Blog Comment Spam Attack

What a blog comment spam attack is

A blog comment spam attack is the automated posting of large volumes of comments across blogs, news sites and anything else with an open comment form, where each comment carries a link to — or simply names — a site the attacker wants to damage. It is ordinary comment spam turned inside out. Instead of promoting the spammer's own property, the run promotes somebody else's, so that the target appears to be running a crude and obvious link campaign.

Two variants fail for different reasons and should be kept apart.

• The link variant. Each comment embeds a hyperlink to the target, usually with commercial or adult anchor text, posted at volume across unrelated sites. The intended signal is a link profile — the whole inventory of pages elsewhere on the web that point at a site — that a spam classifier or a human reviewer reads as a scheme the target bought.
• The association variant. The comment does not link at all. It repeatedly names the target brand next to toxic subject matter: pharmaceuticals, gambling, adult content, scams. The intended effect is contamination at the level of the entity rather than the link — brand-name searches surfacing junk, or the business becoming associated with categories that suppress it.

Both variants depend entirely on the target having no control over the sites where the comments appear. That absence of control is exactly the reason the attack does not work, because it is also the reason Google does not hold the target responsible for what is posted there.

January 2005: the countermeasure shipped before the attack did

This vector has the cleanest kill date in the whole catalog, because the countermeasure was built for it specifically and shipped more than twenty years ago.

On 18 January 2005, Matt Cutts of Google and Jason Shellen of Blogger announced rel="nofollow" in a post titled, without ambiguity, "Preventing comment spam". The mechanical statement was that "when Google sees the attribute (rel="nofollow") on hyperlinks, those links won't get any credit when we rank websites."

The next sentence is the one that decides this page:

This isn't a negative vote for the site where the comment was posted; it's just a way to make sure that spammers get no benefit from abusing public areas like blog comments, trackbacks, and referrer lists.

Read that as a design decision, because that is what it is. Google chose to make the spammed link worthless rather than toxic. A link carrying no credit also carries no penalty. An attacker firing nofollowed comment links at a target is, by the deliberate design of the attribute, firing blanks.

Adoption followed immediately and by default rather than by anyone's choice. WordPress applied nofollow to user-submitted links, comment author links included, from version 1.5 in 2005. Because WordPress powers a very large share of the world's comment forms, the default state of a comment link on the open web became "not counted" within months of the announcement. In September 2019 Google added rel="ugc" for user-generated content and now recommends comment platforms use it, which refines the labeling but does not change the outcome: the link does not carry an endorsement.

So an attack invented after 2005 has been aiming, its entire life, at a signal that was switched off before it was conceived.

The one manual action in this story points at the blogs

The structural argument is stronger than the historical one, and it is the part most write-ups miss.

Google's spam policies define the situation precisely, and the definition names the party at risk:

User-generated spam is spammy content added to a site by users through a channel intended for user content. Often site owners are unaware of the spammy content.

There is a corresponding manual action — a penalty a human reviewer at Google applies by hand and reports to the site owner in Search Console — called "User-generated spam", and Google's manual actions documentation describes it as issued when "Google has detected spam on your pages submitted by site visitors." It goes to the blog that let the spam through.

Now look for the mirror image. There is no manual action for being mentioned in somebody else's comment section. Google has never documented one, has never announced one, and the vocabulary it uses for spam links — ignored, discarded, neutralized — describes removing a link's value rather than passing a penalty along it. Every enforcement path Google publishes on this subject runs from the spam to the site hosting it. None runs from the spam to the site named in it.

Gary Illyes of Google addressed the exact payload of this attack at Pubcon Florida in March 2019, in remarks reported by Search Engine Journal. He said he had examined hundreds of supposed cases of negative SEO and found none where it was the genuine cause, and on inbound spam specifically:

If you have a bunch of unnatural porn links pointing at your site, don't worry about it... The worst thing that would happen is that you might rank better.

That is adult and pharmaceutical anchor text pointed at an innocent site, which is the literal contents of a comment run, and Google's answer is that the realistic worst case is nothing. I will note the honest limit anyway: Google's written assurances on third-party harm are phrased as effort rather than as a guarantee, and no case has ever been published in which a site was penalized for comment links it did not create. That is an absence of evidence over twenty years, not a proof of impossibility.

The part of this you can actually be penalized for

If a site owner spends a week disavowing inbound comment links while their own comment section fills with junk, they have inverted the real risk exactly.

The comment section on your own site is the only part of this attack with a documented enforcement path attached, and it is the part you control. Attackers who understand the mechanism frequently spam the target's comment form as well as the wider web, precisely because that is where a penalty is available.

The work is unglamorous and it is the whole job:

• Turn on moderation, and require approval for first-time commenters.
• Confirm the platform emits ugc or nofollow on comment author links and on links inside comment bodies. Check the rendered source, not the settings screen.
• Remove accumulated spam from published comments and from any archive pages that reproduce them.
• Do not solve it by switching comments off. That trades a moderation problem for a loss of genuine engagement, and moderation was the cheaper fix.

