Beginner Tutorial: Checking Your Website Against Google’s Spam Policies
You do not have to be a spammer to have a spam problem. Most small business websites that run into Google’s spam policies got there by accident: a web designer left a sponsor link unmarked years ago, a plugin added star ratings nobody checked, or someone broke in through an old plugin and hid gambling pages that only Google can see. This tutorial explains, without jargon, what Google’s spam rules are, why they matter to a small firm, and how to run a first check of your own website calmly and make sense of what comes back.
What Google means by spam
When most people hear “spam” they think of junk email. Google uses the word more widely. In search, spam means a web page or a website trying to get a higher place in Google’s results by tricking Google rather than by being useful, or trying to mislead the people who visit it.
Google writes these tricks down in a public document called its spam policies. Each policy names one kind of trick. Some sound technical, like “cloaking”, but the ideas behind them are simple. A few examples in everyday language:
- Showing Google one thing and customers another. Like a shop that puts a respectable window display out for the inspector and something quite different inside.
- Stuffing a page with search words. A footer listing sixty towns, or a page that repeats “cheap plumber Derby” in every sentence.
- Links that were paid for but pretend not to be. A link to a sponsor or an online shop that pays you commission, without the small label Google asks for.
- Lots of near-identical pages. Thirty “Our services in [town]” pages that are the same apart from the town name.
- Misleading or harming visitors. Fake download buttons, pages pretending to be a government service, or star ratings that nobody gave.
Google puts it in its own words for each policy. For example, it says keyword stuffing “refers to the practice of filling a web page with keywords or numbers in an attempt to manipulate rankings in Google Search results”. The idea running through all of them is the same: do not try to fool Google or your visitors.
Why this matters to a small business
If Google decides part of a site breaks its spam policies, those pages, or the whole site, can drop down the results or disappear from them. That can happen automatically, through Google’s spam-fighting systems and the regular “spam updates” it announces, or through a person at Google applying what is called a manual action, which shows up as a message in Google Search Console.
For a small firm that relies on people finding it locally, losing those positions can mean the phone stops ringing, and it is often hard to work out why. A few points worth knowing:
- Most problems are accidents. In the study published alongside the audit, 445 of 469 ordinary small UK websites (94.9%) showed no signs at all. Of the 24 (5.1%) that did, most had a single thing to fix, often affiliate or sponsor links not marked as paid.
- Hacks are the serious exception. The same study found small business sites, including a shop and an estate agent, where criminals were showing Google gambling pages while the owners saw their normal website.
- Customers are affected too. A hacked site can send visitors to scam or malware sites. Even when search rankings are not hit, that damages trust in your name.
- Fixing early is cheaper. Marking a link or removing a fake rating takes minutes. Recovering from a manual action or a long-running hack takes much longer.
Seeing your site the way Google does
Google finds and reads websites with a program called Googlebot. It visits your pages, reads them and reports back to Google. When Googlebot visits, it announces itself by name, a bit like a courier saying who they are at the door.
That politeness is exactly what criminals exploit. A common type of hack adds a small piece of hidden code to a website. When an ordinary person visits, the code does nothing and the site looks normal. When Googlebot visits, or sometimes when someone arrives from a Google search on their phone, the code serves up a page of gambling or pill adverts instead, often in another language. Google stores that page under the business’s name. The owner, who visits by typing the address into their own browser, never sees it.
So the Spam Policy Audit does something an owner normally cannot: it visits each page several times, as an ordinary visitor, as Googlebot, as a phone user and as someone arriving from Google, and compares the results. If the versions disagree in a suspicious way, the report shows you what was found and which version of the page it was in.
site:
followed by your web address, for example site:example.co.uk, and scroll through the results.
Titles you did not write, especially in another language, are a warning sign worth acting on straight
away.One honest caveat: the audit uses Googlebot’s name, but its visits do not come from Google itself. Some website security services spot that and block the visit, which is sensible behaviour. If your report shows a difference that turns out to be a security block page, that is not a problem with your site.
The checks, grouped in plain terms
The audit checks 15 of Google’s 16 spam policies, plus scam and fraud and spammy structured data, which Google also describes. It is easier to think of them in five groups.
Things being hidden
Cloaking (different content for Google), sneaky redirects (sending some visitors somewhere else), and hidden text and links (words or links on a page that visitors cannot see). On ordinary business sites, these usually mean a hack.
