How to Fix Every Spam Policy Audit Finding

Where each finding is fixed

The report groups its results by policy and lists any policy with signs found at the top, each with the URL, what was found and which copy of the page it was found in. Use the list below to jump to the section that matches the heading in your report. Related policies share a section because the same change often clears several of them at once: removing a hack, for instance, usually clears cloaking, sneaky redirects and hacked content together.

• Cloaking and sneaky redirects: Googlebot, phones or visitors arriving from Google being shown something different, or sent somewhere else.
• Hidden text and link abuse: links or wording placed in the page but kept out of sight.
• Keyword stuffing: runs of town names or phone numbers, phrases repeated far beyond normal writing, and repetitive titles or alt text.
• Hacked content and malicious practices: injected spam, suspicious scripts, hidden iframes, Web Risk listings, pop-unders, mining code and back-button tricks.
• Link spam, user-generated spam and thin affiliation: unmarked paid, sponsor and affiliate links, spam in comments and profiles, and pages that are mostly affiliate links.
• Scaled content, doorways and site reputation: near-copy pages, town-swap pages and sections about subjects your site is not about.
• Expired domain abuse: a domain registered again after it held a site on a different subject.
• Scam and fraud, and spammy structured data: claims to be an official service, and ratings in the markup that the page does not show.
• Misleading functionality and scraping: content lockers, fake download buttons, empty tool pages and pages built from other sites’ embedded media.

Four items always appear as Not checked automatically: machine-generated traffic, legal removals, personal information removals and policy circumvention. They depend on what a site owner does towards Google or on Google’s own records, so nothing on your pages can show them. There is nothing to fix in your HTML for those; simply read Google’s description and confirm none applies to you. The same status is also given to expired domain abuse when that check could not be completed: no registration date could be found, the Wayback Machine did not answer, or its old copies could not be loaded. Results marked Information are worth knowing but are not signs, and No signs found means the audit saw none of the patterns it looks for in that policy on the URLs it checked.

For the full explanation of how the report is laid out and what each status means, see the Spam Policy Audit Guide.

Cloaking and sneaky redirects

Google describes cloaking as “presenting different content to users and search engines with the intent to manipulate search rankings and mislead users”. Sneaky redirecting is sending people somewhere they did not expect, or sending search engines and users to different places. The audit loads every URL as a visitor, as Googlebot, on a phone and as a visitor arriving from Google, opens selected pages in Chrome the same ways, and compares where each one ends up and what each one is shown.

First, rule out your own firewall

The audit’s Googlebot requests carry Googlebot’s name but do not come from Google’s network. Google itself recommends that sites verify Googlebot by checking where a request really comes from, so a firewall, security plugin or CDN bot filter may block or challenge the audit’s Googlebot. The audit recognises common bot-check, firewall and maintenance pages and does not compare them, but an unusual challenge page can slip through. Look at the evidence: if the Googlebot copy is a block page, a loading screen or a “checking your browser” message, the cause is your security layer and no change is needed. Confirm with Search Console’s URL Inspection tool, which fetches the page from Google’s real network.

When the difference is real

If the Googlebot copy carries a title or wording you did not write, often gambling, pills or loans and frequently in another language, treat it as a hack and go straight to the hacked content section. The injected code checks the visitor’s user agent or referrer and only serves spam to Google or to people arriving from search, which is why the owner never sees it. Search your theme files, .htaccess, wp-config.php, must-use plugins and database options for the words googlebot, HTTP_REFERER and HTTP_USER_AGENT, and for long encoded strings.

If the difference is deliberate, for example a plugin that serves a stripped-down page to crawlers, or a mobile redirect to a separate domain for phone users only, remove it. Give every visitor and Googlebot the same content at the same address. Responsive design, or a mobile page that shows equivalent content, is fine. A redirect that sends everyone to the same place is not sneaky.

