Forum Profile Spam

What forum profile spam is, and whose problem it is

Forum profile spam is the automated mass creation of accounts on discussion forums, wikis, guestbooks and any other site that lets a stranger register, where each account carries a link in its profile page (the "About me", "Website" or "Homepage" field) or in the signature block appended to every post the account makes. One run produces thousands to hundreds of thousands of inbound links from low-quality sites, very often with the same commercial anchor text repeated on all of them.

Used as negative SEO, the run points at somebody else's site. The attacker is trying to manufacture a link profile — the complete set of pages across the web that link to a given site, which is what search engines read to judge how the site is regarded elsewhere — that looks bought. Enormous volume, unrelated forums, frequently non-English, frequently abandoned or compromised, all carrying money anchors. The hoped-for cause and effect is that Google reads that pattern as the target's own scheme and demotes or penalizes them for it.

Two different readers type "forum spam" into a search box and they want opposite answers. If you run a forum, forum spam is the junk your members post and it is your content problem. If you own the site being linked to, forum profile spam is somebody else's junk pointed at you, and you control none of it. This page answers the second reader. The distinction matters more than it sounds, because Google's enforcement lands almost entirely on the first.

The attribute that made these links worthless before they were created

The history is the argument here, and the decisive date is more recent than most write-ups admit.

On 18 January 2005 Google introduced rel="nofollow", a link attribute telling search engines not to pass ranking credit through a hyperlink. That announcement was explicitly about blog comments, not forum profiles, and honest copy should say so — the extension to forums came later and by documentation rather than by that post's own text.

The date that governs forum profiles is 10 September 2019, when the Google Search Central Blog — Google's official channel for search-ranking announcements to site owners — introduced rel="ugc" for user-generated content and rel="sponsored" for paid placements, and moved the whole family to a hint model. In its announcement of the change Google wrote that "by shifting to a hint model, we no longer lose this important information, while still allowing site owners to indicate that some links shouldn't be given the weight of a first-party endorsement." Nofollow became a hint for ranking purposes on 1 March 2020.

Google then told forum operators, in its own documentation on qualifying outbound links, exactly what to emit: "We recommend marking user-generated content (UGC) links, such as comments and forum posts, with the ugc value." Every forum platform of any consequence complied, and most had been emitting nofollow on profile fields for years before that.

So consider the sequence in an actual attack. A bot registers an account, fills in the homepage field, and the forum software writes the link out with ugc or nofollow already attached. The payload is labeled as discountable by the victim of the registration, at the moment of creation, before Google ever sees it. That is a strange kind of weapon.

It is worth being precise about what those attributes were designed to do. Google's stated purpose in 2005 was to make spammed links carry no credit — not to make them carry a negative vote against the page they point at. Worthless is not the same as toxic, and no Google documentation published since has described the second.

The ten-minute check that ends most of these investigations

Before diagnosing anything, sample twenty of the new referring URLs and read the actual HTML of the link. Not the backlink tool's summary of it, the source.

If the majority carry rel="nofollow" or rel="ugc", the analysis is over. Those links were never going to be counted, so removing them cannot restore anything and leaving them cannot be costing anything. I have watched site owners spend weeks and real money on a link profile whose source they never once opened.

The other checks, in the order they should be run:

• Search Console, Manual actions. The decisive one, and the one people skip. A manual action is a penalty applied by a human reviewer at Google and shown in writing to the site owner in this report. "No issues detected" means no human at Google has acted, no reconsideration request is available or appropriate, and whatever happened to the rankings has another cause.
• Search Console, Links, Top linking sites and Top linking text. A profile run shows as a sudden spike of many distinct low-authority domains, often clustered on a few top-level domains or hosting ranges, with anchor text nobody at the company would have chosen.
• Search Console, Performance, compared against the drop date and Google's published update history. A drop landing on a documented core update rollout is a core update.
• Server logs and CDN analytics. Registration bots generate real traffic even when their links generate nothing.

What a profile-spam spike gets mistaken for is long and mundane: a core update the same week, a seasonal pattern, a migration fault, a noindex shipped to production by accident, the loss of one valuable referring page, or a competitor who simply got better. Those account for the large majority of suspected attacks I am asked to look at.

Penguin discounts links; it does not demote sites

Penguin is Google's link-spam ranking system, launched in April 2012, and its original architecture is the reason this attack ever sounded plausible. In its first form Penguin applied a site-level demotion in periodic refreshes: bad links could drag down a whole site, and recovery meant cleanup plus a wait for the next refresh. If bad links can demote a site, pointing bad links at a rival is at least a coherent plan.

That architecture ended on 23 September 2016, when Google folded Penguin into its core algorithm, made it real-time, and changed the treatment of spam links from site-level demotion to granular devaluation: the links are discounted and stop counting, rather than the site being marked down.

Once the response to a spam link is ignore the link, an attack whose entire payload is spam links has no mechanism left to work through. Google's public vocabulary for bad links has not shifted since: neutralized, discarded, ignored, lost. Not one of those verbs describes transferring a penalty to whoever a link points at.

Gary Illyes of Google, speaking at Pubcon Florida in March 2019 and reported by Search Engine Journal, said he had examined "hundreds of supposed cases of negative SEO" and that in none of them was negative SEO the genuine cause of the damage. That is a Google engineer describing a null result over a large sample, which is about as good as evidence gets on a question where the mechanism is proprietary.

