Negative SEO attack: detect, document, recover

A negative SEO attack is a deliberate attempt by a third party to damage your search visibility or your standing in search results, usually through spam links pointing at your site, copies of your content, spam pages planted on your site, or pages built to rank for your name. The defensive answer has four parts: rule out ordinary causes first, document what you see, use the remedies the search engine itself documents, and recover your own site if it was hacked.

Most people who suspect an attack do not have one. A drop in traffic or a bad result for your name is far more often the product of a site change, a ranking update, a hacked page or a genuine third-party article. Treating an ordinary problem as an attack wastes weeks and can make things worse, because the most popular "fix", a blanket disavow of links, is the one Google's own documentation warns against.

This guide is about defense and audit only. It describes how to tell what is happening, what evidence to keep, which documented tools apply and which do not, and what to do when your site has been compromised. It says nothing about how attacks are carried out. It is information, not legal advice, and a lawyer decides which legal route fits your facts. Policies are described as the pages read for this guide state them, with the source named.

The short version

Rule out the boring causes before you suspect an attack: your own site changes, a manual action, a security issue, a ranking update, or a real article about you. Search Console reports on the first three.
Use only the remedies the search engine documents: the manual actions and security issues reports, the disavow tool for a narrow set of cases, and the spam report form.
A hacked site is the most damaging case that is fully in your control. Fix every affected page, then request a review and describe what you fixed.
Keep a dated evidence log from the first day. It supports every report and every conversation with a host, a lawyer or a client.

What counts as a negative SEO attack, and what does not

A negative SEO attack is hostile action by someone else that harms how a site or a name appears in search. A bad result that exists because someone published an accurate article about you is not an attack, and neither is a drop caused by your own redesign. The label matters because the remedy depends on it.

Four situations get called negative SEO in practice. Each is different in cause, evidence and route.

Spam links pointing at your site. Links you did not build, from pages you do not recognize. This is the case most people mean, and the one where the documented remedy is narrowest.
Spam placed on your site. Pages, links or redirects that someone added without permission. Google calls this hacked content, and it is a security problem before it is a search problem.
Copies of your content. Your text republished elsewhere. Google's spam policies describe scraping as taking content from other sites and republishing it to manipulate rankings.
Pages built to damage your name. Fake or hostile pages that rank when people search for you or your brand. This one is a reputation problem that happens to use search, and it is the one that most often needs the suppression and removal routes rather than the webmaster tools.

The first three are about your site's health. The fourth is about what people see when they search your name, and it uses different tools.

Rule out the ordinary causes first: a decision table

Start from the symptom, not the suspicion. The table maps what you see to the usual cause, the first thing to check and the route that follows. The checks use free tools that Google provides to site owners.

What you see	Most likely cause	First check	Route
Traffic fell on a date you can name	A site change, a ranking update or a manual action	Your change log, then the Manual actions report	Fix the cause. A manual action has its own review process
Strange pages or text in results for your site	Hacked content	Security issues report, then a search of your own domain	Fix every page, then request a review
A flood of links you do not recognize	Spam links, often harmless	Manual actions report for an unnatural links action	Do nothing unless there is an action or a clear risk of one
Your text appears on other sites	Scraping	Confirm which copy was published first	Spam report, host report, or a copyright notice
A hostile page ranks for your name	Third-party content	Is it false, unlawful or against a platform rule?	Removal if it qualifies, otherwise suppression with accurate pages
Fake reviews or a wave of ratings	A review attack	The platform's own reporting channel	A separate procedure, not a webmaster tool

Write each result in your log before moving to the next row.

Two Search Console reports answer most of the question

Search Console is the first place to look, because the search engine tells you there what it has decided about your site. Two reports matter here.

The Manual actions report.

A manual action means a human reviewer at Google has decided that pages on your site do not comply with its spam policies. Google's Manual actions report help page says you are alerted in the report and in the Search Console message center, and that the report shows a count of current manual actions at the top. Affected sites may rank lower or not appear at all, according to the spam policies page.

If the report shows no action, the search engine has not penalized your site by hand. That does not rule out an automated demotion, but it does remove the scenario in which a pattern of paid or manipulative links has been judged to be yours.