Redirects made by scripts

Script redirects that only fire for phones, after a delay, or only for visitors from Google are a common payload of hacked advert scripts. Remove third-party scripts you cannot account for, and replace any intentional JavaScript or meta refresh redirect with a server-side 301 that applies to everyone. Old event or campaign pages that bounce to link shorteners should be removed or redirected to a relevant page on your own site.

Hidden text and link abuse

In Google’s words, this is “placing content on a page in a way solely to manipulate search engines and not to be easily viewable by human visitors”. The audit looks for links and text hidden from visitors, including by stylesheets, colour and position, and it leaves out ordinary hidden interface parts such as menus, tabs, accordions, sliders, cookie notices and screen-reader text.

Finding the hidden element

Open the flagged URL in Chrome, press Ctrl+F (or Cmd+F) in the developer tools Elements panel and search for the link text or address the report quotes. Look at the element’s computed styles. Typical tricks are a zero font size, text the same colour as the background, a box with overflow:hidden that is too small to show its contents, an element pushed far off-screen, or links tucked inside <noscript> blocks or HTML comments.

Removing it properly

• Links you did not put there, especially to casino, pharmacy or loan sites: this is almost always a hack or a compromised theme. Remove the code, then follow the hacked content clean-up so it does not come back.
• Links that came with a theme or plugin, such as hidden footer credits in a free or nulled theme: replace the theme with a legitimate copy from its developer. Nulled (pirated) premium themes and plugins are a frequent source of hidden links and backdoors.
• Text you added for search engines, such as a hidden paragraph of keywords: delete it. If the words are useful to people, put them in visible copy.

Do not just change the CSS so the links become visible. Spam links shown openly are still link spam; the fix is to remove them. Equally, there is no need to change legitimate hidden content: a collapsed FAQ answer, a mobile menu or a visually hidden label for screen readers is normal design, and Google’s policy is about content hidden to manipulate rankings.

Keyword stuffing

Google defines keyword stuffing as “filling a web page with keywords or numbers in an attempt to manipulate rankings”. The audit looks for the shapes Google gives as examples: long lists of phone numbers, blocks of place names, and the same phrase repeated unnaturally, plus titles and image alt text that repeat one word. Navigation, menus and repeated product cards are set aside before it checks.

Town and area lists

The most common small-business case is a long comma-separated list of every town and village served, usually in the footer or at the bottom of a service page. People rarely read it; it exists for search. Replace it with one sentence naming your base and the main areas (“We work across Derby and south Derbyshire, from Belper to Swadlincote”), and add a coverage map if the boundary matters to customers. If certain towns genuinely need their own page, see the doorway section first.

Repeated phrases

Read the flagged page aloud. If “emergency boiler repair Derby” turns up in nearly every paragraph, rewrite so that the phrase appears where it is natural, usually the title, the main heading and once or twice in the text, and use plain variations elsewhere (“we can usually come out the same day”). Google’s systems understand synonyms; repeating the exact phrase does not help.

Titles and alt text

A title such as “Hire | Van Hire | Minibus Hire | Cheap Hire | Hire Derby” should become one clear statement: “Van and Minibus Hire in Derby | Example Hire”. Alt text should describe the image for someone who cannot see it (“Blue Transit van parked outside the depot”), not list keywords. In WordPress, SEO plugins sometimes fill alt text or titles automatically from a template; check the plugin settings so the pattern does not reappear on new pages.

Phone number lists

Directories of numbers with little text around them look like stuffing. Keep the numbers people need, such as one per branch or department, each with a label and a short line of context.

Hacked content and malicious practices

Google defines hacked content as “any content placed on a site without permission, due to vulnerabilities in a site’s security”. Malicious practices “create a mismatch between user expectations and the actual outcome”. On the audit, hacked content covers spam words in 11 languages, hidden iframes, suspicious scripts and auto-generated pages; malicious practices covers Google Web Risk on every URL and linked site, hidden code, mining, pop-under and back-button tricks.

