Fixing Ranking Losses from a Google Spam Update
Spam updates improve Google's automated systems for spotting practices that break its spam policies, from bought links and doorway pages to mass-produced content and hacked pages.
Unlike a core update, a spam update is about rules: if your rankings fell during one, something on your site, in your link profile or injected by an attacker may now be treated as spam. This guide shows how to tell a spam update from a manual action, how to audit each policy area that commonly catches small businesses, and what recovery can and cannot look like once the problem is fixed.
Spam update, link spam update or manual action?
Three different things are often all called a "spam penalty". They behave differently and have different routes out:
| Spam update | Link spam update | Manual action | |
|---|---|---|---|
| Who decides | Automated systems, including Google's SpamBrain | Automated systems | A human reviewer at Google |
| How you find out | Rankings fall during an announced rollout | Rankings fall during an announced rollout | A message in Search Console under Manual actions |
| Typical effect | Pages or the whole site rank lower or drop out | Links stop passing value, so pages that relied on them slide | Affected pages or the site demoted or removed |
| Route back | Fix the problem; systems reassess over time | Earn genuine links; lost link value does not come back | Fix the problem, then file a reconsideration request |
The link spam row deserves attention. When Google's systems neutralise spammy links, any ranking benefit those links were providing disappears. Google has said that in that case, cleaning up may not bring rankings back, because the rankings were partly built on links that no longer count. Recovery then depends on earning links and value that do count.
The spam policies that catch small businesses
Google's spam policies are long, but a handful account for most problems on ordinary business sites. The policies on scaled content abuse, site reputation abuse and expired domain abuse were added in 2024; the rest are long-standing.
| Policy | What it looks like on a small site | Typical fix |
|---|---|---|
| Link spam | Paid guest posts with keyword anchors, link packages from an agency, reciprocal link pages, links hidden in theme footers | Remove what you control, ask for removal elsewhere, disavow what you cannot remove if a manual action or clear scheme is involved |
| Scaled content abuse | Hundreds of pages generated from a template or AI prompt, each targeting a keyword variation with little unique value | Consolidate into fewer useful pages; remove the rest |
| Doorway pages | "Plumber in [town]" pages for fifty towns with only the name swapped | Keep pages only where you have real, distinct content for that place |
| Site reputation abuse | A section hosting third-party coupon, casino or payday content to ride on your site's standing | Remove it, or block it from indexing |
| Expired domain abuse | Buying an old domain and filling it with unrelated content to use its history | Only use domains for content that genuinely continues their purpose |
| Hacked content | Injected pages, hidden links or redirects added by an attacker | Clean the site, close the hole, request a review in Search Console |
| User-generated spam | Spam comments, forum posts or profiles full of links | Moderate,
add rel="ugc", restrict open sign-ups |
| Cloaking and sneaky redirects | Different content for Googlebot and people, often from a plugin or an attack | Remove the code serving different content |
Google has been clear that the scaled content policy is about purpose and value, not method. Pages produced by people, AI or both fall under it if they are made mainly to manipulate rankings and add little for the reader.
The fix, step by step
Step 1
Check for a manual action or security issue
Open Search Console and look at Security and manual actions. A manual action lists the problem and affected pages, and is fixed through a reconsideration request once you have cleaned up. A security issue means Google has found hacked content or malware. If both reports are empty, use the Algorithm Impact monitor to check whether your drop began during a spam update rollout rather than at some other time.
Step 2
Map the site against the spam policies
Read Google's current spam policies and write down, honestly, every practice your site has used at any point: link packages, guest post deals, location page generators, bulk AI content, hosted partner content, bought domains. Include work done by past agencies or freelancers. This list, not guesswork about the algorithm, decides where to spend your clean-up time, and it is often longer than owners first expect.
Step 3
Audit past link building
Export
your linking domains from the Search Console Links report and any link tool you use,
then flag links that were paid for, exchanged, placed through networks or carry exact-match keyword anchors
on unrelated sites. Remove links you control, such as footer credits on client sites, and ask site owners
to remove or add rel="sponsored" to paid ones. Keep a record of every request and reply
you receive.
Step 4
Find scaled, templated and doorway pages
Crawl the site and sort pages by template or URL pattern. Look for groups where pages differ
only by a place name, product variant or keyword, and read five at random from each group. If they are
interchangeable, they are a risk. Keep only pages with distinct, useful content, merge the rest into
a single strong page with 301 redirects, and remove pages that have no sensible destination.
Step 5
Review hosted and third-party content
Check
for sections written or supplied by others: sponsored posts, partner coupon pages, advertorials, subdomains
or folders run by another company, and open comment or forum areas. Remove content unrelated to your
business that exists to exploit your site's standing, or stop it being indexed. Moderate user content,
add rel="ugc" to user links, and close sign-up forms that attract spam accounts or fake
profiles.
Step 6
Remove or fix what breaks the rules
Work
through your list, starting with anything hacked, then doorway and scaled pages, then links. Return 410
or 404 for spam pages that should disappear, and update your sitemap so it only lists pages
you want indexed. Use the disavow tool only for unnatural links you could not get removed and only where
a manual action or a clear past scheme justifies it.
Step 7
Record the clean-up and allow time
Keep a dated log of every page removed, every link request sent and every disavow file uploaded. If you had a manual action, file a reconsideration request describing what you found, what you fixed and what you could not fix. For algorithmic spam updates there is no request to file; Google says its systems may take months to learn that a site now complies. Track progress with the Algorithm Impact monitor.
