Documents Published With Hidden Details Inside

What the download link hands over

Most business websites offer a few documents to download: a price list, an application form, a menu, a sample agreement, a brochure made in Word and saved as a PDF.

The visitor sees the page. What they download is the whole file, and a working document holds far more than its final page.

The name of whoever created it and whoever edited it last, comments left in the margin, every tracked change, and sometimes last year's wording sitting underneath this year's.

Anyone who opens the file in the right program can read all of it, with no special skill.

What a file can carry

• Tracked changes, with every deleted price still readable.
• Comments written for a colleague, never meant for customers.
• Author and company names in the file's properties.
• Text covered by a picture or a white box.
• Cropped photos that still hold the whole original picture.
• Pasted charts carrying the spreadsheet behind them.

The fourth catches out even careful people. A picture or a white rectangle laid over a line hides it on screen and on paper, but the words stay in the file, and selecting or searching finds them.

Why it matters for security

An old price showing through is embarrassing. The other details are more useful to the wrong person.

Author fields usually hold staff names, often the login names they use at work, and the properties can hold folder paths from the office server.

Those are the makings of a convincing fake email, like the bogus invoices and urgent payment requests that impersonate the boss. A sample built from a real customer's paperwork can also expose that customer's details.

How the details get there

Nobody publishes hidden details on purpose. They arrive through ordinary habits.

A new price list starts as a copy of last year's, edited with tracked changes on so the manager can approve it. The approval happens, the changes are never accepted, and the file goes up as it stands.

A brochure has a photo dropped over a paragraph nobody wanted to retype. The author field names whoever set up Office on that computer years ago.

Each step is reasonable. The upload simply takes the whole history along.

A worked example

An elevator maintenance company with a handful of technicians looks after lifts in strata buildings, offices and care homes. Its page for strata councils offered a sample maintenance agreement as a Word file, to read before a meeting.

It had been made from a real agreement with one building, name replaced, and the tracked changes remained: the original monthly rate, the negotiated discount and a manager's comment on the age of the building's controller.

A council member at another building opened it, saw the markup in the margin and mentioned it at a meeting with the company. A deleted line still held the first building's address.

The company took the file down that day. It wrote a new sample from a blank template, ran Word's inspection tool, checked the properties and published it as a PDF.

It also deleted the old file from the server, not just the link, told the building concerned, and found two older rate sheets with the same problem.

Finding every document on the site

Start with a list, since files are added over years by different people.

The site's media library or uploads folder shows what is stored.

Google shows what it has found: a search for site:yourbusiness.ca filetype:pdf lists the PDFs it knows on that domain, and doc or docx in place of pdf finds Word files.

Expect files nobody links to any more. A document removed from a page stays public at its own address until the file itself is deleted.

Cleaning a Word file

Open the file and look at the Info screen, where Word shows the author, who saved it last, and whether it contains comments or tracked changes.

Accept or reject every change and delete every comment. Then run Inspect Document, under Check for Issues, which finds hidden text, properties and personal information and removes what you choose.

For photos, compress the pictures with the option that deletes cropped areas. Then save a fresh PDF from the cleaned copy.

Checking a PDF

A PDF is not a flat picture of the page. It keeps the properties, the selectable text underneath any picture or box, and whatever markup was showing when it was saved.

Open the document properties in your PDF reader and read the title and author. Some browsers show that title in the tab, an awkward place for last year's client name.

Then select all the text, copy it and paste it into a plain text editor such as Notepad. Anything hidden behind a box or a picture shows up there in plain view.

Text that must never be seen has to go: deleted from the source and the PDF made again, or removed with a proper redaction tool. A box drawn on top does not count.

Replacing a file properly

Uploading a corrected copy often creates a second file instead of replacing the first. Many systems add a number to the new name, and the old file stays public at its old address.

Delete the old file, and put the clean one at the same address where the system allows it, so links in old emails and printed material still work. Otherwise redirect the old address to the new file.

If Google has already found the old file, the Remove URLs tool in Search Console can take it out of the results while the change is noticed.

The counter-case

Most documents on small business sites are harmless: a menu, a map, a form made fresh from a blank template by one person, carrying little more than an author's name.

Some properties are worth keeping, too. A clear title and the business as author help a document make sense when it turns up in search results.

Check anything that began as an internal working file, remove what you never meant to publish, and post the clean PDF rather than the working copy.

Before the next upload

1. List every document currently on the site.
2. Delete files nothing needs any more.
3. Accept tracked changes and delete comments.
4. Run Inspect Document on every Word file.
5. Paste each PDF's text into a plain editor.
6. Publish a fresh PDF from the cleaned copy.
7. Delete the old file before uploading the new one.

Step five is the quickest check and the most revealing. In a minute it shows what any curious reader could find, including whatever sits behind a picture or a box.

Documents arriving from outside carry the opposite risk, covered in the document that asks you to enable macros.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.