An attacker can request a password reset for a victim's email address while modifying the Origin header to point to an ...
Google's John Mueller's response on phantom noindex errors in Search Console acknowledges indexing blocks visible to Google.