Negative SEO removal, and how a recovery actually proceeds

The sequence, and why skipping to the end is the expensive mistake

Recovery from a suspected negative SEO attack is a sequence, and the sequence is not negotiable: establish whether anything happened, establish what it touched, then remediate in order. Nearly every expensive failure here comes from jumping to the third step - buying a link cleanup or a toxic-backlink audit before anyone has established that a hostile act occurred, and before anyone has dated it.

The first check takes a minute and settles most cases. In Search Console, Google's free reporting console for verified site owners, open the Manual actions report. A manual action is a penalty applied by a human reviewer at Google, issued, in Google's words, when "a human reviewer at Google has determined that pages on the site are not compliant with Google's spam policies" (Google, Manual Actions report). A green check mark and "No issues detected" means nobody at Google has acted against your site: there is no penalty to lift, no reconsideration request to file, and nothing for a disavow file to reverse.

Then read the Security Issues report, which covers a different class of problem - hacking, malware and phishing - and has its own review flow. Between them those two reports answer the only question that changes what happens next: has something been done to this site that Google is acting on, or has this site's ranking simply moved?

I sell negative SEO recovery work, never attacks, and I put the diagnosis in public because it is the part a site owner can do alone and the part that most often makes hiring anyone unnecessary.

When you do not need this, said plainly

Here is the sentence that will save more readers of this page more money than anything else on it.

If your rankings fell on a day Google confirmed a core update, and your competitors moved on the same day, nothing was done to you - and paying anyone, me included, to clean up your links will not bring that traffic back.

That is the documented state of the mechanism, not modesty. Announcing on 23 September 2016 that Penguin had become part of the core algorithm, Google wrote that "Penguin now devalues spam by adjusting ranking based on spam signals, rather than affecting ranking of the whole site," with changes taking effect "shortly after we recrawl and reindex a page" (Google Search Central). That moved the default outcome of an inbound link attack from demotion to discount - from something you must undo to something that undoes itself on the next crawl. The December 2022 link spam update extended the same treatment through SpamBrain, Google's machine-learning spam detection system. Reported by Search Engine Journal on 2 February 2023, John Mueller wrote of the agencies on both sides of the link trade that they "are just making stuff up, and cashing in from those who don't know better."

The counterweight, because a page quoting only the reassuring half is a sales page in reverse: Mueller has also said, in a Search Central video reported on 1 November 2021, that where Google's systems "can't isolate and ignore these links across a website" and see "a very strong pattern," the algorithms can conclude they have "kind of lost trust with this website." That residual case describes a site whose whole profile is indistinguishable from spam, with nothing legitimate left to isolate the junk from - not the ordinary business reading this at nine at night.

Dating the event, because a real event has a date

An attack is an event, and its date is the most discriminating evidence available to you. Remediation aimed at the wrong month cannot work even when the remediation itself is sound.

• Plot clicks and impressions by day, separately. Both falling on one day is an event. A gradual slope over months is not - that is competition, decay or seasonality.
• Compare the step date against published update dates. A drop landing on a confirmed core or spam update is an update until proven otherwise, and the burden sits with the attack theory.
• Check the scope. A broad fall across a whole query category is almost always algorithmic. A loss confined to a handful of URLs is where an attack is plausible and the evidence obtainable.
• Only now look at links, and at first-seen dates rather than totals. Links discovered after the drop cannot have caused it, though a tool surfacing them the same week will make them look as though they did.

The full triage is in the guide to telling an attack from an algorithm update.

Establishing what was touched, not who did it

Once the event has a date, the next question is which surface it touched - not which enemy. Attribution is emotionally urgent and operationally near-useless in week one: scope determines the remediation, identity determines only whether there is a legal track later.

• Your own server and pages. Injected links, hidden text, cloaked pages, redirects firing only for Googlebot. This is a compromise, it shows in Security Issues or as a cloaking or outbound-link manual action, and it is the one category where the damage is unambiguously real. See hacked site injection.
• Your URLs inside someone else's index entry. A canonical claim from a copied page, a live proxied clone, a redirect chain, a fraudulent copyright complaint. Visible in URL Inspection's Google-selected canonical field, not in a backlink tool. See canonical hijacking and fake DMCA takedowns.
• Platform records about your business. A profile edited, suspended, flagged permanently closed, or buried under fabricated reviews. None of it is an SEO problem and nothing in a link file touches it.
• Your inbound link profile. Last on purpose: the surface everyone checks first and the one least likely to be the cause.

Preserve the evidence before it changes. Export referring domains with first-seen dates, the anchor-text distribution, a dated Performance export, and full-page captures of anything hosted elsewhere - today. Backlink indexes rewrite themselves and spam pages get taken down; a screenshot from month three is not evidence of month one. Method in the guide to preserving evidence.

The remediation, in the order that works

With a date and a scope, the work has an order, dictated by what actually reverses each kind of damage.

