What Does "ext:asp intitle:cart" Mean? Google Dorks and Securing Online Stores

"ext:asp intitle:cart" is a Google search query that looks for pages built with classic ASP (Active Server Pages) that have "cart" in their title, typically old online shopping cart pages. Queries like this are known as "Google dorks". Security testers use them to find information that sites have exposed by accident. If you run an online store, the right response is to make sure your own legacy cart and admin pages are not exposed.

What "ext:asp intitle:cart" means:

• ext:asp limits results to URLs ending in .asp, the file extension of classic ASP pages. Google does not officially document ext:, but it is widely treated like filetype:.
• intitle:cart limits results to pages with the word "cart" in their HTML title.
• Together: they surface shopping cart pages running on classic ASP, a technology used by many older e-commerce sites.
• Why it matters: old, unpatched cart software has a history of exposing customer and payment data.

How Google Search Operators Work

Search operators are special commands that narrow Google results. Google's Search Central documentation covers operators such as site: and filetype:. It says filetype: "finds results in a specific file type, by content-type header or file extension." It also warns that search operators "are bound by indexing and retrieval limits", so results are not complete. Google's Refine web searches help page adds that you should not put spaces between an operator and its search term.

intitle: and ext: are not listed on those official pages, but they still work in practice and appear in security testing guides. Google Advanced Search offers the same filters as form fields: "terms appearing in the title of the page" and a file type selector.

What Is a Google Dork?

A "Google dork" is a search query designed to find sensitive information that websites have made public by mistake, such as login pages, configuration files or exposed databases. The Google Hacking Database (GHDB), maintained by Exploit-DB, describes itself as "a categorized index of Internet search engine queries designed to uncover interesting, and usually sensitive, information." Its categories include "Sensitive Online Shopping Info" and "Pages Containing Login Portals."

The term reflects that the problem is the site's misconfiguration, not a flaw in Google. Google only indexes what a server makes publicly available.

The OWASP Web Security Testing Guide lists search engine reconnaissance, using operators like intitle: and filetype:, as a standard first step in testing a website's security. Testers use it to see what an attacker could find.

Why Old ASP Shopping Carts Are a Risk

Classic ASP was widely used for e-commerce sites in the late 1990s and 2000s. Many of those carts are no longer maintained. One historical GHDB entry concerns A-CART, described as "an ASP shopping cart application written in VBScript". A flaw in it let remote attackers download its database, exposing customer contact details, card numbers and credentials.

The risk is not the search query itself. Old cart software, forgotten admin pages and backup files left on a server can be found by anyone, including attackers using the same search techniques.

How to Protect Your Online Store

1. Search your own site first. Run site:yourdomain.com searches with filetype: or intitle: filters to see what Google has indexed. Use Search Console's URL Inspection for more reliable checks, as Google recommends.
2. Retire legacy cart software. Move off unsupported classic ASP carts to a maintained e-commerce platform, and delete old .asp scripts, test pages and backups from the server.
3. Lock down admin and order pages. Put back-end pages behind authentication. Google states that robots.txt "is not a mechanism for keeping a web page out of Google", and other crawlers may ignore it.
4. Use noindex correctly. For pages that must stay public but out of search, use a noindex rule. Do not also block the page in robots.txt, or Google will never see the rule.
5. Meet PCI DSS. If you take card payments, the Payment Card Industry Data Security Standard applies. Use hosted or embedded payment pages from your processor where possible. The PCI Security Standards Council says requirements 6.4.3 and 11.6.1 call for payment page scripts to be "properly authorized, checked for integrity, and monitored for tampering".
6. Patch known exploited flaws first. CISA's Known Exploited Vulnerabilities catalog lists flaws attackers are actively using. Prioritise anything on it.

For a wider look at security obligations for growing firms, see our report on cybersecurity compliance for mid-sized companies.

Is It Legal to Use Google Dorks?

Searching Google is legal. But using results to access systems or data without permission can break computer misuse laws. Security professionals test only systems they own or are authorised to test. If you find exposed data on someone else's site by accident, report it to the site owner rather than accessing it.

ext:asp intitle:cart FAQs

What does ext:asp mean in Google?

It restricts results to URLs with the .asp extension. Google does not officially document it, but it behaves like filetype:asp.

What does intitle:cart mean?

It shows only pages with "cart" in their HTML title.

How do I stop my cart pages appearing in Google?

Protect admin and order pages with authentication, use noindex for public pages you want out of search, and remove legacy files. Do not rely on robots.txt alone.

Checked on November 9, 2026, against Google Search Central, Google Search Help, OWASP, Exploit-DB, the PCI Security Standards Council and CISA. This article is for defensive and educational purposes and is not legal advice.