Declining traffic with no editorial reason, which can signal a penalty.
How do you keep the placement healthy?
Check each placement at 90, 180 and 365 days for status, indexation and link attributes, and record the result for the next publisher decision. Our cohort method covers it, and the site qualification checklist is the working document.
Key takeaways
- Vet the specific page and the publisher, not the domain rating alone. DR is a filter, not the verdict.
- Five gates decide yes or no. Failing any one is a reject, whatever the DR.
- Security carries operational risk: a publisher that prints careless technical claims puts your credibility at risk, and your link sits next to them.
- A publisher's own rules tell you what to expect. In our audit of seven security publications, the stricter ones ban vendor promotion, and one excludes vendor-affiliated contributors altogether (see Top Security Blogs Accepting Guest Posts).
- Ask about removal and update terms. One publication we read charges a fee to take an article down.
- No vetting method guarantees a ranking or a citation. It reduces waste and risk.
References
- Ahrefs (2022) 'At least 66.5% of links to sites in the last 9 years are dead', Ahrefs Blog, 29 April (updated 2 February 2024). Available at: https://ahrefs.com/blog/link-rot-study/ (Accessed: 20 October 2026).
- Google (2026b) 'Spam policies for Google web search', Google Search Central, last updated 28 August. Available at: https://developers.google.com/search/docs/essentials/spam-policies (Accessed: 20 October 2026).
- Information Security Buzz (2024) 'Write for Information Security Buzz', Information Security Buzz, last modified 24 September. Available at: https://informationsecuritybuzz.com/write-for-information-security-buzz/ (Accessed: 20 October 2026).
