Negative SEO: Detect It, Remove It, Recover

Someone points a large number of low-quality links at your site, hoping Google treats them as yours. Google's spam policy lists the kinds of links involved. Examples are automated link creation, low-quality directory links and forum signature links.

Warning signs: you see many new linking domains within days, where you normally gain a few a month. The anchor text has nothing to do with your business, such as gambling, pills or foreign phrases. The same exact-match keyword repeats across hundreds of links. Most links aim at one or two pages. Search Console may also show a manual action for unnatural links.

Rule out first: scraper sites that copy everything, including links to you. Also check for cheap link packages that you or an earlier SEO bought years ago. Both look the same as an attack.

Scraping means copying a site's content automatically. Google's policy describes the abusive form as republishing content from other sites without adding original value. As negative SEO, the hope is that the copy is treated as the original.

Signs: an unusual sentence from your page, searched in quotation marks, shows other sites. A copy ranks above your page for your own title. New articles appear on unknown domains within hours. URL Inspection may also show that Google picked another site's address as the canonical, which is the main version of a page.

Rule out first: your own duplicates. Examples are printer versions, tracking parameters, an open staging site or a forgotten syndication partner. These cause the same symptoms far more often than an enemy does.

Reviews written by people who never used your business. Google's rules for Maps contributions ask for a genuine experience and forbid posting about a competitor to undermine it.

Signs: several one-star reviews arrive within a day or two, after months of normal activity. The reviewer names match no customer, order or appointment. The text is vague, or it praises services you do not offer. Some reviewers posted many one-star reviews on unrelated businesses.

Rule out first: a real unhappy customer, a mix-up with a business of a similar name, or a review about a competitor's branch.

The attacker breaks into your site and adds spam pages, hidden links or redirects. Unlike the types above, this one lives on your own domain, so it can do real harm quickly.

Signs: you find pages or products you never created, often in another language. Search Console shows a Security Issues warning. Search results for your site show pharmacy or casino titles. Visitors on mobile get sent to other sites.

Rule out first: a plugin or a developer who added pages on purpose, or a temporary redirect from a campaign.

First move: do not delete things yet. Take a backup of the infected state, change every password, and ask your host for a malware scan. Then clean up, and close the door that was used.

An email arrives that appears to come from a webmaster or from you. It asks another site to remove its link to you, or asks you to remove a link to theirs. The aim is to make you lose links that were working.

Signs: the sender address differs by one letter from the real one. Or a friendly partner suddenly removed your link without being asked.

First move: never answer a removal request from an address you cannot confirm. Contact the partner by another route and ask.

Bots request your pages thousands of times, so the server slows down or fails. Google's guidance on crawling asks sites to work with their host on this. It also describes a special request to reduce Googlebot crawling when Google itself is the cause.

Signs: pages run slow at odd hours. The Crawl Stats report shows error spikes. One address or user agent makes most of the requests in your server log.

Rule out first: a real traffic peak, a large sale or a legitimate crawler. You can verify real Googlebot with the reverse and forward DNS check that Google documents.

An article, forum thread or blog post attacks you or your business. It ranks for your name, or for your brand plus words like "scam" or "reviews".

How to check: search your name and brand in a private window, on desktop and on a phone. Write down every negative result with its address and the date you saw it.

First move: save screenshots and the address, then follow the five removal routes above in order. Do not reply in public, because a heated thread tends to gain links and climb.

Your opening hours, phone number, website or category change without you touching them. Or the listing is reported as closed or as a duplicate.

How to check: open the profile as the owner and look for edits you did not make. Then turn on the email notices the profile offers.

First move: revert the data and remove access for anyone you do not know. Then make sure at least two trusted people can manage the profile, so one lost login cannot lock you out.

This can be a site with almost your name and design. It can also be a social profile that uses your logo, or emails that appear to come from you.

How to check: search your brand and your logo, and try the obvious misspellings of your domain. Then see who registered the lookalike. Customers who say "I got an odd message from you" are often the first warning.

First move: report the profile or the site to the platform or the host as impersonation. Then tell your customers once, calmly, on your real site.

Someone who does not own the work files a copyright complaint that names your page. A host or search engine then hides your content.

How to check: read the notice and compare it with your page history. If you wrote the work, you have dates, drafts and files to prove it.

First move: do not ignore the notice, because the time to answer can be short. Send a counter-notice through the same channel with your proof. Google says the content can be restored if no legal action starts within 10 business days after a counter notice. For anything with legal weight, talk to a lawyer first.

The server slows or goes offline for hours. Or Search Console lists thousands of odd addresses that you never created, such as internal search result pages or links with long parameter strings.

How to check: compare the request count in your logs with a normal week. Then look in the pages report for new addresses that follow one pattern.

First move: ask your host, a firewall or a CDN to rate-limit the sender. Then stop the site from creating crawlable pages for every search term. A noindex rule on internal search results is a common fix. I check each case before I say which one applies.

Updates. The WordPress hardening guide says to keep WordPress current. Update plugins and themes too, delete the ones you do not use, and install only from trusted sources.

Backups. Keep regular backups of files and the database. Keep older copies too, because a hack is often found weeks after it happened. Test a restore, or the backup is only a hope.

Two-step login. A code from your phone after the password. Turn it on for WordPress admins, hosting, the domain registrar, and the Google account that owns Search Console and your Business Profile.

Alerts. Switch on Search Console email notifications, add an uptime monitor, and turn on review notifications in your Business Profile.