Spam Policy Audit Guide: The Complete Reference
The Spam Policy Audit is a reader, not a judge. It fetches the public pages of a website in several guises, compares what each guise receives, and reports for every one of Google’s spam policies it can test whether it saw signs of the practice that policy describes. This reference covers the whole tool: how it chooses which URLs to read, why each page is fetched as more than one kind of visitor, what each of the 17 checks covers, how to read the four result types, what changes when you sign in, and the boundaries of what any outside check can see.
What the audit does and does not claim
Google publishes a set of spam policies describing practices that can cause pages or whole sites to rank lower or disappear from results. They range from deliberate tricks, such as showing search engines different content from visitors, to things owners do without realising, such as leaving sponsor links unmarked. Google enforces them with automated systems and, sometimes, human reviewers. It does not offer site owners a way to test their own site against them.
The audit fills that gap from the outside. It does three things:
- It reads your public pages, exactly as anyone on the internet could, and never logs in, installs anything or writes to your server.
- It looks in those pages for the patterns Google’s policies describe, at the level shown in the tool’s feature list: for example hidden links, repeated place names, unmarked affiliate links or ratings in markup that the page does not display.
- It reports each policy with a status and, where it found something, the evidence: the URL, what was found and which copy of the page it appeared in.
What it does not do is decide that your site is spam. Google weighs intent, scale and signals no outside tool can see. The tool page puts it plainly: a sign is something worth looking at, not a verdict. Equally, a clean report is not a guarantee. It means none of the patterns the audit tests for showed up on the URLs it read.
To show how the finished audit behaves on real websites, we ran it on every URL of 469 ordinary small UK sites picked at random, plus 199 gambling sites found among them. Of the ordinary sites, 445 (94.9%) showed no signs and 24 (5.1%) showed signs against at least one policy. The full write-up, including every rule and threshold the audit uses, is published as the study on the tool page. This guide deliberately describes the checks in plainer, less technical terms.
Which URLs are read
The audit always starts with your homepage. If the homepage cannot be loaded or returns an error, the audit stops and tells you, because nothing else can be judged reliably.
Finding the rest
- Sitemaps first. It reads the sitemaps declared in your
robots.txt, or tries/sitemap.xmlif none are declared, and follows a sitemap index to every sitemap it lists. URLs are then taken in the order your sitemaps list them. - Links as a fallback. If there is no working sitemap, it follows internal links from the homepage, staying on the same site.
- Duplicates removed. Addresses that differ only trivially are checked once, and a URL that simply redirects to a page already checked is not checked again.
What counts as checkable
Web pages and text files such as .md, .txt, .json and .xml
are read and checked. Images, PDFs and other non-text files are listed in the report as not checked,
as is any URL that could not be loaded. That listing is useful in itself: a long run of failed URLs can
point to an overloaded server or an over-eager firewall.
How many
| How you run it | URLs checked | Pages also opened in Chrome | Choice of URLs |
|---|---|---|---|
| Signed out (free) | Up to 20 | Up to 10 | Homepage, then sitemap order |
| Signed in, Advanced controls | 20, 50 or 100, depending on the tier you choose | Up to 10 or up to 25 | Whole site, one folder, or your own list |
The report shows how many URLs were found and how many were checked, so you can see at a glance whether a run covered the whole site or only its first pages. The free version has a daily allowance for each connection; the page says so if you reach it. A run usually takes a few minutes.
Five fetches and a real browser
Several spam practices only show up when you compare what different visitors receive. A hacked site may serve spam only to Google’s crawler, or redirect only people who arrive from a search result on a phone, precisely so that the owner, typing the address directly on a desktop, sees nothing wrong. So every checkable URL is fetched:
- as an ordinary visitor on a computer;
- as Googlebot;
- as a visitor on a mobile phone;
- as a visitor arriving from Google on a computer;
- as a visitor arriving from Google on a phone.
The copies are then compared for content and for where each one finally lands.
The Chrome pass
Plain HTML does not show everything. Redirects written in JavaScript, links hidden by a stylesheet, content built by a framework and windows that open by themselves only appear when a page actually runs. So a selection of pages, always including the homepage, is also opened in Chrome as a visitor, as Googlebot and as a mobile visitor from Google. Pages that already look suspicious in their HTML are given priority for this pass. Stylesheets, scripts and comments loaded by JavaScript are checked on those pages; every other page is checked from its HTML.
