Negative SEO attack: the five forms it takes, how to detect one, and what to do about each

A negative SEO attack is a deliberate effort by a third party to damage another site's search performance. It takes five forms: a flood of spam links, copying your content across other sites, hacking your site to insert spam, sending fake link removal or takedown requests, and abusing your server with bot traffic. Most traffic drops are not attacks, so check the common causes first. If one is real, the response depends on the form, and for most sites it is monitoring and clean up, not a long disavow file.

What Google says about it

Google's help page on the disavow tool states that Google works very hard to make sure that actions on third party sites do not negatively affect a website. The same page calls the tool an advanced feature, says it should be used with caution, and says that in most cases Google can assess which links to trust without additional guidance, so most sites will not need it. Treat that as the starting position: a pile of odd links pointing at you is usually ignored, and your job is to know the few cases when it is not.

First, rule out the ordinary causes

Attacks are rare, and a drop is far more often a change on your own side. Work through the diagnostic in why did my traffic drop first: a site change, a tracking fault, a migration, a seasonal swing, or a Google update. Then open Search Console and look at two reports.

• Manual actions. A listing here means a person at Google found a violation, such as unnatural links to your site.
• Security issues. A listing here means Google found hacked content or malware.

If both are clean and the drop matches a date you changed something, it was not an attack.

The five forms and the response to each

1. Spam links

Thousands of links from gambling, adult or pharmacy sites appear with exact match anchor text. Export your links from Search Console and from a link index, sort by the date first seen, and look for a sudden spike from unrelated domains. Google's spam policies treat link schemes as violations by the site that builds them, and your first step is the one Google names: ask for the worst links to be removed where you can find a contact. Use disavow only if you have a manual action for unnatural links or a large run of clearly artificial links, and file it by domain. A disavow file full of guesses can remove links that were helping you. The method for reading a link report is in the backlink audit page.

2. Copied content

Someone scrapes your pages and publishes them on other domains. Search for a distinctive sentence from your page in quotation marks to find copies. Keep the dated original, make sure yours is indexed and carries a self referencing canonical tag, and send a copyright takedown request through the host or through Google's removal process for the copy. Copying matters most when the copy gets indexed before yours, which is a reason to submit new pages for indexing quickly.

3. A hacked site

Spam pages, hidden links or redirects appear on your domain. Google's spam policies list hacked content and describe how hackers use cloaking to hide the damage. Read the Security issues report, restore from a clean backup, change every password, update the platform and all plugins, close the hole, then request a review. Hacking is the form that does the most harm, and prevention is cheap: two factor sign in on every admin account, automatic updates, a tested backup, and the fewest plugins that do the job.

4. Fake removal or takedown requests

Someone emails your host or your link partners pretending to be you and asks them to remove a link or take a page down, or files false reports on your listings. Keep contact details for your host, registrar and key partners current, set registrar locks, and verify any instruction by a channel you control. For fake reviews on a business profile, use the report process in the negative review page.

5. Bot traffic and crawl abuse

Automated requests slow your server until real visitors and Googlebot see errors. Check your server logs for one address range or user agent making a very large number of requests, and block it at the firewall or through your host. Use a content delivery network with bot rules if it recurs. Slow pages and server errors harm search performance whoever causes them, so a fast, stable host protects you from this by design.

A monitoring routine that takes twenty minutes a month

1. Open Search Console and read Manual actions and Security issues.
2. Compare the number of referring domains with last month, and open any month with an unusual jump.
3. Check the top anchor texts for terms you would never use.
4. Search for your brand name and your main page titles to see copies and impostors.
5. Look at the server error report and the crawl stats for spikes.
6. Record the date and the result, so a later drop has a clean history to compare with.

What not to do

• Do not disavow every low quality link on sight. Most are noise.
• Do not pay a provider who sells guaranteed negative SEO removal or guaranteed recovery. Nobody who is honest sells a guaranteed outcome in search.
• Do not retaliate. Building spam links to a competitor is a link scheme and breaks the policy you are trying to defend.
• Do not wait on a hacked site. Every day it stays infected adds more spam pages to clean.

For a link profile you are building yourself, the safe tactics are set out in backlink strategy.

Questions about negative SEO attacks

Can a competitor really push my site down?

Google states it works to stop third parties harming your site. The cases that do cause real harm are the ones where the attacker gets inside your site, so security is the strongest defence.

Should I use the disavow tool?

Use it when you have a manual action for unnatural links or a large run of clearly artificial links you cannot remove. Otherwise leave it alone.

How do I know the links are an attack and not my old SEO?

Look at when they appeared. A sudden spike across unrelated domains with matching anchors points to an attack. Links that built up over years from a past agency are a clean up job, with the same remedy.

How long does recovery take after clean up?

For a manual action, the review request starts a clock that Google reports in Search Console. For a hack, recovery follows the review of the security issue. Ordinary link noise needs no recovery because it was never counted against you.

The attack that happens in the answer instead of the search result

Search results are not the only place a rival or a bad source can damage a name. An assistant can repeat a false claim from a scraped page, a fake review site or an impostor listing, and the buyer reads it as the answer. The test is the same kind as the monthly routine above: ask ChatGPT, Gemini, Perplexity and Claude who you are, what you sell and whether you can be trusted, and read the sources behind each reply. AI Knows Us (aiknowsus.com) shows what the assistants say about a business and which pages they drew it from, so a copy or an impostor that has become the source can be traced and dealt with.