Example Spam Policy Audit Report, Explained Line by Line
This page walks through a Spam Policy Audit report for Brookfield Garden Rooms, a fictional company that designs and builds garden offices, on the placeholder address example.co.uk. It is an illustrative example written to show the kinds of results the report gives and how to read them. It is not the output of a real audit, and no real website’s data appears here. Brookfield’s report has four policies with signs, one Information item, a row of clean results and the four practices no website check can see. Each is explained below, with what the owner should do about it.
About this example
Brookfield is the sort of business the audit is built for: a small firm with a WordPress site put together by a freelance designer some years ago, updated now and then by the owner. The site has service pages, a gallery, a quote form, a blog with buying advice, a testimonials page and a set of “garden rooms in [town]” pages that a previous marketing agency added.
How the run was set up
The owner signed in and used Advanced controls with these choices:
| Setting | Choice in this example | Why |
|---|---|---|
| How many URLs to check | Up to 50 URLs | The sitemap lists a little over 40 pages, so 50 covers the lot. |
| Which URLs | The whole site (from your sitemaps) | A first full audit, so nothing is excluded. |
| Pages opened in a real browser | Up to 25 pages | Several pages rely on scripts from plugins. |
| Which policies | All | Nothing is known yet, so every policy is reported. |
The free, signed-out version would have checked the first 20 URLs only, and opened fewer pages in Chrome, which on this site would have missed most of the blog and several town pages.
The report at a glance
The report lists policies with signs first. Here is how Brookfield’s came out, summarised in one table so the shape of the result is clear before going into detail.
| Policy | Status in the example | In one line |
|---|---|---|
| Link spam | Signs found | A paid “featured supplier” box links out
without rel="sponsored". |
| Doorway abuse | Signs found | Nine town pages, including the Belper page, differ only by the town name. |
| Keyword stuffing | Signs found | A long block of village names on the main service page. |
| Spammy structured data | Signs found | A star rating in the markup of pages that show no reviews. |
| Spam score (DataForSEO) | Information | Third-party scores for the site and the sites it links to. |
| Cloaking | No signs found | None of the patterns appeared; a few Googlebot copies were bot-check pages and were not compared. |
| Sneaky redirects, hidden text and link abuse, hacked content, malicious practices | No signs found | None of the patterns appeared. |
| User-generated spam, thin affiliation, scaled content abuse, site reputation, misleading functionality, scraping, scam and fraud | No signs found | None of the patterns appeared. |
| Expired domain abuse | No signs found | No archived copy from before the current registration, so there is no earlier site to compare. |
| Machine-generated traffic, legal removals, personal information removals, policy circumvention | Not checked automatically | Cannot be seen from a website; review by hand. |
The pattern is typical of an honest small site: no sign of tampering, and a handful of problems created by well-meant marketing decisions. None of the four signs suggests anyone is attacking the site, which is why the owner can work through them calmly rather than treating the report as an emergency.
Sign 1: link spam from a paid box
The evidence for link spam lists one line per link. In the example, each blog post carries the same
sidebar box headed “Featured supplier”, which a decking company pays Brookfield to show. The links in
it have no sponsored or nofollow marking.
| URL | Copy | What was found |
|---|---|---|
https://example.co.uk/blog/insulating-a-garden-office/ | Visitor | Advert
link to decking.example.com in a sponsor box, not marked sponsored |
https://example.co.uk/blog/planning-permission-garden-rooms/ | Visitor | Advert
link to decking.example.com in a sponsor box, not marked sponsored |
https://example.co.uk/blog/heating-a-garden-room/ | Visitor | Advert
link to decking.example.com in a sponsor box, not marked sponsored |
The real report would continue for every blog page where the box appears. The repetition is a clue: one widget is responsible for every line, so one change clears them all.
What it means and what to do
This is the most ordinary kind of link spam sign. Brookfield is not selling links to manipulate rankings;
it simply never labelled a paid placement. Google asks for paid links to carry rel="sponsored",
so the fix is to edit the sidebar widget once:
<aside class="sponsor featured-supplier">
<p>Featured supplier</p>
<a href="https://decking.example.com/" rel="sponsored">Composite decking for garden rooms</a>
</aside>After saving the widget and clearing the site cache, viewing the source of any blog post should show the attribute on the link.
