Google AdSense Optimization Tips

1. Don’t Feel Shy – If you are seriously willing to monetize your website with AdSense, make sure that you place advertisements in prominent locations where visitors will notice the ads.

2. The best performing ad units for AdSense are 160×600, 336×280 and 300×250. For text only ads, you should go with the 336×380 format but in all other situations, 300×250 may be a better format since it is most popular among advertisers and also supports rich media. 160×600 can easily fit in the sidebar of your blog.

3. Web visitors have a very short attention span and majority of them may simply leave after a quick glance. Their eyes follow a F pattern so you can get good results if the Google ads are placed in the areas colored red on the heat map. Sidebars and leaderboards at the top are often ignored.

4. Depending upon the layout of your website, you should consider placing the first unit somewhere in the middle of the page and above the fold.

5. Even kids would know that AdSense works best if there are no borders and that the background color of the ads matches with the background of the page. That may not always be true and sometimes colored backgrounds (like light yellow or very light grey) can convert better – look at the top AdWords unit on the Google search page.

6. If you have a website with a dark theme (like a black background), experiment using a contrast color scheme for Google ads.

7. While it is a good idea to use section targeting around the main content, you should skip adding the section targeting tags for the comment section in your blog because the comments may not exactly convey what the page is all about. The aim is to increase the relevance of Google Ads.

8. Site visitors generally look for a search button at the top left region. Use the word “search” in the submit button else some visitors may not notice them. AdSense doesn’t allow publishers to pre-populate search boxes with keywords. Always use a second search box at the bottom of your pages and if possible, host site search on a separate sub-domain as regular readers can easily remember that address.

9. I recommend using only text ads for the first Google Ad unit but place another 300×250 unit in the sidebar (or somewhere below the fold) – these generally serve CPM based ads and will therefore help you monetize visits from places like Digg and StumbleUpon even when the bounce rate is very very high.

The CPM of ad units will decrease as you come the page but that may not be the case with link units – they are small, text based, can fit in even small locations and perform brilliant.

10. These are recommended ad placements for a website depending upon the design (two-column or three-column). If you write long articles, try fitting an ad unit somewhere in the middle of the article or at the bottom because when readers are done with reading, they’ll probably look for more resources or related information.

11. Once your new ad placement is live, make sure you test the AdSense layout with help of your grandma or subscribe to a professional mouse tracking service like CrazyEgg to know how people interact / navigate your content.

12. Sometimes traffic flowing in from Image search engines can earn you more AdSense Revenue than regular web traffic. So upload good quality images and use text captions with alt tags to make sure that blog images rank good in Image Search results.

13. Flickr is another great source of traffic (especially from Yahoo!) and you may also use it to indirectly improve your organic rankings.

14. You can also increase relevance of Google Ads on your site by linking to authority websites using descriptive anchor text. This will also help improve your organic ranks since outgoing links and citations carry weight in the eyes of the search engine who may then consider you as an authority for that niche.

15. Look for variations in Google Analytics – AdSense reports. If you are seeing impressions for a page but no CTR or CPM, chances are that the page may be serving PSAs or the ads aren’t relevant enough. You may also use the AdSense Sandbox to figure out if visitors from other countries are unable to see ads on some page that have low (or zero) CPM.

Also see: How to Enable Analytics in AdSense

16. Placement targeting is an excellent opportunity for you to market your site to potential AdWords advertisers. Therefore always make it a practice to use descriptive text when describing your AdSense channels.

17. Archives, Tags, Category or Author pages in a blog aren’t good landing pages and are hard to monetize as well. Redirect their Google juice to single post page using NOINDEX, FOLLOW tags.

18. Reward your regular visitors (I call them influences) with ad-free content. AdSense in feeds is not a loved option either so you may have use the feed footer to find spammers & feed scrappers.

19. If you run a multi-author blog, you can very easily implement AdSense Revenue sharingthrough channels. Assign a separate channel to each other and use that number for his or her blog posts.

20. AdSense Premium sites like CNN,  New York Times, About.com, etc. generally have dedicated AdSense account managers to help them optimize their Google ad units. You can study their layouts and probably implement some of the techniques in your own blog(s).