Here is the honest limit of that. Google's assurances on this subject are worded as effort — the documentation says Google works very hard to make sure that actions on third-party sites do not negatively affect a website — and effort is not a guarantee. The SEO industry reads that hedge as an admission; Google reads it as a description of engineering. Both readings survive the sentence, and I will not pretend the sentence is stronger than it is.

What it actually costs you, which is usually not rankings

The residue is real, but it sits somewhere other than where people look for it.

• Hosting and bandwidth. A very large run against a small site on shared hosting produces genuine bot and referral traffic that costs money or destabilizes the server. That is an infrastructure problem with an infrastructure fix, and it has nothing to do with search rankings.
• Vendor "toxicity" scores. A profile run reliably wrecks the Toxic Score or Spam Score a commercial backlink tool computes. Those are vendor inventions with no counterpart inside Google, which publishes no such metric and never has. But they are what agencies, prospects and acquisition analysts look at, so the embarrassment is real even when the ranking effect is zero. Most reports that "the attack worked" turn out, on inspection, to be reports that a vendor score moved.
• Attention. The largest cost by a wide margin is the time and fee spent cleaning up links that were never counted, and that is a cost the site owner chooses.

The conditions under which a run might still bite are narrow: a site already carrying an unresolved manual action for unnatural links, where a reviewer is reading the profile with suspicion already engaged; and, as industry consensus rather than demonstrated fact, a brand-new domain where the spam run is proportionally most of what Google knows about the site. That second claim is repeated everywhere and has never, as far as I can find, been shown in a disclosed, reproducible experiment. Treat it as plausible, not established.

How it is undone, beginning with doing nothing

1. Do nothing, deliberately. For the great majority of cases this is correct, and it is the hardest instruction to accept mid-emergency. Clean manual actions report, links marked nofollow or ugc, traffic change lining up with a known update: the correct action is no action.
2. Confirm the diagnosis before touching the link profile. Manual actions, then the update calendar, then technical health, then links. Site owners who reverse that order disavow their way into a worse position than the attack ever put them in.
3. Preserve evidence early if a platform or legal complaint is in prospect: dated Search Console exports, timestamped screenshots, hosting and registration records. Forum operators purge spam accounts and the record evaporates within weeks.
4. Harden the perimeter if server load is the actual harm.
5. Disavow only under the documented condition. Google's guidance on the disavow tool restricts it to a considerable number of spammy, artificial or low-quality links that "have caused a manual action, or likely will cause a manual action," and states that "in most cases, Google can assess which links to trust without additional guidance, so most sites will not need to use this tool." Google calls it an advanced feature that "can potentially harm your site's performance in Google Search results" if used incorrectly. Absent a manual action, a disavow file is at best inert.
6. File a reconsideration request only if a manual action exists. With a clean report there is nothing to reconsider and no queue to join.

What does not help, bluntly: chasing individual removals from forums that will delete the accounts anyway; buying a link-detox subscription; disavowing whole top-level domains; blocking Googlebot; or publishing a post accusing a competitor.

Where a complaint can go, and where it stops

Recourse on this vector is thinner than on almost any other, and a reference that implies otherwise is doing the reader harm.

Google's spam report process targets the forums hosting the spam, not the party who ran the bot, and it produces no notification and no outcome for the reporter. Filing one is a civic act, not a remedy. Individual forum abuse contacts work one at a time and are hopeless at the scale these runs operate.

On the statutes, note who the victim actually is. The Computer Fraud and Abuse Act, 18 U.S.C. section 1030, has been argued against automated account creation that defeats a site's access controls — but the computers accessed are the forums. The site being framed is not the accessed system and generally has no claim of its own under that theory.

The federal theory counsel reaches for is Lanham Act section 43(a), 15 U.S.C. section 1125(a), covering false advertising and unfair competition, where a competitor is behind the run and the spammed profiles misuse the target's name or marks. Note what it turns on: the text published in the profiles and posts, not the ranking effect. A claim built on "my rankings fell" needs evidence of what Google's systems did with the links, which no private plaintiff can obtain. A claim built on what the pages say needs only the open web, where the pages sit. State-law tortious interference is the traditional alternative.

I located no decided case establishing liability on a forum-profile spam fact pattern, and no court has held that such a run moved a ranking. Every theory above needs a defendant a court can reach, and anonymous, offshore, bot-sourced runs rarely produce one. A victim who cannot name the attacker is not choosing between causes of action. They are choosing between an investigation and a cleanup.

What people get wrong about profile links

• Disavowing on suspicion. The most common and most expensive error on this vector. A wide disavow file removes legitimate links the site actually earned, and the damage is slow to reverse.
• Believing the count. Forty thousand profile links from four thousand junk forums is a large number describing a small event. Volume is the attack's only product and it is the product Google's systems are built to disregard.
• Filing reconsideration requests with nothing outstanding, then reading the silence as Google ignoring them.
• Paying a monthly fee for toxic-link monitoring. Anyone selling you ongoing protection against forum profile spam is selling you protection from a mechanism that Google's own spam policies describe as a violation committed by the party creating the links. You did not create them.
• Blocking crawlers too broadly in robots.txt while trying to stop scrapers, and deindexing the site by hand.
• Naming a competitor publicly, which converts a search problem that was probably not real into a defamation exposure that certainly is.

Frequently asked questions