One manual action is relevant to link attacks: unnatural links to your site. Google's wording is that it "has detected a pattern of unnatural, artificial, deceptive, or manipulative links pointing to your site." The recommended steps on the help page are to download your links from Search Console, identify the ones that break the link spam policy, ask the site owners to remove them or mark them nofollow, and disavow those you could not get removed.

The Security issues report.

The Security issues report shows when Google finds that your site was hacked or could harm visitors. It names three families: hacked content, which Google defines as content placed on your site without your permission because of security vulnerabilities; malware and unwanted software; and social engineering, meaning content that tricks visitors into risky actions. The sections on hacked sites below start from this report.

If either report shows an issue, you have a defined problem with a defined review process. If both are empty, you are looking at an ordinary ranking change or at third-party content, and the right move is usually patience and measurement, not a drastic change to your site.

Spam links: when Google says to disavow and when it does not

For most sites under a spam link wave, the correct action is to document and wait. Google's disavow help page says that in most cases Google can assess which links to trust without additional guidance, so most sites will not need the tool. It says to use it when you have many spammy or low-quality links pointing to your site and those links have caused or will likely cause a manual action against your site. The manual actions page, for its part, tells you to ask site owners to remove links first.

That gives you a two-part test, and both parts must be true.

Volume and quality. Many links, and clearly spammy or low quality. A handful of odd links is not a case.
Consequence. A manual action exists or is likely. The Manual actions report is the evidence for "exists". For "likely", the honest question is whether the pattern looks like links built to manipulate rankings, attached to your site, which is what the link spam policy covers.

Google's manual actions page adds a warning that matters for anyone tempted to disavow everything: "Simply disavowing all backlinks without attempting to remove them might lead to rejection of your request." The disavow help page also says the tool is advanced, should be used with caution, and can hurt your performance in search if used incorrectly.

What the Links report can and cannot show you

The Search Console Links report lists external links by top linking sites, top linked pages and top linking text. Its own help page says it is not a comprehensive list of every link, that tables are limited to 1,000 rows, that data may be stale, and that it does not show whether a link is marked nofollow. So it can show a pattern, but it cannot prove the absence of one.

100,000 linesmaximum size of a disavow file, which must also be under 2MB

1,000 rowscap on each table in the Search Console Links report

Days or weekshow long Google says most review requests take

From Google's disavow links tool, Links report and Manual actions report help pages. The manual actions page adds that link-related requests may take longer.

How to build and submit a disavow file if your case meets the test

If a manual action for unnatural links exists, or your evidence says one is likely, the file is the last step, after you have tried to get links removed. The format comes from Google's help page.

Disavow file, as Google documents it

Export from the Links reportDownload your links from Search Console, as the manual actions page recommends. Keep only the lines you actually intend to disavow when you build the file.
Try removal first and keep proofContact the owners of the sites and ask them to remove the links. Record the date and the reply. Google's manual actions page asks for documentation of removed links and an explanation of any you could not remove.
Write one entry per lineUse one URL or one domain per line. To disavow a whole domain, prefix it with domain:, for example domain:example.com. Lines beginning with a hash are comments and are ignored.
Check the file limitsA plain text file encoded in UTF-8 or 7-bit ASCII, with a name ending in .txt. Maximum 100,000 lines including blank and comment lines, 2MB, and 2,048 characters per URL.
Upload to the right propertyYou must be an owner. Each property has one list, a new upload replaces the old one, and http and https versions need separate lists. The tool does not support Domain properties. Errors are shown immediately and the old list stays in place.
Wait, and keep the recordsGoogle says incorporating the list can take a few weeks. Disavowed links remain visible in the Links report. To undo, use Cancel Disavowals or upload a replacement list.

If you hold a manual action, the final move is Request Review. Google's manual actions page asks you to describe the problem, the steps you took and the results. Google asks you not to resubmit while a request is pending, so file it once, when the work is finished.

Hacked content: the attack you can fully recover from

Hacked content is the most direct way someone else can damage a site, and it is also the one you can reverse completely. Google's spam policies define it as "any content placed on a site without permission, due to vulnerabilities in a site's security." The policy lists code injection, content injection and redirects as examples. In each case the owner is often unaware, because the added material may be built to be seen by search engines or by only some visitors.

