Negative SEO: How to Detect, Respond To, and Prevent Attacks on Your Site
Negative SEO is a deliberate attempt by someone else to damage a site’s search performance: pointing spammy links at it, copying its content, flooding its listings with fake reviews, filing false reports, or breaking into the site itself. Detecting it means telling a real attack apart from ordinary ranking changes. Responding means using Google’s own tools in the order Google describes. Preventing it means monitoring the places an attack would show up and closing the security gaps that let an attacker into the site itself.
Where Google Starts
Google’s position is that most bad links never need a response from you. Its guidance on the disavow links tool says that Google can usually decide which links to trust without help, so most sites will never need the tool. Its Manual Actions report documentation adds that Google’s algorithms detect most spam on their own and remove it from search results without a manual review.
That is the right starting point for an unexplained ranking drop. Check for a core update, a technical problem, or a competitor publishing better content before assuming an attack, because acting on an attack that is not happening, such as disavowing links that help you, can do damage of its own.
The Forms an Attack Takes
- Link attacks: large numbers of low-quality links pointed at a site, sometimes with commercial anchor text, in the hope of making the site look like it bought them.
- Content scraping: copies of a site’s pages published elsewhere, aiming to confuse which version is the original.
- Fake reviews: a wave of negative reviews on a Business Profile or review platform, which those platforms handle through their own reporting tools.
- Hacking: injected spam pages or redirects on the site itself, which Google reports in Search Console’s Security Issues report rather than as a manual action.
- False reports: bad-faith spam reports or copyright complaints filed against a site.
Detect: Telling an Attack From Background Noise
Every site collects odd links from scrapers and directories. What separates an attack is a pattern measured against the site’s own history:
- a sudden jump in new referring domains with no topical connection to the site
- anchor text that shifts toward one commercial phrase, compared with the site’s earlier profile
- many links from templated, low-effort pages that look like one automated campaign
- links from regions or languages unrelated to the site’s audience
No single signal proves an attack. Google publishes no percentage of commercial anchors that counts as safe, so compare against your own baseline, not a number from someone else’s article.
Two cases are clearer. A manual action in Search Console is a confirmed problem, whatever caused it. A message demanding payment to stop or undo an attack is not a service; the steps below are the documented way to deal with harmful links, and none of them involve paying a third party.
Respond: What Google Asks You to Do
Start with the Manual Actions report. If there is no manual action, Google’s systems are evaluating the links on their own, and the disavow guidance says the tool is for cases where you have “a considerable number of spammy, artificial, or low-quality links pointing to your site” and those links “have caused a manual action, or likely will cause a manual action.”
If there is a manual action for “Unnatural links to your site,” take it seriously even if you never built the links. Google’s documentation describes that action as “a pattern of unnatural, artificial, deceptive, or manipulative links pointing to your site” and does not limit it to links the owner created. Its recommended steps are:
- Download your links from Search Console, either by top linking sites or by latest links.
- Check them against Google’s link spam policy, starting with the sites that link to you most and the links created in recent months.
- Contact the owners of violating sites and ask that they “either remove the links or prevent them from passing PageRank,” for example with
nofollowor a more specific rel attribute. - Disavow the links you could not get removed. Google warns that disavowing every backlink wholesale does not count as a good-faith effort and will not make a reconsideration request succeed.
- File a reconsideration request that describes the fixes.
On timing, the same page says a review usually takes several days or weeks, and that link-related requests can take longer. Google asks that you not resubmit before a decision on a pending request.
For a hacked site, the order is different: remove the injected content, close the vulnerability that let the attacker in, and then request review.
The other forms run through the platform where the harm appears. Fake reviews on a Business Profile can be reported for removal, and Google removes only reviews that break its policies. Scraped copies that infringe your copyright are a legal matter, which Google handles through its page for reporting content for legal reasons. In each case, keep the evidence described below and note the date each request was sent and answered.
Keep a Record
If an attack is real, keep dated evidence before anything is cleaned up: exports of the link profile, screenshots of fake reviews and scraped copies with their dates, the removal requests you sent and the answers, and a timeline set against your traffic. That record supports a reconsideration request, and it is the material a lawyer would ask for if you consider legal steps, which depend on where you are and whether the person responsible can be identified.
Prevent: What to Monitor
| What to watch | What it catches |
|---|---|
| A backlink tool's new and lost referring domains, with alerts set to your normal range | Sudden link spikes |
| Search Console, verified, with email alerts | Manual actions and security issues as soon as they are issued |
| Searches for distinctive sentences from your pages | Scraped copies |
| New reviews on your Business Profile and major review sites | Review floods |
| File changes, unexpected redirects, and unfamiliar indexed pages | Signs of a hack |
Set alert levels from your own history: a large publisher may gain dozens of referring domains on an ordinary day, while a small local site may gain a few in a month. A hack is the form of negative SEO a site owner can most directly prevent. Google’s 2015 #NoHacked post asks owners to check for outdated software, “especially updates that patch security holes,” to avoid reusing passwords across services, and to turn on two-factor authentication for accounts that offer it. Its 2017 follow-up warns against premium themes and plugins offered free of charge, which attackers copy and fill with backdoors.
Questions About Negative SEO
Can a competitor hurt my rankings with bad links?
It can happen, but Google states that in most cases it can assess which links to trust without your help. A link spike or even a manual action also does not show who caused it; record what you observed separately from who you suspect. Investigate other causes first, and act on links when there is a manual action or a clear pattern that matches the disavow guidance.
Does Google penalize a site for links it didn’t build?
A manual action for “Unnatural links to your site” describes links pointing to the site without saying who built them. If you receive one, follow the removal, disavow, and reconsideration steps above and explain in the request what you found.