The Googlebot caveat
The audit’s Googlebot requests use Googlebot’s name, but they do not come from Google’s own network. Many security services verify crawlers by their network origin, as Google recommends, and challenge or block impostors. The audit recognises common firewall, bot-check and maintenance pages and does not compare them, but if your security layer treats unverified Googlebot requests differently in an unusual way, the result can look like cloaking. If that is the explanation, nothing needs changing. Search Console’s URL Inspection tool shows what the genuine Googlebot receives and settles the question.
The 17 checks
Google lists 16 spam policies. The audit checks 15 of them automatically, plus two further areas Google also describes: scam and fraud, and spammy structured data. The descriptions below are the level of detail the tool publishes in its feature list; the precise rules are in the study.
| Check | What the audit looks for |
|---|---|
| Cloaking | Each URL fetched as a visitor, as Googlebot and on mobile, then compared; selected pages also compared in Chrome. |
| Sneaky redirects | Where visitors, Googlebot, mobile users and visitors from Google each end up, including script redirects. |
| Hidden text and link abuse | Links and text hidden from visitors, including by stylesheets, colour and position. |
| Keyword stuffing | Repeated phrases, lists of phone numbers and places, repeated words in alt text and titles. |
| Hacked content | Spam words in 11 languages, hidden iframes, suspicious scripts and auto-generated pages. |
| Malicious practices | Google Web Risk on every URL and linked site, hidden code, mining, pop-under and back-button tricks. |
| Link spam | Sold, affiliate and advert links, link exchanges, sponsored posts and site-wide keyword links. |
| User-generated spam | Spam in comments, forum signatures, member profiles and uploaded files. |
| Thin affiliation | Pages that are mostly affiliate links with little of the site’s own text. |
| Scaled content abuse | Near-copies, reworded copies and pages assembled from other sites’ snippets. |
| Doorway abuse | Near-identical town or keyword pages, and short pages that funnel visitors onward. |
| Site reputation | Coupon, casino, loan and similar sections on a site that is not about those subjects. |
| Expired domain abuse | Whether the domain was registered again after holding a different site. |
| Misleading functionality | Content lockers, fake download buttons and tool pages with nothing to use. |
| Scraping | Pages that are mostly media embedded from other sites. |
| Scam and fraud | Pages posing as a brand’s or a government’s official service. |
| Spammy structured data | Ratings and reviews in the markup that the page does not show. |
How the expired domain check works
This one draws on outside records rather than your pages alone. The audit reads when the domain’s current registration began from the public registration record (RDAP), then asks the Wayback Machine whether a site existed on the domain before that date. If one did, the old site’s main words are compared with your homepage, and a domain registered again after holding a site about something else is reported as a sign. If no registration date can be found, or the Wayback Machine does not answer or its old copies cannot be loaded, the report says the check could not be completed. If the archive simply holds no copy from before the current registration, there is no earlier site to compare, and the result is no signs found.
Ordinary features the checks leave alone
Much of a normal website looks suspicious to a careless scanner: drop-down menus hide text, shop templates repeat wording across hundreds of products, cookie banners start invisible, and social icons link out on every page. The audit was tuned over nine study runs specifically to leave these alone, so a sign on your report has already passed a filter for the most common innocent patterns.
Reading the four result types
Every policy in the report ends up with one of four statuses. Policies with signs are listed first.
| Status | What it means | What to do |
|---|---|---|
| Signs found | The audit found at least one pattern the policy describes, and lists each one with its URL, what was found and which copy it came from. | Open each URL, confirm the evidence, then fix or explain it. |
| Information | Something worth knowing that is not a sign. | Read it; act if it reveals something you did not intend. |
| No signs found | None of the patterns the audit tests for appeared on the URLs it checked. | Nothing, though remember the run may not have covered every URL. |
| Not checked automatically | The practice cannot be seen from a website, or the expired domain check could not be completed. | Review it yourself against Google’s description. |
The evidence lines
Each sign is backed by evidence, usually one line per URL or per link. The line tells you which version of the page held the problem. That matters more than it sounds. A problem in the visitor copy is something you can see by opening the page yourself. A problem that appears only in the Googlebot or visitor-from-Google copy will not show up when you browse your own site normally, which is why owners of hacked sites are so often unaware.
What sits in Not checked automatically
Machine-generated traffic is the one Google spam policy the audit cannot test, because it concerns automated queries sent to Google, not anything a site shows. Three of the other practices Google lists as leading to demotion or removal are also outside reach: legal removals, personal information removals and policy circumvention. They depend on Google’s own records. The report lists all four so that you can tick them off by hand.