1. Close the entry point first. On a compromised site nothing counts until the attacker is out and cannot return - credentials rotated, the vulnerable component patched, unknown admin accounts deleted, injected content gone from every page rather than the sample you found. Cleaning symptoms with the hole open produces the failed-review loop that keeps sites penalized for months.
2. Reclaim ownership signals where an index entry was taken. Absolute canonical tags with fully qualified URLs, consistent internal linking, honest status codes, and against a live proxy, blocking its ability to fetch the origin at all. A disavow file does nothing here, and neither does a JavaScript redirect, because Googlebot never runs it.
3. Use the platform's own process for platform damage. A counter notification for a false copyright removal, the review-reporting flow for fabricated reviews, the redressal form for a falsified listing. These are the remedies documented incidents were actually resolved by, and none lives in an SEO tool.
4. Attempt link removal only where removal is plausible. A real publisher with a monitored inbox is worth one polite written request, kept on file; a mass-generated cluster on abandoned forums and hacked pages is not. Never pay a removal demand: it funds the next round and marks the address as responsive. See link removal extortion.
5. Disavow only against Google's two-part test. Google says to disavow "only if: 1. You have a considerable number of spammy, artificial, or low-quality links pointing to your site, AND 2. The links have caused a manual action, or likely will cause a manual action, on your site," under a heading reading "Step 0: Decide if this is necessary" (Google, Disavow links to your site). Note the AND. Every entry that is not part of the documented attack is a legitimate link voluntarily discarded. Mechanics in the disavow file guide.
6. File the review once, when the fix is complete and crawlable. Google states that "fixing the issue on just some pages will not earn you a partial return to search results." Write it as evidence a reviewer can check in two minutes, not as an argument. See manual actions and reconsideration requests.
7. For most readers, stop at step zero and build. With no manual action, no security issue and no hijacked index entry, the fastest recovery is the one where no link remediation is attempted, because there is nothing to recover from and every action adds a variable to a diagnosis that was already unclear.

The clocks, and the one that does not exist

I will give you the published review windows and not a recovery date, because Google publishes review times and nobody publishes recovery times. Google's own figures: a security review "can take from a few days to a few weeks to complete," with spam hacks needing "up to several weeks"; warnings clear "within 72 hours" once a site is found clean; "most reconsideration reviews can take several days or weeks, although in some cases, such as link-related reconsideration requests, it may take longer than usual"; and a disavow list takes "a few weeks for Google to incorporate" into the index.

What nobody publishes, Google included: how long rankings take to return afterward, or whether they return. A revoked manual action restores eligibility, not position; a lifted malware warning stops the interstitial and says nothing about traffic. Conflating those clocks is how a successful remediation gets mistaken for a failed one. The scenario-by-scenario list, quoted, is in the guide to negative SEO recovery time. There is also no way to accelerate a review queue; a vendor describing one is describing something that does not exist.

What does not help, including things sold as help

A recovery page listing only actions is half a page. These are the things I decline to do, for the same reasons a site owner should decline to pay for them.

• Filing a reconsideration request with no manual action outstanding. Nothing is outstanding for a reviewer to revoke, so a favorable review would change nothing. The most common wasted action in this field.
• Mass disavowal on suspicion, generated from a tool export at domain level. It fails Google's stated criteria on its face and discards real links with the junk.
• Treating a vendor toxicity score as a finding. No search engine publishes such a score and no vendor's is calibrated against Google's behavior. It is an opinion sold as a metric.
• Toxic-link monitoring subscriptions producing a monthly list of links Google has already discarded. Monitoring has one legitimate purpose - dated evidence collected before you need it, covered in backlink monitoring alerts - and it is not a defense, because nothing is being defended.
• Blocking the linking sites at the firewall. They are not visiting you. Links are not requests.

Two things this practice does not do at all. I do not run attacks, broker them, or advise on running them - the exposure that creates is set out on the page asking whether negative SEO is illegal. And no guaranteed rankings, no guaranteed traffic, no promised recovery date: recovery cannot be guaranteed by anyone, and the industry's signature tell is pretending otherwise.

How an engagement actually starts

It starts with the same two reports you can read yourself, plus a dated Performance export and, where one exists, the referring-domain export with first-seen dates. From that I can usually say on the first pass which of four things you have: an algorithmic movement with no hostile act behind it, a compromise, a hijacked index entry, or a platform-process attack. Those are four different pieces of work at four different costs, and which one you have is visible in Search Console rather than a matter of opinion.

Where the answer is the first of the four, I say so, and there is no engagement to sell. That happens often enough that I would rather it be printed here than discovered in an invoice. Where it is one of the other three, what an engagement covers and what structurally drives its cost is set out on the services page. I have been working in search since 1996, which mostly means I have watched this particular fear be true, stop being true, and go on being sold.

If you have read this far and you still think something was done to your site, the useful next step is a short message rather than a form. Tell me what changed, the date it changed, and what you have already checked — the manual actions report, the security issues report, and whether your competitors moved on the same day. I will tell you what the evidence supports, including when it supports doing nothing. You can get in touch here.

Frequently asked questions