With Google AdSense, one should never feel complacent because there’s always a chance to improve earnings provided you are willing to experiment. The software theory – “If it ain’t broke, don’t fix it” doesn’t really apply here.

Javascript Injection

JavaScript Injection Overview

JavaScript is a widely used technology within websites and web based applications. JavaScript can be used for all sorts of useful things and functions. But along with this comes some additional security issues that need to be thought of and tested for. JavaScript can be used not only for good purposes, but also for malicious purposes.

Using JavaScript an individual can modify and change existing information within a form. It can be used not only to change form input tags, but also the cookie's that are currently set in the browser, and any other value within a website or web application. Any type of parameter manipulation that you want to perform can typically be done with Javascript injection.

To execute any javascript within a current session, a user would enter the specific javascript commands within the browser's url bar minus the http://. All javascript commands must start with the javascript: tag followed by any javascript command that will be executed. All javascript is ended with a ; so a user could enter multiple javascript commands, as long as each command ended with the ;

JavaScript cookie modification

Using JavaScript a user can modify the current cookie settings. This can be performed with some basic JavaScript commands. To view the current contents of your current cookie/s, use the following JavaScript command. Put this in your browser's URL bar.

javascript:alert(document.cookie);

This command will popup a box which lists your current cookies. A malicious user could use javascript to change values in the cookie. For example lets say a web application you are testing sets an authorization cookie to true when a user has successfully logged in and passed the authorization test. To change the values within the cookie, a malicious user would execute javascript like the following from the url bar within the browser.

javascript:void(document.cookie="authorization=true");

This would cause the current cookie parameter authorization=false to be changed to authorization=true. Which the malicious user might not have passed the original authorization test. The malicious user has just bypassed the authorization test and gained access to the sensitive content. As you could imagine, this could cause severe problems in privilege escalation, if the malicious user could use JavaScript injection to bypass the correct authorization process.

If you are testing for JavaScript injection and wish to see if the cookie has been altered you would execute a command similar to the following, except you would want to replace the cookie name and value with the cookie you desire to test. Start with the javascript command to alter the cookie and then tack on the javascript alert function to view what the cookie was changed to. For example

javascript:void(document.cookie="authorization=true");javascript:alert(document.cookie);

You should now be able to see the new cookie parameter in the popup box.

JavaScript HTML Form modification

You can also use javascript to modify any value with an html form, including hidden forms, and disabled forms. The following is an example of how you would set an input tag named email within form number 0 (or the first form on the page)

javascript:void(document.forms[0].email.value="test@test.com");

You will need to view the source code of the html page to determine what needs to be changed and how to change it. Verify the form number and set the correct number. The first form is always 0. Next look for the html tag you wish to change. Finally add the new value you want the html tag to be. This will allow you to modify the information within the html form.

How to protect against Javascript Injection

Always validate the input received against a whitelist. If you use a blacklist you could and probably will come up against encoding issues. Always use a whitelist when validating input.

Do not rely on client side validation to validate the user input. Client side validation is great for helping the user input correct data. But a malicious user will not use this and could bypass the client side validation. Client side validate is should never be considered as a security fix. Using javascript to validate input should not be used. As you can see javascript is very easy to change and modify on any html page.

Additionally validate the input every time, not just when the data is initially accepted. For example if you set a cookie, make sure that cookie is the same value and it is correct on each and every request. A malicious user could modify and change the value anytime during the session.

Injecting javascript into existing pages

Not only can you use javascript to manipulate parameters, cookies, but you can also inject javascript into dynamic pages to cause the page to render differently, do something else, or some other malicious thing. Think of a XSS attack.

Come back soon and we will post some examples of this.

Using JavaScript is difficult. Isn't there an easier way?

Actually there is an easier way to test for any type of parameter manipulation you can do with javascript injection. Using some type of proxy that allows you to manipulate parameters on the fly is much easier. You can do this with a number of different applications. I've included a list of some of the proxy applications that allow you to do this.

• Paros Proxy
• TamperData

There are many, many more security testing proxy tools, this is just a short list of a few of the quick, easy, and nice tools to use.