Cleaning a hacked site

1. Take a full backup first, files and database, even though it is infected. You may need it to trace how the attacker got in.
2. Change every password: hosting control panel, SFTP or FTP, database user, every CMS administrator, and the email account that can reset them. Remove admin users you do not recognise.
3. Update or replace the software. Update the CMS core, themes and plugins; delete any you do not use; reinstall core files from a fresh download rather than trusting the existing copies. Out-of-date plugins and themes are the usual way into WordPress sites.
4. Hunt for leftovers. Look for recently changed files, PHP files in upload folders, unfamiliar scheduled tasks, rewrite rules in .htaccess, and code that checks for Googlebot or the referrer. Check the database for injected posts, options and links. Your host may be able to run a malware scan or restore a clean backup from before the hack.
5. Check what Google has. Search site:example.co.uk and look for titles you did not write. Remove spam URLs so they return 404 or 410, and use Search Console’s URL Inspection to confirm Google now sees your real page.
6. Ask for a review if Google flagged you. If Search Console’s Security issues report lists a problem, request a review there once the site is clean.

If a developer or host manages the site, send them the report: the evidence shows what was found on each page and which copy it was in, such as the title Googlebot was given, which saves them a lot of searching.

Malicious behaviour without a hack

Not every malicious-practices sign is an attack. A page that opens a new window by itself, a pop-under advert network or a script that traps the Back button may come from an advert provider or a plugin you installed. Remove the script or switch to an advert setup that only opens things when visitors click. A Web Risk listing on a linked site means you are sending visitors somewhere Google considers unsafe: remove or replace the link. A Web Risk listing on your own URL is an emergency and goes through the clean-up above.

The Security Audit fixes page covers hardening steps, such as security headers, that make the next attack harder.

Link spam, user-generated spam and thin affiliation

Google defines link spam as “creating links to or from a site primarily for the purpose of manipulating search rankings”, and its link guidance asks owners to mark advertisements and paid placements with the sponsored value. The audit looks at links on your own pages: sold, affiliate and advert links, link exchanges, sponsored posts and site-wide keyword links. It does not check links pointing to you from other sites.

Marking paid, sponsor and affiliate links

Most link spam signs on ordinary sites are not sold links at all, just a missing attribute. Sponsor logos on a club website, “featured supplier” boxes that are paid for, Amazon or Awin product links, and advertorials all count as paid in Google’s eyes. Add rel="sponsored" to each one. rel="nofollow" is also accepted. The link still works for visitors.

<a href="https://partner.example.com/" rel="sponsored">Our kit sponsor</a>
<a href="https://www.amazon.co.uk/dp/XXXXXXXXXX?tag=yourtag-21" rel="sponsored noopener">Check the price</a>

In WordPress, most affiliate link plugins and many page builders have a setting to add sponsored automatically; turn it on and check the output in the page source. Sponsored posts need the attribute on every outbound link in the paid content. Link exchange pages and “link back to us” requirements should simply be retired.

Links that other sites point at you are a separate matter. If you once bought links, see judging and removing toxic backlinks.

User-generated spam

Google defines this as “spammy content added to a site by users through a channel intended for user content”. Delete the spam comments, posts, signatures or profiles the report points to, and stop more arriving: hold first comments for moderation, add a spam filter, require sign-up confirmation, close comments on old posts, and remove or noindex empty member profiles. Mark user-submitted links with rel="ugc" (most forum and comment software can do this automatically). Remove uploaded files containing spam and restrict which file types users can upload.

Thin affiliation

The audit flags pages that are mostly affiliate links with little of your own text. It cannot tell whether descriptions were copied from the merchant, so read the page as a buyer would. The fix is not more words but your own knowledge: why each product made the list, what you found using it, who it suits and who should pick something else, with your own photos where you can. Cut products you cannot say anything useful about. Mark every affiliate link rel="sponsored" as well.

