Google bot hits on files 'apple-app-site-association' and 'assetlinks.json' showing up in Google Webmasters as pages with errors

Question

I've seen a number of posts on this but none really answer the question of why Google Bots specifically are trying to access the following on ALL of my sites, every single one of them...

/.well-known/apple-app-site-association
/apple-app-site-association
/.well-known/assetlinks.json

In each case on my server a 404 is returned, but the troubling thing is these files now show up as Top pages with errors in Webmaster tools alongside other non existent files

/m/
/mobile/

Should I worry about this?

Solution 1

The file which is being requested is a json file used by some websites to map certain sections of the site and certain pages to a native app so that going into those sections or pages will automatically open the native app and use the app instead of the browser for iOS devices. It appears as though Google is trying to see if you have this file on your site so that they can include the association between sections of your site and native iOS apps in the index. This does not mean that your site has been hacked and does not indicate any problems. You can safely ignore this as Googlebot will check for the file and when it sees that the file does not exist will continue on without an issue as if it hadn't checked for the file, the only reason why it is shown in webmaster tools is for transparency so that webmasters know that Google has tried to access the file when it doesn't exist.

Solution 2

You are not being hacked. Google Bot is trying to see if you have those files using Digital Assets Links protocol to check whether your website has any association with an App.

You can read more about these files here https://developers.google.com/digital-asset-links/v1/getting-started

Comments

[closetnoc]

We are seeing questions around hacked sites a lot in the last few days or weeks. Even the question just before this one is essentially the same question. Your site is likely hacked. Google is following links created on other compromised systems to pages on your site that did exist or may still exist under circumstances.

[Stephen Ostermiller]

I'm not sure this indicates a hacked site. These are URLs that apps can try. Googlebot often fetches URLs that it thinks might work. It may see other clients trying to access these. Does the Search Console "content keywords" report show any unexpected keywords for your site? Weird keywords in that report is a much better indication of a hacked site.

[zod]

Since closetnoc's answer I've been checking out the server, cannot find the said files but on checking out the history via ssh I have found that a bunch of reserved IP addresses (10.80.1.x) have been been in, a sub domain and folder (with one file .ftpquota set to 600 permission) were created on the server - will check out Console

[unor]

See also: What is the .well-known/ directory and how should I set it up?