Pages padded or copied to rank
Keyword stuffing, scaled content (many near-copy pages), doorway pages (one page per town or product with only the name changed), thin affiliate pages (mostly shop links, little of your own writing) and scraping (pages that are little more than someone else’s video or post).
Links
Link spam (paid, sponsor and affiliate links without the right label, link swaps, and similar) and user-generated spam (junk left by visitors in comments, forums or member profiles).
Things that harm or mislead visitors
Hacked content, malicious practices (unsafe sites, hidden code, pop-unders, trapping the Back button), misleading functionality (things that promise content or a tool that is not really there), scam and fraud (pretending to be an official service) and spammy structured data (star ratings in the markup that the page does not show).
Your domain’s past and other people’s content
Expired domain abuse (a web address that used to belong to someone else, now used for something different) and site reputation abuse (a section about coupons, casinos or loans that your site is not otherwise about, usually placed there by a third party).
Four further items cannot be seen from any website, such as sending automated searches to Google. The report simply lists them for you to think about.
Your first audit, step by step
Step 1
Gather what you need
Set aside about forty-five minutes when you will not be interrupted. Have your website address ready, a notepad or a simple spreadsheet for writing down what you find, and the details of whoever looks after your site, whether that is you, a web designer or an agency. You do not need any passwords to run the audit itself, because it only looks at the public pages anyone can see.
Step 2
Run the free check
Go to
the Spam Policy Audit page, type your full web address including https:// and press Check
My Site. There is no account or payment needed. It will look at up to twenty addresses on your
site, starting with your homepage. Leave the page open while it works; this usually takes a few minutes
because every page is visited several different ways and compared.
Step 3
Look at the top of the report first
Policies marked Signs found are listed first. If there are none and every policy says No signs found, that is good news for the pages it checked. Also note how many pages it found and how many it checked. If your site has more than twenty URLs, the free run will not have reached them all, so keep that in mind before deciding everything is fine.
Step 4
Open one finding at a time
For each sign, the report shows the page address, what was found and which version of the page it was in. Open that page in your own browser and look for the thing it describes. If the finding was only in the Googlebot version, you will not see it by browsing normally, so do not assume the report is wrong just because the page looks fine to you.
Step 5
Sort findings into three piles
Put each finding into one of three groups. First, urgent: anything suggesting a hack, such as gambling or pill words you never wrote, or visitors being sent to another website. Second, quick fixes you can do yourself, such as labelling a sponsor link or rewriting a list of towns. Third, bigger jobs that need your web designer, such as merging lots of similar pages.
Step 6
Keep a record and check again later
Save or print the report and keep your notes with the date. If there is an urgent pile, contact whoever manages your site that day and send them the report. Once fixes are made, run the audit again to confirm the signs have gone. After that, a check every few months, or after any big change to the site, keeps small problems from quietly growing.
Making sense of the four answers
Every policy in your report gets one of four answers. Here is what each means for you in practice.
- Signs found. The audit spotted something that matches what a Google spam policy describes. This is not Google’s judgement and it does not mean your site has been punished. Think of it like a warning light in a car: worth looking at soon, and occasionally it turns out to be nothing.
- Information. Something useful to know that is not a warning in itself. Read it, but it does not need fixing unless it surprises you.
- No signs found. The audit looked for that kind of problem on the pages it checked and did not see it.
- Not checked automatically. This is something no website check can see, so you are asked to think about it yourself. For most small businesses the answer is simply “we don’t do that”. The same label is used when the check on your web address’s history could not be completed, for example because the Wayback Machine archive did not answer; that is not a warning either.
If the report shows nothing at all, that is the most common outcome for ordinary small sites. It is still worth running again after you change web designer, install new plugins or add a big section to the site.