How to notice it

Do not rely on browsing your own site as a visitor. Check the Security issues report, search your own domain for pages or text you did not write, and read the Search Console message center. Visitors reporting redirects are also worth recording.

The recovery order

Stage	What you do	What you keep	What goes wrong
1. Contain	Tell your host and your developer. Change every credential for the site, the host and the content system	A dated note of what you changed	Fixing pages while the way in is still open
2. Scope	Use the sample URLs in the report, then look for more. Google notes that the sample list may be incomplete	List of every affected page and file	Fixing only the pages the report names
3. Remove and close the gap	Remove the injected content and the weakness behind it, from every page	Before and after copies	Removing content but leaving the vulnerability, so it returns
4. Test	Recheck the pages and the report	Test results	Assuming it is done
5. Request review	Select Request Review in the report once every issue is fixed on every page	The request text	Requesting early, which Google says can lengthen later reviews

Google's Security issues help page says to fix the issue throughout the site, because fixing only some pages will not restore your search results. It says a good request explains the exact issue, describes the steps taken and documents the outcome, and that submitting before the problem is fixed can lengthen future review times. Most reviews take several days or weeks, and Google emails you when the request is received and when the review is complete.

Ask your host in writing for backups and logs: they help the recovery and show when a change was made.

Copies of your content and spam pages that mention you

When your text appears on other sites, three questions come first: which copy was published first, who hosts the copy, and whether the copy outranks yours. Google's spam policies include scraping as a violation, defined as taking content from other sites and republishing it to manipulate rankings.

Google's page on reporting quality issues gives the route. It offers a spam report form for spammy, deceptive or low-quality pages, and says reports help it improve spam detection and may be used to take manual action against violations. It also gives separate forms for malware and for phishing. Two practical rules follow from that page. Do not include personal information in the report, because Google says it will not process a submission that contains it. And remember that Google must send the submission text to the site owner, so write the report as if the owner will read it.

A spam report is an input, not a command: the page promises no result or time. Ownership of a copied article is also a copyright question, and a copyright notice is a separate legal route that was not part of the sources read for this guide. Take advice before filing one.

When the attack is on your name: separating the webmaster tools from reputation work

If a hostile or fake page ranks when people search your name or your company, the tools above will not remove it. Disavow concerns links to your own site. The spam report concerns violations of spam policies. A page that merely says something damaging about you is not a spam policy violation, and an accurate article about you stays up no matter how it ranks.

Sort the page into one of three groups before you act.

Content that is false, unlawful or against a platform rule. This has removal routes: a platform report, a publisher request, a legal letter or a search engine request. Each depends on the facts and the country.
A fake site or profile impersonating you or your brand. This has its own reporting channels with registrars, hosts and platforms, different from the ones in this article.
Accurate or lawful content that you dislike. No webmaster tool will touch it. The honest route is to publish better, accurate pages about you, which the page on suppression describes in outline. It does not delete anything, and it works slowly if at all.

A true, lawful result you dislike is not an attack, and nobody should help you hide accurate information about wrongdoing that is in the public interest.

A worked scenario with a realistic timeline

This is an invented scenario with generic parties and assumed facts. A small consulting firm sees its organic traffic fall about a third over two weeks. A new employee also reports that searching the firm's name shows odd page titles in the results for its own domain.

The owner's first assumption is a link attack. The log below shows why the first assumption is rarely the right one.

Day	Action	Finding
1	Check Manual actions and Security issues reports. Write the dates of the traffic drop and of the last site change	No manual action. A hacked content issue is listed, with sample URLs
1	Search the firm's own domain for unfamiliar page titles. Save screenshots and addresses	Dozens of pages the firm never wrote, none linked from the menu
1 to 2	Contact the host, reset every credential, ask for logs and backups	Host logs show the date the files first appeared
2 to 5	Remove every injected page and close the weakness identified with the developer. Recheck the full domain	Further injected files found in two folders the sample list did not include
6	Confirm the report issues are fixed on all pages, then file Request Review with the exact issue, the steps and the outcome	Review pending
Some days or weeks later	Google emails when the review is complete. Traffic is tracked weekly	Recovery is gradual and may not match the old level

The link wave the owner noticed was real but incidental. There was no manual action, so the disavow tool was not used. Had the owner uploaded a file listing every linking site on day one, the hacked pages would still have been live, and the review request would have been premature.