Sign 2: doorway pages for each town
The doorway evidence names a group of pages built from one pattern. In Brookfield’s case the previous agency created a page for each nearby town, each titled “Garden Rooms in [Town] | Brookfield Garden Rooms”, with the same text and photos and only the town name swapped.
| URL | What was found |
|---|---|
/garden-rooms-ashby/ | Nearly the same as /garden-rooms-belper/; title differs by one word |
/garden-rooms-ripley/ | Nearly the same as /garden-rooms-belper/;
title differs by one word |
/garden-rooms-matlock/ | Nearly the same as /garden-rooms-belper/;
title differs by one word |
| …and five more town pages in the same group | |
What it means and what to do
Brookfield has one workshop and no branches, so these pages cannot honestly be made local in the sense of an address or opening hours. What the firm does have is completed projects in several of those towns. A sensible plan:
- Keep pages only for the three towns where Brookfield has built several garden rooms, and rewrite each around those real projects: photos, what the customer needed, any local planning points the team dealt with.
- Merge the other six into one “Where we work” page and redirect their old addresses there with 301 redirects.
- Remove the town pages from the sitemap if they are deleted, and update any menu or footer links.
A rewrite of this size takes longer than the other fixes, so it goes last on the job list.
Sign 3: a block of place names
On the main “Garden rooms” service page, below the description of the work, sits a paragraph that starts “We install garden rooms in” and then lists dozens of villages and towns separated by commas. The keyword stuffing evidence quotes the start of that list and names the URL, in the visitor copy.
Lists like this are one of the examples Google gives of keyword stuffing. Customers do not read them, and they make the page look as though it was written for search engines. The audit set aside the site’s navigation and footer before looking, so the sign is about the paragraph in the main content, not the menu.
What to do
Replace the list with a sentence a person would actually write, for example: “We are based near Belper and build garden rooms across Derbyshire and the edges of Nottinghamshire and Leicestershire. If you are unsure whether we cover your area, send us your postcode.” A simple coverage map does the same job visually. Pair this with the new “Where we work” page from the doorway fix so the information has one proper home.
Sign 4: ratings the pages do not show
The spammy structured data evidence lists pages whose markup includes an aggregateRating
although nothing on the page shows a rating or reviews. On Brookfield’s site, a reviews plugin had been
set to add the rating to the business’s markup on every page, while the reviews themselves only appear
on /testimonials/.
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "HomeAndConstructionBusiness",
"name": "Brookfield Garden Rooms",
"url": "https://example.co.uk/",
"aggregateRating": {
"@type": "AggregateRating",
"ratingValue": "4.9",
"reviewCount": "37"
}
}
</script>That block, appearing on the home, gallery and blog pages, is what the evidence points at.
What it means and what to do
Google’s structured data guidelines say markup should describe what the page shows. The reviews here are real, so nothing is being invented, but they are not visible where the markup claims them. Google also does not show review stars for reviews a business hosts about itself in this kind of markup, so the rating was earning nothing in search anyway. The owner should switch off the plugin’s site-wide rating option and, if wanted, keep review markup only on the testimonials page where customers can read the reviews. The Rich Results Test can confirm what each page now outputs.
The quieter results
It is tempting to skip everything below the signs. These results still tell the owner useful things.
Information: spam score
Because the run was signed in, the report includes a spam score from DataForSEO for example.co.uk and for the sites it links to, listing the highest-scoring linked sites with the page that links to each. It is DataForSEO’s own measure and not a Google figure, so it is information only. In the example, the decking supplier and the rest of the linked sites look unremarkable, and there is nothing to act on.
No signs found, with a note
Cloaking shows no signs. In the example, a few URLs received a bot-check page from the site’s CDN when requested as Googlebot, so those copies were not compared. That is the security service doing its job with an unverified crawler, not a fault. If the owner wants certainty about those pages, Search Console’s URL Inspection shows what the real Googlebot receives.
Expired domain abuse shows no signs: the Wayback Machine holds no archived copy of example.co.uk from before the current registration, so there is no earlier site to compare.
Not checked automatically
Machine-generated traffic, legal removals, personal information removals and policy circumvention are listed for the owner to review by hand. Brookfield does not send automated searches to Google, has had no copyright or personal information removal requests and has never moved domains to dodge action, so the owner notes “not applicable” against each. The same label would appear against expired domain abuse if that check could not be completed, for example if no registration date could be found or the Wayback Machine did not answer; here it could be completed.
Files listed but not checked
The sitemap includes a PDF brochure and some gallery images. These are listed as not checked because they are not text, which is expected.
Reading this report, step by step
Step 1
Check the run settings and coverage
Before trusting any result, confirm what was read. In this example the report found just over forty URLs and checked every text URL, with the PDF and images listed as not text files and not checked. Had the free run been used, the town pages near the end of the sitemap might never have been reached, and the doorway sign would have been missed entirely. Always compare found and checked numbers first.
Step 2
Scan the summary for patterns
Look at which policies have signs and ask what they have in common. Here, link spam came from one paid widget, while the town pages and the village list both came from a past push for local searches, and the rating came from a plugin setting. Spotting those shared causes early turns what looks like four separate problems into three or four small editing jobs, each with a single owner.
