Negative SEO: What It Is and How to Spot a Real Attack

Negative SEO is any deliberate attempt to push a competitor's site down in search results, rather than lifting your own. The usual tools are spammy backlinks, copied content, fake reviews, hacking and false removal requests. Most of it does far less damage than its reputation suggests: Google ignores the bulk of spam links on its own. Hacking and fraudulent takedowns are the forms that do real harm.

This guide sticks to what Google has documented, what named Googlers have said on the record, and a practical way to tell whether a traffic drop has anything to do with an attacker at all.

#What is negative SEO?

The term covers off-page and on-page sabotage carried out by someone other than the site owner. The intent is what defines it. A spammy link that appears because a scraper bot copied your page is not negative SEO. The same link, bought by the thousand and pointed at you on purpose, is.

The idea took off around Google's Penguin update, which went after manipulative links. Once Google was visibly penalising sites for buying links, some people reasoned that buying bad links for a rival would get the rival penalised instead. That logic still drives most of the fear today, and it is also the part Google has spent the most effort neutralising.

#The forms negative SEO takes

Five tactics account for nearly everything people report, and they are not equally dangerous.

Spammy backlinks

The attacker points large numbers of low-quality links at your domain: comment spam, hacked pages, link farms, adult or gambling sites, often with exact-match anchor text for your money keywords. The goal is to make it look as though you bought them, so that Google penalises you.

It is the form people notice first, because backlink tools surface every new referring domain. It is also the least effective, for reasons covered in the next section.

Scraped and duplicated content

Someone copies your articles, sometimes thousands of them, and republishes them on other domains, occasionally with a few words swapped. The hope is that Google sees duplicate content and either filters your page out or credits the copy as the original.

Google's spam policies treat this as the scraper's problem. They define scraping as taking content from other sites and "hosting it with the purpose of manipulating search rankings", and list republishing without added value as an example of abuse. A site with a clear publishing history and a correct self-referencing canonical tag on every page gives Google a strong hint about which copy is the original.

Fake reviews

For local businesses this is often the form that hurts most, because it does not need to move rankings at all. A wave of one-star reviews on a Google Business Profile changes how a dental clinic in Leeds or a restaurant in Bengaluru looks to everyone who finds it, whatever position it holds.

Google has started treating review spikes as an attack pattern. In an April 2026 update on protecting businesses on Maps, it said that when it sees "a sudden spike in spam reviews" it will remove the fake content, pause new reviews on the profile, alert the owner and show customers a banner explaining why. The same post named extortion schemes that demand payment to remove fake one-star reviews, and reported that Google blocked or removed over 292 million policy-violating reviews in 2025.

Hacking

An attacker who gets into your site can do far more than any outside link campaign. Google's spam policies describe page injection, where hackers add new pages "that contain spammy or malicious content", and sneaky redirects that only fire for some visitors, depending on "the referrer, user agent, or device". The same document warns that hackers often use cloaking "to make the hack harder for the site owner to detect".

This is negative SEO with real teeth. A hacked site can trigger browser warnings that Google says may cut Search traffic, or have its index flooded with pharma or casino pages it never published.

Fake removal requests

There are two versions. The old one is a fake email, supposedly from you, asking sites that link to you to remove those links. The newer and more serious one is a fraudulent copyright complaint filed with Google to get your pages delisted.

That second version is documented in court. In 2023 Google sued two men who, according to its complaint as reported by Search Engine Roundtable, created "at least 65 Google accounts" to file thousands of fraudulent copyright notices against more than 117,000 competitor URLs. Google's own complaint said the defendants had "weaponized" the takedown process. Google's spam policies add a reason this matters beyond the pages removed: a significant volume of valid copyright removal requests against a site can be used "to demote other content from the site".

The defence is the counter notification. Google's DMCA help page says the operator of an affected site can file one, and that Google may then reinstate the material. If a page vanishes from search overnight and Search Console shows nothing technical, check the Lumen database, where Google says it may forward the notices it receives.

#Does negative SEO actually work?

For link spam, the evidence says very rarely. For hacking and fraudulent takedowns, yes, it can.

What Google's systems do with spam links

In December 2022 Google announced a link spam update powered by SpamBrain, its AI-based spam system. The announcement said Google was using it "to neutralize the impact of unnatural links on search results", and that it could now detect both sites buying links and "sites used for the purpose of passing outgoing links".

The verb matters. Neutralising a link means it passes no value, positive or negative. That is exactly what defeats a link-based attack: if the hundreds of spam domains pointed at you are recognised as spam, their links count for nothing in either direction.

