Canonical URL: https://aiwebpageseo.com/spam-audit.html Owner: AI Web Page SEO Contact: advice@aiwebpageseo.com Documentation: https://aiwebpageseo.com/aipageseo-demo-pages/ AI usage permissions: This page and its content may be used by AI systems for indexing, summarisation, and training purposes. Attribution to AI Web Page SEO is appreciated where content is reproduced. # Example Spam Policy Audit Report, Explained Line by Line This page walks through a Spam Policy Audit report for Brookfield Garden Rooms, a fictional company that designs and builds garden offices, on the placeholder address example.co.uk. It is an illustrative example written to show the kinds of results the report gives and how to read them. It is not the output of a real audit, and no real website’s data appears here. Brookfield’s report has four policies with signs, one Information item, a row of clean results and the four practices no website check can see. Each is explained below, with what the owner should do about it. By John Carlsson · Updated 1 October 2026 · About 15 minutes to read 1. [About this example](#about) 2. [The report at a glance](#overview) 3. [Sign 1: link spam from a paid box](#link-spam) 4. [Sign 2: doorway pages for each town](#doorway) 5. [Sign 3: a block of place names](#stuffing) 6. [Sign 4: ratings the pages do not show](#ratings) 7. [The quieter results](#quiet) 8. [Reading this report, step by step](#fix) 9. [What a good outcome looks like](#outcome) 10. [Questions and answers](#faq) ## About this example Brookfield is the sort of business the audit is built for: a small firm with a WordPress site put together by a freelance designer some years ago, updated now and then by the owner. The site has service pages, a gallery, a quote form, a blog with buying advice, a testimonials page and a set of “garden rooms in [town]” pages that a previous marketing agency added. ### How the run was set up The owner signed in and used Advanced controls with these choices: | Setting | Choice in this example | Why | | How many URLs to check | Up to 50 URLs | The sitemap lists a little over 40 pages, so 50 covers the lot. | | Which URLs | The whole site (from your sitemaps) | A first full audit, so nothing is excluded. | | Pages opened in a real browser | Up to 25 pages | Several pages rely on scripts from plugins. | | Which policies | All | Nothing is known yet, so every policy is reported. | The free, signed-out version would have checked the first 20 URLs only, and opened fewer pages in Chrome, which on this site would have missed most of the blog and several town pages. ## The report at a glance The report lists policies with signs first. Here is how Brookfield’s came out, summarised in one table so the shape of the result is clear before going into detail. | Policy | Status in the example | In one line | | Link spam | **Signs found** | A paid “featured supplier” box links out without `rel="sponsored"`. | | Doorway abuse | **Signs found** | Nine town pages, including the Belper page, differ only by the town name. | | Keyword stuffing | **Signs found** | A long block of village names on the main service page. | | Spammy structured data | **Signs found** | A star rating in the markup of pages that show no reviews. | | Spam score (DataForSEO) | Information | Third-party scores for the site and the sites it links to. | | Cloaking | No signs found | None of the patterns appeared; a few Googlebot copies were bot-check pages and were not compared. | | Sneaky redirects, hidden text and link abuse, hacked content, malicious practices | No signs found | None of the patterns appeared. | | User-generated spam, thin affiliation, scaled content abuse, site reputation, misleading functionality, scraping, scam and fraud | No signs found | None of the patterns appeared. | | Expired domain abuse | No signs found | No archived copy from before the current registration, so there is no earlier site to compare. | | Machine-generated traffic, legal removals, personal information removals, policy circumvention | Not checked automatically | Cannot be seen from a website; review by hand. | The pattern is typical of an honest small site: no sign of tampering, and a handful of problems created by well-meant marketing decisions. None of the four signs suggests anyone is attacking the site, which is why the owner can work through them calmly rather than treating the report as an emergency. ## Sign 1: link spam from a paid box The evidence for link spam lists one line per link. In the example, each blog post carries the same sidebar box headed “Featured supplier”, which a decking company pays Brookfield to show. The links in it have no `sponsored` or `nofollow` marking. | URL | Copy | What was found | | `https://example.co.uk/blog/insulating-a-garden-office/` | Visitor | Advert link to `decking.example.com` in a sponsor box, not marked sponsored | | `https://example.co.uk/blog/planning-permission-garden-rooms/` | Visitor | Advert link to `decking.example.com` in a sponsor box, not marked sponsored | | `https://example.co.uk/blog/heating-a-garden-room/` | Visitor | Advert link to `decking.example.com` in a sponsor box, not marked sponsored | The real report would continue for every blog page where the box appears. The repetition is a clue: one widget is responsible for every line, so one change clears them all. ### What it means and what to do This is the most ordinary kind of link spam sign. Brookfield is not selling links to manipulate rankings; it simply never labelled a paid placement. Google asks for paid links to carry `rel="sponsored"`, so the fix is to edit the sidebar widget once: ``` ``` After saving the widget and clearing the site cache, viewing the source of any blog post should show the attribute on the link. ## Sign 2: doorway pages for each town The doorway evidence names a group of pages built from one pattern. In Brookfield’s case the previous agency created a page for each nearby town, each titled “Garden Rooms in [Town] | Brookfield Garden Rooms”, with the same text and photos and only the town name swapped. | URL | What was found | | `/garden-rooms-ashby/` | Nearly the same as `/garden-rooms-belper/`; title differs by one word | | `/garden-rooms-ripley/` | Nearly the same as `/garden-rooms-belper/`; title differs by one word | | `/garden-rooms-matlock/` | Nearly the same as `/garden-rooms-belper/`; title differs by one word | | …and five more town pages in the same group | ### What it means and what to do Brookfield has one workshop and no branches, so these pages cannot honestly be made local in the sense of an address or opening hours. What the firm does have is completed projects in several of those towns. A sensible plan: - Keep pages only for the three towns where Brookfield has built several garden rooms, and rewrite each around those real projects: photos, what the customer needed, any local planning points the team dealt with. - Merge the other six into one “Where we work” page and redirect their old addresses there with 301 redirects. - Remove the town pages from the sitemap if they are deleted, and