Scaled content, doorways and site reputation

These three policies all concern pages created mainly to rank rather than to help. Google describes scaled content abuse as “when many pages are generated for the primary purpose of manipulating search rankings and not helping users”, doorway abuse as pages “created to rank for specific, similar search queries”, and site reputation abuse as third-party content published on a host site mainly because of the host’s established ranking signals.

Near-copy and town-swap pages

The audit looks for groups of near-copies, reworded copies and pages made of other sites’ snippets, and for near-identical town or keyword pages plus short pages that funnel visitors on to the same contact or booking page. Shop, account and listing pages share templates by design and are left out, and so are branch pages that carry their own local details.

For each flagged group, choose one of two routes:

• Make each page genuinely different. A page for a real branch should have its own address, opening hours, team, photos, reviews, local prices or service details, and a map. Pages for products or car makes should explain what differs: parts, prices, problems you see with that make, jobs you have done.
• Merge them. If you cannot honestly say something different for each town or variation, combine them into one strong page and 301-redirect the old addresses to it. One good “areas we cover” page beats thirty thin ones.

See branch pages for multi-location sites for how to build location pages that stand on their own. For content produced in bulk with AI or templates, Google has said the method is not the issue; the purpose and value are. Prune or rewrite pages nobody would miss.

Site reputation

The audit flags coupon, casino, loan and similar sections that your site is not about. If you host such a section for a partner, Google’s guidance is to remove it or keep it out of Google’s index (for example with noindex). If you did not know it was there, it may have been added through a compromised account, so check user accounts and treat it like a hack.

Expired domain abuse

Google describes this as “where an expired domain name is purchased and repurposed primarily to manipulate search rankings by hosting content that provides little to no value to users”. The audit checks whether the domain was registered again after holding a different site, using the public registration record and the Wayback Machine, and compares the old site’s main words with your homepage.

A sign here records a change of subject after a new registration. It does not say your content is low value, which is the other half of Google’s definition. Plenty of legitimate businesses buy a name someone else let lapse. What matters is what you do with the domain’s past.

What to do

• Look at the history yourself. Check the domain on the Wayback Machine to see what it held and for how long.
• Do not trade on the old reputation. Do not recreate the old organisation’s pages, keep its URLs alive with unrelated content, or redirect its old pages to your money pages to capture their links. Old URLs that have no equivalent on your site should return 404 or 410.
• Review links from the old life. If the domain carries backlinks aimed at the previous site, particularly from schemes you would not want to be associated with, consider whether disavowing them is warranted.
• Make your own purpose obvious. A clear About page, real contact details and content that clearly belongs to your business leave no doubt about what the site is now.

If the result says the check could not be completed, no registration date could be found for the domain, the Wayback Machine did not answer, or its old copies could not be loaded. The report marks this Not checked automatically. That is not a sign; try again later if you want an answer.

Scam and fraud, and spammy structured data

Google says scam and fraud include “impersonating an official business or service through imposter sites, intentionally displaying false information about a business or service, or otherwise attracting users to a site on false pretenses”. The audit looks for pages posing as a brand’s or a government’s official service.

Scam and fraud signs on an honest site

On a legitimate business, this sign usually comes from a carelessly worded title. An independent repair shop titled “Official Example Brand Support”, or a paid application-help service titled as if it were the government service itself, misleads visitors whatever the intention. Rename the page to say what you are: “Independent repairs for Example Brand appliances” or “Help with your application (we are not a government website)”. Link to the official service, state your fees clearly, and never offer to sell official documents such as driving licences or passports. If you find pages like that on your site and did not create them, treat it as a hack.

Ratings in markup that the page does not show

Google’s structured data guidelines say markup must describe content visible on the page. The audit checks for ratings and reviews in the markup that the page does not show, a common way to fake star ratings in results.