Expired domain abuse can also be marked Not checked automatically on a particular run. That happens when no registration date could be found for the domain, when the Wayback Machine did not answer, or when its old copies could not be loaded. It is not a sign; running the audit again later may complete the check.
The DataForSEO spam score
Signed-in runs add a spam score from DataForSEO for your site and the sites it links to. It is shown as information only. It is DataForSEO’s own measure, not something Google publishes, so it never counts as a sign. A high score on a site you link to is a prompt to look at that link, nothing more.
Running the audit, step by step
Step 1
Decide how much of the site to cover
For a small site of twenty pages or fewer, the free run covers everything, so use it as
it is. For a larger site, sign in and open Advanced controls. Pick the URL tier that
fits, and decide whether to read the whole site from its sitemaps, a single folder such as /blog/
where trouble is suspected, or your own list of key pages. You can also limit the report to particular
policies, which helps when rechecking one fix.
Step 2
Enter the address and confirm consent
Type
the full address of the site, including https://. Any public website can be checked, so
agencies can audit client sites and owners can audit a site before buying it. Where the form asks, tick
the box confirming you are happy for the address to be checked by the audit tools, then run it. The audit
only reads public pages, so you never need to provide a login or install anything on the server.
Step 3
Wait for every URL to be read
Keep the page open while the audit works. Each URL is fetched several ways and selected pages are opened in Chrome, so a run normally takes a few minutes and can take longer on slow servers. If your hosting has strict rate limits or bot protection, some fetches may fail; that usually shows in the coverage figures or as “not compared” rather than as a sign. Avoid running several audits on the same site at once, which only adds load.
Step 4
Start with the coverage summary
Before reading any policy result, compare how many URLs were found with how many were checked, and look at the list of URLs that were not checked or could not be loaded. If important sections were missed, the clean results below do not cover them. Fix sitemap order, use the folder option or supply your own URL list, and run again before drawing any conclusions about pages the audit never read.
Step 5
Work through each policy with signs
Take the policies at the top of the report one at a time. For each evidence line, open the URL, find the quoted link, text, title or markup, and note which copy it came from. Decide whether it is the practice Google describes, a security layer reacting to an unverified crawler, or an innocent pattern the rules did not expect. Record your decision next to each line, so that nothing gets fixed twice or forgotten.
Step 6
Note the Information and unchecked items
Read every Information result, because some point to useful tidying even though they are not signs, such as a linked site with a high third-party spam score on a signed-in run. Then read Google’s descriptions of machine-generated traffic, legal removals, personal information removals and policy circumvention, and confirm that none applies to how you run the site. Write that confirmation down with the date of the audit.
Step 7
Choose how the fixes get done
Use Copy AI fix prompt to hand the HTML, CSS and JavaScript changes to an AI coding tool; server, hosting and DNS changes are listed separately and are not part of the prompt. Back up the site before any tool edits it. Alternatively, choose Request a quote for this work, which sends the signs and their fixes automatically. When the changes are live, clear any caches and run the same audit again.
Signed-in Advanced controls
Signing in unlocks a form that shapes the run. Every option changes what is read or reported; none changes how strictly a policy is judged.
- How many URLs to check: up to 20, 50 or 100.
- Which URLs: the whole site from your sitemaps, one folder only, or your own list of URLs (one per line, up to 100, all on the same site). Your homepage is always checked first whichever you pick.
- Pages opened in a real browser: up to 10 or up to 25. More pages in Chrome means more script-driven redirects and stylesheet tricks can be seen, at the cost of a longer run.
- Which policies: tick the ones you want in the report, with All and None shortcuts. The four practices that cannot be checked automatically are still listed.
When to use each option
The folder option suits a site where one section has a different history: a blog written by a past
agency, a /shop/ with affiliate feeds, or a /locations/ folder full of town
pages. The URL list suits a quick recheck after fixes, and sites whose sitemaps are missing or untrustworthy.
Narrowing the policies makes a follow-up report shorter and easier to share with whoever made the fix.
A 25-page Chrome allowance matches what the published study used for every site, so a signed-in run gives the same depth of browser checking the study figures are based on.
After the report
Below every report are three actions: copy the AI fix prompt, request a quote for the work, or check another site.
The AI fix prompt
The prompt summarises the signs found and the changes needed, ready to paste into an AI coding tool. It deliberately covers only changes to your site’s own files, meaning HTML, CSS and JavaScript. Anything involving server configuration, hosting settings or DNS is listed separately, because those changes carry more risk and depend on your provider. Back up the site before letting any AI tool change it, and review its edits before publishing.