Reading a comment run, and the four things it is mistaken for

In order:

1. Search Console, Manual actions. The decisive check. "No issues detected" means no human at Google has acted, no reconsideration request is available or appropriate, and the ranking change has another cause. If an action is present, read which one: "User-generated spam" means your own comment section is the problem and you can fix it; "Unnatural links to your site" is the inbound case and a different page.
2. Sample the HTML. Fetch twenty of the new referring URLs and read the rel attribute on the link. Overwhelmingly they will be nofollow or ugc. This single check ends most investigations and costs ten minutes.
3. Search Console, Links, Top linking sites and Top linking text. A comment run shows as a burst of low-quality domains with anchor text nobody at the company chose.
4. Search Console, Performance, with the drop date laid against Google's published update history.
5. Your own moderation queue. See above.

Four things get mistaken for this attack, and between them they explain most reports of it:

• Referrer spam — fake referrals engineered to appear in analytics reports. It never enters the search index and has no ranking effect whatsoever. A great many "my site is under attack" calls are this and nothing else.
• Trackback and pingback spam, which is a moderation nuisance on your own site rather than an inbound link event.
• A core update or spam update landing in the same week as the links were noticed. Coincidence in timing is not causation, and the update calendar is published.
• A technical regression — an accidental noindex, a robots.txt change, a broken canonical, an incomplete migration — which produces a sharper drop than any link event and is far more common.

What to do, in order, and why the first step is nothing

1. Do nothing about the inbound links, and mean it. Clean manual actions report, links marked nofollow or ugc, drop coinciding with a known update: no action is the correct action. Google's own disavow guidance says "in most cases, Google can assess which links to trust without additional guidance, so most sites will not need to use this tool."
2. Diagnose in the right order. Manual actions first, the published update calendar second, technical health third, the link profile last. Owners who work that list backwards talk themselves into a disavow file they never needed.
3. Clean your own comment section, which is the part with a penalty attached and the part you own.
4. Preserve evidence if a platform or legal complaint is plausible: dated Search Console exports, timestamped screenshots, and saved copies of the comments themselves. Blog owners delete spam, and the record goes with it.
5. Disavow only under Google's stated condition — a considerable number of spammy, artificial or low-quality links that "have caused a manual action, or likely will cause a manual action." Google calls the tool an advanced feature that "can potentially harm your site's performance in Google Search results" if used incorrectly.
6. File a reconsideration request only against an outstanding manual action. With a clean report there is nothing to reconsider.

What does not help: emailing hundreds of blog owners for removals; subscribing to link-detox monitoring; disavowing whole top-level domains; adding noindex anywhere; blocking Googlebot; or naming a suspected competitor in public.

When the words are the injury, not the links

The association variant is where this attack has any teeth, and the teeth are legal rather than algorithmic.

Where comments publish false statements of fact about a business — that it defrauds customers, that it sells something it does not — that is potentially defamation, and it belongs to the business as an ordinary claim rather than as a search problem. It is under-used, because owners route the whole matter to an SEO instead of to counsel.

Lanham Act section 43(a), 15 U.S.C. section 1125(a), covering false advertising and unfair competition, fits where a competitor is behind the run and the comments misuse the target's name or marks, or attach the business to products it has nothing to do with. Notice which facts each theory needs. Both turn on the text published beside the brand name, not on a measured ranking loss. That distinction is practical rather than academic: a ranking loss can only be proved from inside Google, while a comment can be proved from a browser and an archive. State consumer protection and deceptive trade practices statutes travel alongside the federal claim.

What is not available: Google's spam report process, which targets the blogs hosting the spam, returns nothing to the reporter and is not a remedy; and the Computer Fraud and Abuse Act, 18 U.S.C. section 1030, under which the blogs are the computers accessed rather than the target, so a framed business usually has no claim of its own.

I found no decided case establishing liability on a comment-spam fact pattern, and no court has held that a comment run moved a ranking. Attribution is the practical wall on all of it: every theory needs a defendant a court can reach, and most targets of an anonymous run cannot name one.

Where site owners lose money on this

• Mass disavowing on suspicion, which removes legitimate earned links along with the noise and reverses slowly and uncertainly.
• Panicking about inbound comments while ignoring their own comment form — the exact inversion of where the risk actually sits.
• Treating referrer spam as a link attack. It appears in analytics, never in the index, and does nothing to rankings.
• Reading a vendor toxicity score as a Google signal. Google publishes no such metric. John Mueller of Google said on X on 31 January 2023 that the agencies on both sides of this — the ones creating the links and the ones disavowing them — are "just making stuff up, and cashing in from those who don't know better."
• Turning comments off to solve a problem that moderation solves.
• Accusing a named competitor in public, which converts an SEO problem that was probably imaginary into a defamation exposure that is not.

Anyone selling a subscription that protects you from blog comment links is selling protection from a link type Google has declined to count since 2005. Comment spam is cheap to produce and highly visible in a dashboard, which makes it excellent material to sell a scare with, and I would not buy the scare. The correct response for nearly every established site is to moderate its own comments and to look elsewhere for the cause of the traffic loss. Google's spam policies describe link spam as something a party creates. You did not create these.

Frequently asked questions