• If the reviews are real, show them on the page the markup is on: the rating, the number of reviews and the reviews themselves or a clear summary.
• If they are not, or cannot be shown there, remove the aggregateRating and review properties from that page.
• Check plugins. Some schema and review plugins add a rating to every page or to the site-wide Organization block by default. Switch that off and limit ratings to the pages that display them.

Be aware that Google does not show review stars for reviews a business publishes about itself on its own LocalBusiness or Organization markup, so site-wide self-ratings rarely earned stars anyway. Test changes with Google’s Rich Results Test.

Misleading functionality and scraping

Google defines misleading functionality as “intentionally creating sites that trick users into thinking they would be able to access some content or services but in reality can’t”, and scraping as “taking content from other sites, often through automated means, and hosting it with the purpose of manipulating search rankings”. The audit checks the patterns a website shows: content lockers, fake download buttons and tool pages with nothing to use, and pages that are mostly media embedded from other sites. It cannot check whether text was copied from elsewhere, so that needs your own review.

Lockers, fake buttons and empty tools

• Content lockers and offer walls (“complete a survey to unlock”): remove them. If you need sign-ups, ask for an email address openly and deliver what you promised.
• Fake download buttons that lead to adverts: remove the advert units styled as buttons, or change advert settings so they are clearly labelled as adverts and look nothing like your own controls.
• Tool pages with nothing to use: if a page promises a free calculator, checker or generator, the tool must be there and working. If the tool was removed, rewrite the page as an article, redirect it to a working alternative, or take it down. Check that the tool still works when scripts load slowly or are blocked by a consent tool.

Pages built from other sites’ media

A page that is just an embedded video or social post with a heading adds little. Keep embeds where they support your own writing: a summary, your commentary, a transcript or notes on why it matters. Merge or remove pages that are only an embed. If you republish anything from elsewhere, have permission, credit the source, and add enough of your own that the page is worth visiting on its own.

Which signs to fix first

Some signs mean your site is under someone else’s control; others are a five-minute markup change. Work in this order:

1. Anything pointing to a hack. Spam shown only to Googlebot, redirects to unrelated sites, injected spam words, hidden casino or pharmacy links, suspicious scripts or a Web Risk listing. Every day a hack stays live, Google may be indexing spam under your name and visitors may be sent to harmful sites.
2. Scam and fraud wording. Misleading people about who you are is a risk well beyond search.
3. Malicious behaviour from your own scripts. Self-opening windows, pop-unders and back-button traps hurt every visit.
4. Unmarked paid, sponsor and affiliate links. Usually the quickest fix of all, and the most common sign on ordinary sites in the study published on the tool page.
5. Fake ratings in markup. A short edit to your schema settings.
6. Keyword stuffing. An afternoon of rewriting footers, titles and the worst pages.
7. Doorway, scaled and thin affiliate pages. These take the longest because each page needs real content or a merge decision.
8. Expired domain history. Mostly a review of old URLs and links rather than a change to your current pages.

A sensible order of work

1. Run the audit. Start from the Spam Policy Audit. Signed out it checks up to 20 URLs; signed in you can check up to 100, limit it to one folder, give your own URL list or choose which policies to report.
2. Read the evidence before changing anything. For each sign, open the URL it names and find the exact link, text or title quoted. Decide whether it is a real problem or a firewall or rotating-content effect.
3. Deal with hacks first, as in the priority list, and keep a note of every file and setting you change.
4. Batch the quick markup fixes. Link attributes, rating markup and titles can usually be done in one sitting, often through a theme or plugin setting that fixes every page at once.
5. Plan the content work. List each doorway or thin page and decide: rewrite, merge or remove.
6. Use the help in the report. The AI fix prompt can be pasted into an AI coding tool for changes to your HTML, CSS and JavaScript; server, hosting and DNS changes are listed separately. If you would rather hand the work over, use Request a quote under the report. Back up first either way.
7. Run the audit again. Confirm the signs have gone, then check Search Console for manual actions or security issues. If your traffic dropped during a Google spam update, the spam update recovery guide explains what recovery can look like.