How does website mining work, and what are the risks?

Website mining uses mining scripts embedded in web pages to mine cryptocurrency with visitors’ computing power and energy. For visitors, the main risks are the use of their computer resources and potentially faster laptop battery drain. For websites, the scripts are not necessarily installed deliberately by their operators; they may also be injected after a site is hacked. The following explanation of how website mining works and its risks draws on research published by Ahrefs in 2018. The website counts and tool information should not be treated as reflecting current conditions.

While a page is open, who supplies the resources for mining?

This type of mining requires extensive computation, consuming computing power and energy. Adding a mining script allows a website to use visitors’ computers to carry out this work, rather than relying solely on its own equipment.

According to the article, as long as the page remains open and the script keeps running, longer visits allow more cryptocurrency to be mined using the visitor’s computer. For example, someone who keeps the same page open for an extended period may be contributing not just a page view, but also computing resources used for mining during that time. However, the material provides no figures for energy consumption per visitor, mining revenue, or profitability thresholds, so it cannot be used to calculate how much a website could earn.

Visitors bear the energy cost, while websites may face unauthorized script injection

• For visitors: The scripts use resources on visitors’ devices. The original article specifically mentions laptop batteries running out, but does not measure the extent of battery drain or provide enough evidence to conclude that hardware damage will necessarily occur.
• For websites: Finding a mining script does not mean the site owner intended to profit from it. The original article notes that some websites had scripts injected after being hacked, so deliberate deployment must be distinguished from unauthorized insertion.

This distinction also matters when assessing responsibility: the mere presence of a script does not establish that the operator knew about it, nor should all cases be treated as the same business model. The material does not establish, for each site, who installed the script, whether visitors consented, or how the site was compromised.

A historical survey can indicate scale, but not current prevalence

At the time, Ahrefs crawled 175,251,729 websites in its database, including subdomains, and checked them using Wappalyzer, which could identify 14 common mining scripts. It found 23,872 websites with mining scripts. This result was limited to the sites indexed and scripts detectable in that survey; it was not a census of the entire web.

About 91% of those websites were estimated to receive fewer than 50 organic search visitors from Google per month. This is not total traffic, nor does it prove that mining caused low traffic. A separate study conducted around the same time by Troy Mursch found more than 43,000 websites. The two studies used different databases and checked for different types of scripts, so the difference in their counts cannot, by itself, establish that either study was wrong or that website mining was increasing or decreasing.