Checking for hacked and injected spam
Many small sites hit during spam updates did not create spam themselves. An outdated plugin or weak password let someone inject pages, links or redirects. Signs to look for:
- A
site:example.co.uksearch in Google showing pages you never created, often in another language or about pharmaceuticals, replica goods or gambling. - Search Console queries you do not recognise, particularly in Japanese or other scripts, with impressions on URLs you do not have.
- Visitors from search being redirected to another site on mobile only, while the site looks normal when you type the address in.
- A sudden jump in indexed pages in the Page indexing report.
Attackers sometimes show spam only to Googlebot. Compare what Google sees using the URL Inspection tool's live test with what your browser shows. You can also request a page with a Googlebot user agent, although well-built cloaking checks Google's IP addresses too, so the URL Inspection test is more reliable:
curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://example.co.uk/ | grep -i -E "casino|viagra|replica|<a href" | headCleaning up means removing the injected files and database entries, updating or removing the vulnerable software, changing every password and key, and then using the Request review button in the Security issues report. Your host can often help find the entry point from its logs.
Disavowing links: when and how
Google has said for years that its systems generally ignore spammy links rather than counting them against a site, so most sites never need to disavow anything. The disavow tool exists for cases where you have many unnatural links pointing at you that you cannot get removed, and where they either caused a manual action or clearly came from a link scheme you or a past agency ran.
If that applies, the file is plain text, one entry per line. Domain lines cover every link from that domain:
# Links bought through a package in 2023, removal requests sent, no reply
domain:cheap-links-example.net
domain:article-directory-example.org
# Single page, owner refused removal
https://blog-example.com/sponsored/best-plumbers-2023/Upload it through the disavow links tool for the correct Search Console property. Each upload replaces the previous file, so always upload the complete list. Do not disavow links simply because a third-party tool labels them "toxic"; that score is the tool's opinion, not Google's.
Platform notes
WordPress
Most hacked-spam cases on small sites are WordPress sites with an abandoned plugin or theme. Remove plugins you do not use rather than just deactivating them, keep the core and plugins updated, and check the users list for administrator accounts you did not create. Close open registration unless you need it, and require comment moderation.
Shopify and hosted platforms
Hosted platforms handle server security, so hacked content is rarer, but apps can still inject code and blogs can collect comment spam. Review installed apps, remove ones you no longer use, and moderate blog comments.
Custom sites
Look for location or keyword pages generated from a database or spreadsheet, since these are the usual source of scaled or doorway patterns on custom builds. Add a rule to your build or content process that a generated page is only published when it has content specific to it.
1. How do I know if a spam update affected my site?
Look for a ranking drop that starts during an announced spam update rollout on the Google Search Status Dashboard, with no manual action shown in Search Console and no technical fault on your side. Then check whether your site uses any practice described in Google's spam policies, including ones a past agency may have used. If the timing matches and you find a policy problem, the spam update is the likely cause. If the timing matches but you find nothing, keep investigating other causes.
2. Can I file a reconsideration request after a spam update?
Only if you have a manual action. Reconsideration requests are for penalties applied by a human reviewer and listed under Manual actions in Search Console. Spam updates are automated, so there is nothing to request and no one to review your case. For an algorithmic drop, you fix the problems and wait for Google's systems to recrawl and reassess the site, which Google says can take months. Keep a record of your clean-up in case a manual action appears later.
3. Will removing bad links bring my rankings back?
Not necessarily. If a link spam update neutralised links that were helping you rank, those links now count for nothing, and removing them does not restore the value they used to pass. Google has said this directly about link spam updates. Removing or disavowing unnatural links is still worthwhile if you have a manual action or ran a link scheme, but real recovery comes from earning links and mentions that Google does count, through genuinely useful content and relationships.
4. Should I disavow toxic links flagged by an SEO tool?
Usually not. Toxicity scores are calculated by the tool's maker, not by Google, and Google has said its systems generally ignore spammy links instead of counting them against you. Disavowing is meant for cases where you have unnatural links you cannot get removed, particularly with a manual action or a known past scheme. Disavowing links that were actually helping you can remove value. If you are unsure, it is generally safer not to disavow than to disavow broadly.
5. Is AI-written content treated as spam?
Not automatically. Google has said it judges content on its quality and purpose, not on how it was produced. The scaled content abuse policy applies to large amounts of content created mainly to manipulate rankings with little value for readers, whether written by people, AI or a mix. A small business using AI to help draft pages that a knowledgeable person then checks and improves is in a very different position from a site publishing thousands of unedited keyword pages.
6. Are location pages for each town I serve considered doorway pages?
They can be. Google's doorway policy covers pages created to rank for similar searches that funnel visitors to the same place, and near-identical town pages with only the name changed are a classic example. Location pages are fine when each has genuinely distinct content, such as jobs completed there, local staff, travel times, or area-specific advice. If you cannot write something specific for a town, a single service area page listing the places you cover is safer.
7. How long does recovery from a spam update take?
Google has said its automated systems may take months to learn that a site now complies with its spam policies, and there is no way to speed that up by filing a request. Recovery can also be partial, particularly after a link spam update where the lost link value does not return. Track your rankings from the date you finished cleaning up, not from the date of the drop, and keep improving the useful parts of the site in the meantime.
The Algorithm Impact monitor lines up your daily ranking movements with tracked Google updates, helps separate update effects from technical faults, content decay and competitor gains, tracks your recovery and suggests actions suited to the type of update.
Open Algorithm Impact Fixes →