Requesting a quote
If you would rather someone else made the changes, Request a quote for this work sends a request that already includes the signs found and their fixes, so you do not need to explain the problem again.
Following up with Google
After fixing, check Search Console for manual actions and security issues. If either report lists a problem, request a review or reconsideration there once the site is clean. If your traffic changed after a spam update, Google’s advice is to review its spam policies, and the audit gives you a structured starting point for that. The fixes page covers the repair for each policy family.
Known limits
An outside audit sees what the public sees. These limits come from that, and from choices made to keep false alarms down.
- Backlinks. The policy checks read only your own pages. Links pointing to you from elsewhere are covered by Google’s link spam policy but are not part of any sign.
- Copied text. Scraping and thin affiliation are judged on what a page shows, not on whether its words were lifted from another site. That needs a manual check.
- Cloaking aimed at Google’s real network. A site that only serves spam to requests from genuine Google addresses will not be caught, because the audit’s requests do not come from Google.
- Pages outside the Chrome pass. Those are checked from their HTML only, so script-driven tricks on them may go unseen.
- Expired domains. The check depends on the registry publishing dates and the Wayback Machine answering. When either fails, the result says so.
- Networks of sites. Each audit looks at one site. Patterns that only appear across many domains are out of scope.
- Coverage. A run reads at most 100 URLs. On a larger site, a problem in an unread section will not be reported.
- Tuned to avoid false alarms. The rules favour precision. A stricter tool would flag more, along with many more innocent pages.
The study on the tool page reports the misses it knows about, including one hacked site caught under cloaking but not under hacked content, and explains how many sites the expired domain check could not complete.
1. Is the Spam Policy Audit free to use?
The signed-out audit is free. You do not need an account or a card: enter a website address and the report appears on the same page, covering up to 20 URLs. There is a daily free allowance for each connection, and the page tells you if you reach it. Signed-in runs through Advanced controls are charged in credits, in tiers of 20, 50 or 100 URLs, and add a folder option, your own URL list, more Chrome pages and a choice of policies.
2. Why does my report say some URLs were not checked?
Images, PDFs and other files that are not text are listed but not downloaded, because the checks work on page text and markup. Any URL that could not be loaded, for example because it timed out or returned an error, is listed too. On a free run, URLs beyond the first 20 are simply not reached. The coverage figures show how many URLs were found and how many were actually checked, so you can judge how complete the picture is.
3. Does the audit see JavaScript-built pages?
Partly. Every URL is fetched as HTML, and a selection of pages, always including the homepage and favouring any that look suspicious, is also opened in Chrome so that scripts run. Stylesheets, scripts and comments loaded by JavaScript are checked on those pages. Pages outside that selection are checked from their HTML only. Signing in lets you raise the number of pages opened in Chrome, which helps on sites built with a JavaScript framework.
4. Can I audit a site I do not own?
Yes. The audit reads only public pages, as any visitor or search engine would, so it can check any public website. That makes it useful for agencies reviewing a prospective client, for buyers looking at a site or domain before purchase, and for owners checking a competitor's practices. It never logs in, never submits forms and writes nothing to the server. You confirm you are happy for the address to be checked before the run starts.
5. Why is machine-generated traffic always marked Not checked automatically?
Because it concerns what a site owner does to Google rather than anything a website displays. Google's policy covers sending automated queries to Google, such as scraping its results or running rank checks with bots. Nothing in a site's pages reveals that. The same goes for legal removals, personal information removals and policy circumvention, which depend on Google's own records. The report lists all four so that you can review them yourself instead of assuming they were tested.
6. Where can I see the exact rules and thresholds?
The audit's detailed rules, including the thresholds and word lists it uses, are published in the study on the Spam Policy Audit page, in its section on rules and thresholds. The study also explains how the rules were refined over nine runs to stop ordinary features such as menus and shop templates being flagged. This guide and the other support pages describe the checks in plain terms, which is enough to understand and fix any sign.
7. How accurate is the audit?
In the published study, every sign raised on the final run was reviewed by hand against its evidence. On ordinary sites, three signs, all cloaking, turned out to be false alarms and were removed from the figures. The study also reports a known miss and explains why the expired domain check could not be completed on some sites. No automated check is perfect, which is why every sign shows its evidence so that you can confirm it yourself.
The Spam Policy Audit Fixes page takes each policy family in turn, from cloaking and hidden links to doorway pages, expired domains and fake ratings, and explains the change that removes each sign.
Open Spam Policy Audit Fixes →