What fails and what backfires

Most of the damage in these cases is done by the response, not the attack.

Disavowing everything. Google's manual actions page says disavowing all backlinks without attempting to remove them might lead to rejection of your request. The disavow tool is for a narrow case, not routine hygiene.
Fixing part of a hacked site. Google says partial fixes do not restore results. Treat every page and file as in scope until proven otherwise.
Requesting review early. For both manual actions and security issues, Google asks you not to resubmit while one is pending. For security issues it adds that submitting before the problem is fixed can lengthen later reviews.
Retaliating. Do not respond to a suspected competitor with links, copies or fake content of your own. That can breach the same policies, expose you to a manual action or legal claims, and it is the opposite of defense.
Contacting a suspected attacker. A message confirms you noticed and can complicate any legal route. Keep your communication with hosts, platforms and counsel.
Calling an accurate article an attack. A lawful, accurate result will not be removed by a spam report, and a report that misdescribes it wastes your credibility with the platform.

Build an evidence log and a monitoring routine

An evidence log is a dated record kept from the first day. It is the most valuable thing you can build, because every route in this article asks for facts: when, what, where and what you did.

Record at least the following: the date you noticed the problem and the dates of the last site changes; addresses of suspect pages and links, saved as text; screenshots with the date and time; the contents of the Manual actions and Security issues reports on each check; copies of every report you file with its reference number; and every reply. Keep the log somewhere that does not depend on the site you are protecting.

A routine keeps small problems small. Check the Manual actions and Security issues reports on a fixed schedule, review your Links report export and note the pattern rather than chasing single links, search your own domain for pages you did not publish, and review comments and public profiles. Keep your genuine pages complete and current, because strong, accurate pages about you are the lasting defense against anything that targets your name. Reputation Partners monitors search and AI answers on this principle: a dated baseline and a regular check.

What to do this week

If this is happening to you now

Open the Manual actions and Security issues reports today and write down what they say, with the date. If either lists an issue, follow its review process. If both are empty and you still see a damaging result for your name, a monitoring baseline will show what is changing and when. See reputation monitoring.

Questions people ask

Can a competitor really hurt my rankings with bad links?

Google's disavow page says most sites will not need the tool and that Google can usually judge which links to trust on its own. That does not prove no one can be harmed. It means that a link wave on its own is not a reason to act. Check for a manual action, keep evidence, and use the documented remedy only if one exists.

Should I disavow every spam link I find?

No. Google's disavow page says to use the tool when many spammy or low-quality links have caused or will likely cause a manual action, and its manual actions page asks you to try removal first. Its manual actions page also warns that disavowing all backlinks without attempting removal might lead to a rejected request. A broad file adds risk without a documented benefit.

How do I know if my site has been hacked?

Look at the Security issues report in Search Console, search your own domain for pages or titles you did not publish, and ask your host to check logs. Google defines hacked content as content placed on a site without permission through security vulnerabilities. Visitors who report redirects or warnings are also a signal.

How long does Google take to review a site after I fix it?

Google says most reviews take several days or weeks, and that link-related requests may take longer. It emails you when the request is received and when the review is complete. Do not resubmit while a request is pending. Fix every affected page before you request, and describe the problem, the steps and the outcome.

Can I report someone for spamming or copying my site?

Yes. Google offers a spam report form, and separate forms for malware and phishing. It says reports may be used to improve detection and to take manual action, but it promises no result or time. Do not include personal information, and remember that Google must send the submission text to the site owner.

Will a spam report remove a damaging page about me?

Not unless the page breaks a spam policy. A page that is critical, accurate or lawful stays in results even if it ranks well. Removal depends on whether the content is false, unlawful or against a platform rule, and each has its own route. A spam report is for manipulation of rankings, not for content you dislike.