Step 3
Read each sign against its page
Open each URL named in the evidence and find the exact item quoted, whether that is the sponsor link, the near-identical town text, the village paragraph or the rating block in the page source. Check which copy it came from. Everything in this example was in the visitor copy, which means the owner can see it directly and there is nothing hidden only for Googlebot.
Step 4
Trace each sign to its source
Work out where each problem lives so it is fixed once: the sidebar widget settings for the sponsor link, the agency’s page template for the town pages, the service page editor for the village list, and the reviews plugin’s options for the rating. Fixing the source rather than individual pages stops the same issue reappearing the next time a post or town page is published.
Step 5
Read the quiet results properly
Go through the Information item, the clean policies and the four unchecked practices. Confirm that the bot-check note under cloaking is explained by the CDN, that nothing in the spam score list is surprising, and write a short answer against each practice that cannot be checked automatically. This turns a clean result into a recorded decision rather than an assumption nobody has looked at.
Step 6
Turn the report into a job list
Order the work from quickest to longest: mark the sponsor link, remove the site-wide rating, rewrite the village paragraph, then rebuild or merge the town pages. Copy the AI fix prompt for the template and markup edits, or request a quote if the designer should handle it. Back up the site first, and plan a second audit with the same settings once everything is live.
What a good outcome looks like
Continuing the illustration: after the changes, the owner runs the audit again with the same Advanced controls settings so the two reports can be compared fairly.
- Link spam moves to no signs found, because the sponsor box now carries
rel="sponsored". - Spammy structured data moves to no signs found once the rating appears only on the testimonials page.
- Keyword stuffing clears with the village list gone.
- Doorway abuse clears once six town pages are merged and redirected and the remaining three describe real local projects.
Two points are worth drawing out. First, a clean second report shows the patterns have gone from the pages read; it does not say anything about how Google will rank the site, which depends on far more than spam. Second, the owner keeps both reports, because they document what was found and fixed, which is useful if questions arise later, for example after a Google spam update.
For the full repair instructions for every policy, see the Spam Policy Audit Fixes. For how each part of the report is produced, see the Spam Policy Audit Guide, and if the ideas are new to you, start with the beginner tutorial. To run the real thing on your own site, go to the Spam Policy Audit.
1. Is this a real audit of a real company?
No. Brookfield Garden Rooms is fictional and example.co.uk is a placeholder address used for this walk-through, and every finding, address and count on this page was written to illustrate how the report presents results. None of it comes from a real audit or from the study published on the tool page. The result types, the kind of evidence shown and the actions available under the report do match what the real Spam Policy Audit produces, so you can use it to learn how to read your own.
2. Why does the example show signs on an honest business?
Because that is how most signs on ordinary sites arise. The audit reports patterns that Google's spam policies describe, whatever the intention behind them. A paid supplier box without the right link label, town pages written by a past agency and a plugin that adds ratings everywhere are all common on genuine small business sites. Showing them here makes the point that a sign is a prompt to tidy something up, not an accusation.
3. Would the free version have found the same things?
Not necessarily. Signed out, the audit checks up to 20 URLs, starting with the homepage and following the sitemap order, and opens fewer pages in Chrome. On a site the size of the example, that could leave the later blog posts and several town pages unread, so some evidence lines, or whole signs, might not appear. For a site with more than twenty URLs, signing in and choosing a larger tier gives fuller coverage, up to 100 URLs.
4. What would a hacked site's report look like instead?
It would typically show signs under cloaking, hacked content and sometimes sneaky redirects or hidden links, with evidence that appears only in the Googlebot, mobile or from-Google copies of pages. The quoted titles would often be gambling or pill pages, frequently in another language, that the owner never wrote. That pattern calls for an immediate clean-up rather than routine editing, and the fixes page explains the steps a developer or host will need to take.
5. Why is the spam score shown if it is not a sign?
It is extra context available on signed-in runs. DataForSEO scores the audited site and the sites it links to, and the report lists the highest-scoring linked sites alongside the page that links to each. It is DataForSEO's own measure rather than anything Google publishes, so it never counts towards the policy results. It is most useful for spotting an outbound link to a site you would rather not be associated with.
6. Should Brookfield delete all its town pages to be safe?
Not necessarily. Google's doorway policy targets near-copies made to catch searches for each place, not pages that genuinely help people in a particular area. Brookfield has real projects in a few towns, so pages built around those projects, with their own photos and details, can stay. The pages it cannot make genuinely different are better merged into one coverage page with redirects, which keeps any visitors and links that arrive at the old addresses.
Spam Policy Audit Fixes covers each policy the audit reports, including link spam, doorway pages, keyword stuffing and spammy structured data, with the change that clears each sign.
Open Spam Policy Audit Fixes →