Google's disavow tool documentation says the same thing in plainer words: "In most cases, Google can assess which links to trust without additional guidance, so most sites will not need to use this tool." It also says Google "works very hard to make sure that actions on third-party sites do not negatively affect a website", while admitting that in some circumstances incoming links can affect its view of a site.

What Googlers have said on the record

Gary Illyes, a Webmaster Trends Analyst at Google at the time, has told the same story twice. At Pubcon Florida in 2019 he said he had looked at hundreds of supposed negative SEO cases and none had been the real reason a site was hurt. In a 2024 interview, reported by Search Engine Journal, he gave the fuller version: after Penguin he asked for examples, received "literally hundreds", and found only one worth sending to the web spam team for a second look. His conclusion was that "the fear about negative SEO is much bigger than or much larger than it needs to be".

In that same interview he explained one mechanism. Google tries to match the topic of the linking site with the topic of the page it links to, so links from "completely irrelevant sites" can be assumed to be disabled. A blast of links from casino and adult domains to a bakery's website is the textbook case of a link that does not match.

John Mueller, a Google Search Advocate, has been blunter. In a 2022 Reddit reply covered by Search Engine Journal, he told a site owner who believed a competitor was attacking them: "I'd just ignore them. Think of it this way, if your competitors are competent, they won't build links for you. If your competitors are incompetent, the links won't have any effect." In 2024 he added, on Mastodon, that "Google has 2 decades of practice of ignoring spammy links".

Why the fear persists anyway

Two things keep the worry alive, and neither is evidence that link attacks work.

First, spam links are visible. Every backlink tool reports new referring domains, and many attach a "toxic" score. Those scores are the tool vendor's estimate, not Google's judgement. Mueller made that distinction himself in April 2024, saying spammy links are "sometimes just more visible in tools, but that doesn't mean they're a problem".

Second, timing creates false causes. Every visible site collects junk links constantly, so when rankings drop for some other reason, the junk is sitting in the report, ready to be blamed. Illyes said in 2019 that the real culprit is usually something else, such as an algorithm update or a problem on the site.

#How to tell a real attack from normal noise

Start from the drop, not from the links. Google's guide to debugging drops in Search traffic lists the main causes to investigate: algorithmic updates, technical issues, security issues, spam issues, and seasonality or changing interests. Negative SEO is not on the list as a separate cause.

1. Open the Manual actions report in Search Console. A manual action is issued by a human reviewer, and Google notifies you in that report and the message centre. If "Unnatural links to your site" appears there, links are genuinely the problem, whoever built them.
2. Open the Security issues report. Hacked content, malware and phishing show up here. This is the check most likely to find real sabotage.
3. Search your own domain for pages you did not publish. Use site:yourdomain.com with spam terms common in your market, such as casino, viagra or loan. Injected pages often sit in folders your navigation never links to.
4. Line the drop up against update dates. Google publishes confirmed ranking updates on its Search Status Dashboard. Its own guide says that after an algorithmic update "there might not be anything fundamentally wrong with your content".
5. Widen the date range to 16 months. In the Performance report, choose Last 16 months and compare the last three months year over year. A drop that repeats every year is seasonality, not an enemy.
6. Check for pages removed by legal requests. If specific URLs disappeared from search while still loading normally, search Lumen for your domain to see whether copyright notices were filed against them.
7. Only then look at links. Export recent links from Search Console's Links report and look for a sudden spike in referring domains, exact-match anchors for terms you never targeted, and links pointing to URLs that return 404. Mueller has said links to 404 pages "do nothing", because there is no indexable destination for them to count towards.

If steps one to six find nothing and step seven finds a spike, you have probably found noise, not the cause of your drop. A broader technical SEO audit and the core reports in Google Search Console will usually turn up the real reason.

Signs that point to a real attack

These patterns justify more attention than a spam link:

• Pages on your domain that you did not create, or redirects that only fire from Google results.
• A Security issues or Manual actions entry, of any kind.
• Specific URLs removed from search after copyright complaints you do not recognise.
• A sudden surge of one-star reviews from new accounts within a few days.
• Emails to your linking partners, sent in your name, asking them to drop links.

Notice what is missing: a rise in spammy referring domains on its own. That one shows up on almost every site sooner or later.

#A worked example: a spam link blast that needed nothing

We saw this on projectrankup.com in August 2026. Our referring domains in Ahrefs suddenly filled with links from .shop and .site domains we had never heard of. They had no traffic of their own, they were clearly part of a network, and the jump in referring domains looked dramatic on a chart.

