3

I've been working on the site https://founderspledge.com/ and just noticed that if you go to the main page, and open the Chrome console to view the source, there's an element that I certainly didn't put there:

<div class="pub_300x250 pub_300x250m pub_728x90 text-ad textAd
 text_ad text_ads text-ads text-ad-links" style="position: absolute;">.</div>

It also doesn't show up when I run the site's code in localhost, or when I load the page source separately using Chrome's 'View Source' option.

I Googled the div's class list, and the top few hits were from anti-ad blocker software (eg https://github.com/sitexw/FuckAdBlock), which doesn't seem malign, but doesn't explain why it would be on this site.

How can I get rid of this element, and how might it have got there/does it imply there's a hole in the site's security?

Arepo
  • 133
  • 3
  • 2
    Hi, welcome to security.SE! Unfortunately, you are asking (at least) three questions: 1) Where did this element come from? 2) How can I get rid of it? and 3) Is there a security hole? 1) and 2) are off-topic here (you might consider http://stackoverflow.com/ ), and 3) can only be answered once you know the answer to 1 & 2. – sleske Jan 12 '18 at 12:56
  • I'm voting to close this as off-topic, because it's mostly asking for debugging help. Please edit your question to focus on the security aspects, then it might be reopened. – sleske Jan 12 '18 at 12:57
  • You're not running a ad block blocker? As you say, it looks like the layer is intended to bait adblockers into removing it, so their presence can be detectedd. But I can't find any ad block blocker in your source code. – Anders Jan 12 '18 at 13:15
  • Nope - we don't have any ads on the site – Arepo Jan 12 '18 at 13:21
  • 2
    I do not see this in Chrome or firefox both with my ad blocker enabled and disabled. – Hector Jan 12 '18 at 13:21
  • Hm, I tried checking it on a friend's laptop, as well as Chrome, Safari and Firefox on my own, and I saw it in all four cases – Arepo Jan 12 '18 at 13:27
  • It is not possible for others to help you because you control the source of the web site. It is quite possible that the configuration between your local website and live website are different. So unless you could provide a scenario where such an issue could be replicated, it would be difficult for others to help you. – Nisarg Shah Jan 12 '18 at 13:34
  • I see it in my Chrome. Just above the `<-- Calendly badge widget -->` line. Ad blocker on. – schroeder Jan 12 '18 at 13:46

1 Answers1

2

I have the same issue on my website.

I have found the cause of it to be the Facebook Pixel Code.

Commenting the Pixel out resulted in the unwanted div disappearing.

Matteo Michele Bianchini
  • 21
  • 2
  • 1
    Yeah, that that seems to be it. It is visible in `https://connect.facebook.net/en_US/fbevents.js`, search for `pub_`. – Anders Jan 12 '18 at 15:17