Fake copies of your website: how to detect and take them down
Cloned sites steal customers, credentials and rankings. How clones are made, four ways to spot one, and the takedown route that works.
The short answer
A clone is your website, copied or proxied live, served from a domain that is not yours. It is used to phish your customers’ logins and payments, to run ads and affiliate schemes on your content, to divert enquiries, and sometimes to damage your search rankings with duplicate content. Clones are cheap to make and usually cheap to take down, because they are impersonation, which registrars, hosts and browsers act on. The work is detecting them quickly, reporting them with evidence to the right places, and making cloning less useful in the first place.
How clones are made
| Method | How it works | Tell-tale sign |
|---|---|---|
| Static copy | Your pages are downloaded and re-hosted | Content frozen at the copy date; often still loads images from your domain |
| Live proxy | The fake domain fetches your real pages on every visit and rewrites links | Always current; your logs show one source fetching everything |
| Partial clone | Only the login, checkout or contact page is copied, styled to match | Tightly targeted phishing, often linked from email or ads |
| Template reuse | Your design and copy reused for a different business | Less dangerous, still worth a notice |
The four ways to detect one
- Brand alerts: notifications when your company name or distinctive phrases appear on new pages, and monitoring of new domain registrations resembling yours.
- Referrer and access logs: your assets requested from unknown domains; a single source fetching your whole site repeatedly.
- Search results: a search for a distinctive sentence from your homepage, in quotes, shows every page that copied it.
- Customers and staff: a report of a strange login page, an ad pointing somewhere odd, an invoice with different details. Make it easy to report to a named address.
The takedown route
Collect evidence: the fake address, screenshots, the domain’s registration data and hosting provider, dates, and the phishing email if there is one. Report to the registrar and the hosting provider as impersonation and phishing, with the evidence. Report to the browser safe-browsing programmes and to the search engines’ spam and phishing channels. Where your assets are being loaded from the clone, block those referrers at your network layer, which often breaks the clone immediately. Add a copyright or trademark claim where applicable. Record every step and response.
What this means for you
Your site will be copied at some point; what matters is how fast you notice and how fast it comes down. Set up brand alerts, a referrer rule in your logs and a monthly search. Block proxying and unknown referrers at the network layer. Keep evidence and know the reporting routes. And make your real domain the one customers recognise, so a clone on a look-alike address is noticed by the people it targets.
Frequently asked questions
Someone copied our whole site. Is it a copyright issue or a security issue?
Both, and the security framing gets faster results. A clone that impersonates a business to collect credentials or payments is phishing, which registrars, hosts and browsers act on quickly. Copyright claims work too but move slower. Report it as impersonation and phishing first, with evidence, and add the copyright claim.
How do clones show up in our own logs?
Two ways. A proxied clone requests your pages live, so your logs show a single source fetching everything with odd patterns. A copied clone often keeps links to your images and scripts, so your logs show your assets being loaded with a referrer from the fake domain. Both are detectable with a simple rule.
Can we stop our site being cloned at all?
Not entirely; anything public can be copied. You can make it harder and less useful: block proxying at the network layer, serve assets only to your own domain, watermark where it matters, monitor for your brand, and make sure your real domain is what customers recognise. The goal is fast detection and takedown, not impossibility.
Sources
- Google Search Central: Report spam, phishing or malware (accessed 2026-09-11)