Glossary
| Term | Plain meaning |
|---|---|
| Googlebot | Google’s program that visits and reads web pages so they can appear in search results. |
| Spam policies | Google’s published list of tricks it does not allow in search. |
| Spam update | An announced improvement to Google’s automatic spam detection. Rankings can move when one rolls out. |
| Manual action | A penalty applied by a person at Google, reported in Search Console with the reason. |
| Search Console | Google’s free service for website owners, showing how Google sees and reports on your site. |
| Sign | A pattern on your site that matches a spam policy description, with the evidence. Not a verdict. |
| Cloaking | Showing search engines different content from what people see. |
| Redirect | Automatically sending a visitor from one web address to another. |
| Affiliate link | A link to a shop that pays you a commission if someone buys. |
rel="sponsored" | A small label added to a link’s code telling Google it was paid for or earns you money. |
| Structured data | Hidden labels in a page’s code describing it to search engines, such as a business name or a star rating. |
| Doorway page | One of many near-identical pages made only to catch searches for each town or variation. |
| Expired domain | A web address that someone let lapse and someone else later registered. |
| Wayback Machine | A free public archive of old copies of websites, kept by the Internet Archive. |
| Plugin | An add-on that gives a website extra features, common on WordPress. Old ones are a frequent way in for hackers. |
What to do next
Once you have your first report, these are sensible next moves, in order.
- Handle anything urgent. A suspected hack comes before everything else.
- Do the quick wins. Labelling paid and affiliate links, removing star ratings that the page does not show, and replacing long town lists with a short sentence are all jobs most owners or designers can finish in an afternoon. The Spam Policy Audit Fixes page has the exact change for each.
- Ask for help where you need it. The report has a button to copy an AI fix prompt for changes to your site’s own files, and another to request a quote if you would like the work done for you. Always back up your website before anyone, or any tool, changes it.
- Learn the rest gradually. The Spam Policy Audit Guide explains every part of the tool in more depth, including the signed-in options for checking more pages, and the example report walks through a made-up business’s results line by line.
- Keep the habits that prevent problems. Keep plugins and themes updated, remove ones you no longer use, use strong unique passwords, and ask any designer or marketing agency to label paid links and avoid near-copy pages.
1. Could my website be breaking Google's rules without me knowing?
Yes, and it is more common than people think. A web designer may have added sponsor or affiliate links without the label Google asks for, a plugin may be adding star ratings or keyword-heavy titles automatically, or the site may have been hacked in a way that only shows spam to Google. None of these needs any deliberate wrongdoing by the owner, which is exactly why running a check from the outside is useful even for honest businesses.
2. Does a sign in the report mean Google has penalised me?
No. The audit cannot see Google's decisions; it only looks at your public pages for patterns described in Google's spam policies. A sign means something matches one of those descriptions and deserves a look. Only Google decides whether a site breaks its rules. If you want to know whether Google has taken action, check the Manual actions and Security issues reports in Google Search Console, which are free for any site owner.
3. I'm not technical. Can I still fix what the audit finds?
Often, yes. Several common fixes are changes you can make in your website editor, such as rewriting a long list of towns, changing a repetitive page title or removing a fake rating in a plugin's settings. For changes to code, the report can give you an AI fix prompt to use with an AI coding tool, or you can send the report to your web designer. There is also a button to request a quote if you want the work done for you.
4. Is it safe to run the audit on my live website?
Yes. It only reads pages that anyone on the internet can already see, in the same way a visitor or search engine does. It does not log in, fill in forms, install anything or change any files on your server. It does visit each page several times to compare versions, which is a light load for normal hosting. If your security service blocks some of those visits, the report simply shows which pages it could not compare.
5. Why would someone hack a small business website?
Usually for its reputation with Google rather than for anything on it. An established local business site is trusted by search engines, so criminals hide pages on it promoting gambling, pills or loans, hoping to borrow that trust to rank their pages. Some also redirect visitors arriving from Google to scam sites. They hide this from the owner deliberately, so the hack can carry on for months. Outdated plugins and weak passwords are the usual way in.
6. What is rel=sponsored and do I really need it?
It is a short label added to a link in your page's code, telling Google that the link was paid for, sponsored or earns you commission. Google asks for it on adverts, sponsor links and affiliate links, and accepts nofollow as an alternative. It does not change what visitors see or stop the link working. If your site thanks sponsors with logos or recommends products through affiliate links, adding the label is one of the quickest fixes there is.
7. How often should I run a spam check?
A check every few months is reasonable for most small business sites, plus an extra run after any big change, such as a new website, a new web designer, new plugins or a large batch of new pages. Run one straight away if your traffic or enquiries drop suddenly, if Google announces a spam update and your rankings move, or if customers mention being sent to strange websites from yours.
The Spam Policy Audit Fixes page explains, policy by policy, how to clear each sign the audit can report, from hacked pages and hidden links to unmarked sponsor links, town-swap pages and fake star ratings.
Open Spam Policy Audit Fixes →