Negative SEO Attack: 7 Signs and 5 Look-Alikes
detection guide, defense onlyA negative SEO attack leaves traces in a few specific places: your links, your reviews, your server and your security reports. One sign on its own proves little. Two or three signs on the same dates are worth acting on. This guide lists the seven signs worth checking and five ordinary problems that only look like an attack.
- seven signs, one place each
- five look-alikes ruled out
- dated notes before any fix
| sign | where to look | weight |
|---|---|---|
| spike of new linking domains | Search Console links report | strong with others |
| Security Issues warning | Security Issues report | act now |
| burst of one-star reviews | Business Profile | strong with others |
| copies of your pages | a quoted search on your own sentence | medium |
| server flood | server log, Crawl Stats report | medium |
| drop on an update date | Search Status Dashboard | weak alone |
// the weights are my own opinion. One sign alone is a reason to look closer, not proof.
What a Negative SEO Attack Looks Like
A negative SEO attack shows up as a cluster of changes you did not cause. The cluster matters more than any single item.
Negative SEO means another person works to make your site look bad to Google, or to make your name look bad to your customers. The tactics are different, but they share one habit: each leaves a trace in a place you can check. The seven signs below follow those places. For the full guide, including removal and recovery, read my pillar page on negative SEO attacks.
Seven Signs Worth Checking
Each sign has a place to look and an innocent explanation to rule out first.
1. A spike of new linking domains
Many new linking domains arrive within days, where you normally gain a few a month. Check the links report in Search Console and sort by date. Rule out scraper sites and old paid link packages first.
2. Anchor text that fits nothing you sell
Gambling, pills or foreign phrases, or the same exact keyword across hundreds of links. A pattern like this is unusual for a natural link profile.
3. A manual action for unnatural links
A human reviewer at Google found a problem, and it appears in the Manual actions report. An empty report is good news worth a dated screenshot.
4. A Security Issues warning or pages you never made
Pharmacy or casino titles in your results, products in another language, or visitors sent elsewhere on mobile. This is the sign that turns a worry into an emergency.
5. A burst of one-star reviews
Several reviews within a day or two after months of normal activity, with vague text and reviewer names that match no customer or order.
6. Copies of your pages on unknown domains
A sentence from your page, searched in quotation marks, shows other sites, or a copy ranks above your original for your own title.
7. A server flood
Slow pages at odd hours, error spikes in the Crawl Stats report, or one address making most of the requests in your server log.
// the seven signs follow my own grouping of the cases described in my pillar guide.
Five Things That Only Look Like an Attack
In my experience, most suspected attacks turn out to be one of these. Check them before you blame anyone.
A change to the site
A new theme, a plugin update or changed redirects in the last weeks. A technical fault is the most common cause of a sudden drop.
A Google update
Google lists its ranking updates on the Search Status Dashboard. A drop that matches an update date, with no other sign, is an ordinary ranking drop first.
The season
Many businesses have a normal quiet and busy period. Compare with the same weeks last year before you act.
An old SEO problem
Cheap link packages bought years ago by you or an earlier SEO look the same as a fresh spam blast in the links report.
Your own duplicates
Printer versions, tracking parameters, an open staging site or a forgotten syndication partner cause copy problems far more often than an enemy does.
// the five look-alikes are my own opinion from experience, not Google data.
The Order I Check Things In
Ordinary causes first, outside evidence last. The order saves you from fixing the wrong thing.
Traffic fell
Security Issue or manual action in Search Console?
Yes
treat it as the priority, fix it, request a review
No: did the site change?
theme, plugin, redirects in recent weeks
No: update or season?
compare with last year, wait before acting
Still nothing?
look for outside evidence on the same dates
// this is the decision path from my pillar guide, shortened.
What to Do When Two Signs Line Up
Evidence first. Everything else gets easier when the notes are dated.
- Save the proof. Export the links report, take screenshots of rankings, reviews and warnings, and write down the dates.
- Contain new damage. Change passwords, remove unknown users and turn on two-step login.
- Check the three reports. Manual actions, Security Issues and the links report tell you quickly whether Google sees a problem.
- Read the removal routes. If a harmful page ranks for your name, my guide to negative SEO removal and recovery walks through the five routes in order.
Mistakes That Make It Worse
Each one comes from acting before looking.
- Cleaning before collecting evidence. The proof disappears, and later requests are harder to believe.
- Disavowing everything to be safe. Google calls the tool advanced. See my guide to when to disavow links.
- Arguing in public. A heated thread tends to gain links and climb.
- Blaming a competitor in a review request. It reads as a guess. Describe the facts and the fix.
Questions People Ask Me
How do I know if I am under a negative SEO attack?
Look for two or three signs together on the same dates, such as a spike of spammy links, copies of your pages, a burst of fake reviews, a Security Issues warning or a server flood. Then rule out the ordinary causes: a change to the site, a Google update or the season.
Can one sign prove a negative SEO attack?
No. A single odd link or one bad review is normal for any site. A pattern across several places, starting on the same dates, is what separates an attack from background noise.
What should I do first if I see these signs?
Collect evidence before you change anything. Export the links report, take dated screenshots and save the dates. Cleaning up first destroys the proof.
Is a drop in rankings alone a sign of negative SEO?
No. Most drops come from a technical fault, a Google update, a seasonal change or an old SEO problem. A drop becomes interesting only when it lines up with outside evidence on the same dates.
Send Me the Dates. I Will Look First.
Tell me the address of the page and the dates you noticed the change. You get an honest first look, and I say plainly if I think it is not an attack. You can also ask a cheap SEO expert for a first look at the technical side. See my negative SEO recovery services.
Sources and Last Check
- Google Search Central: Spam policies for Google web search (link spam definition)
- Search Console Help: Manual actions report (where manual actions appear)
- Search Console Help: Security issues report (where hacked content warnings appear)
- Google Maps user generated content policy: prohibited and restricted content (review rules)
// last checked 12 Nov 2026. The weights and the five look-alikes are my own opinion; the report names come from Google.