The triage took minutes. There was nothing in the Manual actions or Security issues reports. Every one of the links was nofollow, which is the attribute Google's own manual action guidance asks site owners to request when they want a link to stop passing PageRank. In other words, the links were already in the state a clean-up would have put them in.

So we did nothing. No disavow file, no outreach, no monitoring tool. The useful lesson was the reverse of the scary one: a rising referring-domain count can be pure noise, which is also why we do not treat third-party authority scores as a goal (the Moz DA vs Ahrefs DR post covers what those numbers do and do not measure).

#When the disavow tool is the right answer

Disavowing tells Google not to count specific links or domains. Google's documentation describes two conditions together: you have "a considerable number of spammy, artificial, or low-quality links" pointing to your site, and those links "have caused a manual action, or likely will cause a manual action". It also calls disavow "an advanced feature" that "can potentially harm your site's performance" if used incorrectly.

In practice that means three situations:

• You have an "Unnatural links to your site" manual action. Here disavow is part of the fix, after a good-faith attempt to get links removed. Google's manual action guidance says blindly adding every backlink to the file "is not considered a good-faith effort".
• You or a former agency bought links. That is not negative SEO, but it is a far likelier route to a links manual action than any attack.
• You are worried and want closure. Mueller called disavow useful for "peace of mind for negative-SEO" back in 2018: if you are worried, disavow and move on. A short file with domain: lines for an obvious spam network does little harm. A file built from a tool's toxic list, sweeping up good links too, can.

How the file works line by line is covered in our guide to what disavow is and how the file works.

#How to protect your site without paranoia

Aim your effort at the forms that work. In rough order of value:

1. Harden the site. Keep your CMS, themes and plugins updated, remove plugins you no longer use, enforce two-factor login for every admin, and keep off-site backups. This addresses hacking, the most damaging form.
2. Verify Search Console and make sure its messages reach someone. A UK solicitor's site or an Indian D2C store that never opens Search Console can be hacked for weeks before anyone notices.
3. Claim and watch your Google Business Profile. If you have a local presence, respond to reviews and report fake ones. Google's new review-spike handling only helps if you can see the alerts.
4. Keep proof that your content is yours. Publish dates, canonical tags and an XML sitemap make it easier for Google to pick the original over a scraper, and make a counter notification easier to support.
5. Track rankings at page level. A sudden fall on one URL points to something different from a sitewide decline. Tools such as daily rank tracking help separate the two; Project Rankup's Rank Tracker labels page-level decay by likely cause, such as losing clicks but not rank.
6. Look at backlinks occasionally, not daily. A monthly glance at new referring domains is enough to spot a manual-action risk. Watching it every day mostly produces anxiety.

What you can skip: paid "negative SEO protection" retainers that consist of monthly disavow uploads, and any service promising to "remove toxic links" without first showing you a manual action.

If you are deciding where your SEO hours should go this quarter, an SEO plan built around outcomes will almost always put defending against link spam near the bottom.

Frequently asked questions

Is negative SEO illegal?

Some of it can be. Google's DMCA help page warns that anyone who materially misrepresents a copyright claim is liable for damages, and Google has sued people who filed fake notices at scale. Breaking into a site is a matter for the police and your host, not only for Google. Buying spam links for a rival breaks Google's spam policies.

Can a competitor hurt my rankings with backlinks?

Rarely. Google says it can assess which links to trust in most cases, and its SpamBrain system neutralises unnatural links. Gary Illyes reviewed hundreds of reported cases and found one that might have been real. Hacking or fraudulent takedowns are far more likely to cause damage than links.

How do I know if my site has been hacked?

Check the Security issues report in Search Console first, since Google lists detected malware, phishing and hacked content there. Then search site:yourdomain.com with spam terms such as casino or loan, and click a few of your results from Google itself, because hacked redirects can fire only for visitors arriving from search.

How long does it take to recover from negative SEO?

For link spam, there is usually nothing to recover from. After a hack, clean the site, close the hole that let the attacker in, and request a review in Search Console; Google lifts a manual action once it decides the site no longer violates its policies. Pages removed by fraudulent DMCA notices can return after a counter notification.

Should I report a site doing negative SEO to Google?

You can. Google's spam policies invite anyone who believes a site is violating them to file a search quality user report. Reports feed Google's spam detection rather than triggering a guaranteed action, so do not wait on one before securing your own site.

Does negative SEO affect AI Overviews and AI search?

Not as a separate channel. Google says a page must be indexed and eligible to appear in Search with a snippet before it can be a supporting link in AI Overviews or AI Mode. A page that stays indexed keeps that chance. A hacked or delisted page loses its ranking and its citations together.