update any menu or footer links. A rewrite of this size takes longer than the other fixes, so it goes last on the job list. ## Sign 3: a block of place names On the main “Garden rooms” service page, below the description of the work, sits a paragraph that starts “We install garden rooms in” and then lists dozens of villages and towns separated by commas. The keyword stuffing evidence quotes the start of that list and names the URL, in the visitor copy. Lists like this are one of the examples Google gives of keyword stuffing. Customers do not read them, and they make the page look as though it was written for search engines. The audit set aside the site’s navigation and footer before looking, so the sign is about the paragraph in the main content, not the menu. ### What to do Replace the list with a sentence a person would actually write, for example: “We are based near Belper and build garden rooms across Derbyshire and the edges of Nottinghamshire and Leicestershire. If you are unsure whether we cover your area, send us your postcode.” A simple coverage map does the same job visually. Pair this with the new “Where we work” page from the doorway fix so the information has one proper home. ## Sign 4: ratings the pages do not show The spammy structured data evidence lists pages whose markup includes an `aggregateRating` although nothing on the page shows a rating or reviews. On Brookfield’s site, a reviews plugin had been set to add the rating to the business’s markup on every page, while the reviews themselves only appear on `/testimonials/`. ``` ``` That block, appearing on the home, gallery and blog pages, is what the evidence points at. ### What it means and what to do Google’s structured data guidelines say markup should describe what the page shows. The reviews here are real, so nothing is being invented, but they are not visible where the markup claims them. Google also does not show review stars for reviews a business hosts about itself in this kind of markup, so the rating was earning nothing in search anyway. The owner should switch off the plugin’s site-wide rating option and, if wanted, keep review markup only on the testimonials page where customers can read the reviews. The Rich Results Test can confirm what each page now outputs. ## The quieter results It is tempting to skip everything below the signs. These results still tell the owner useful things. ### Information: spam score Because the run was signed in, the report includes a spam score from DataForSEO for example.co.uk and for the sites it links to, listing the highest-scoring linked sites with the page that links to each. It is DataForSEO’s own measure and not a Google figure, so it is information only. In the example, the decking supplier and the rest of the linked sites look unremarkable, and there is nothing to act on. ### No signs found, with a note Cloaking shows no signs. In the example, a few URLs received a bot-check page from the site’s CDN when requested as Googlebot, so those copies were not compared. That is the security service doing its job with an unverified crawler, not a fault. If the owner wants certainty about those pages, Search Console’s URL Inspection shows what the real Googlebot receives. Expired domain abuse shows no signs: the Wayback Machine holds no archived copy of example.co.uk from before the current registration, so there is no earlier site to compare. ### Not checked automatically Machine-generated traffic, legal removals, personal information removals and policy circumvention are listed for the owner to review by hand. Brookfield does not send automated searches to Google, has had no copyright or personal information removal requests and has never moved domains to dodge action, so the owner notes “not applicable” against each. The same label would appear against expired domain abuse if that check could not be completed, for example if no registration date could be found or the Wayback Machine did not answer; here it could be completed. ### Files listed but not checked The sitemap includes a PDF brochure and some gallery images. These are listed as not checked because they are not text, which is expected. ## Reading this report, step by step Step 1 ### Check the run settings and coverage Before trusting any result, confirm what was read. In this example the report found just over forty URLs and checked every text URL, with the PDF and images listed as not text files and not checked. Had the free run been used, the town pages near the end of the sitemap might never have been reached, and the doorway sign would have been missed entirely. Always compare found and checked numbers first. Step 2 ### Scan the summary for patterns Look at which policies have signs and ask what they have in common. Here, link spam came from one paid widget, while the town pages and the village list both came from a past push for local searches, and the rating came from a plugin setting. Spotting those shared causes early turns what looks like four separate problems into three or four small editing jobs, each with a single owner. Step 3 ### Read each sign against its page Open each URL named in the evidence and find the exact item quoted, whether that is the sponsor link, the near-identical town text, the village paragraph or the rating block in the page source. Check which copy it came from. Everything in this example was in the visitor copy, which means the owner can see it directly and there is nothing hidden only for Googlebot. Step 4 ### Trace each sign to its source Work out where each problem lives so it is fixed once: the sidebar widget settings for the sponsor link, the agency’s page template for the town pages, the service page editor for the village list, and the reviews plugin’s options for the rating. Fixing the source rather than individual pages stops the same issue reappearing the next time a post or town page is published. Step 5 ### Read the quiet results properly Go through the Information item, the clean policies and the four unchecked practices. Confirm that the bot-check note under cloaking is explained by the CDN, that nothing in the spam score list is surprising, and write a short answer against each practice that cannot be checked automatically. This turns a clean result into a recorded decision rather than an assumption nobody has looked at. Step 6 ### Turn the report into a job list Order the work from quickest to longest: mark the sponsor link, remove the site-wide rating, rewrite the village paragraph, then rebuild or merge the town pages. Copy the AI fix prompt for the template and markup edits, or request a quote if the designer should handle it. Back up the site first, and plan a second audit with the same settings once everything is live. ## What a good outcome looks like Continuing the illustration: after the changes, the owner runs the audit again with the same Advanced controls settings so the two reports can be compared fairly. - **Link spam** moves to no signs found, because the sponsor box now carries `rel="sponsored"`. - **Spammy structured data** moves to no signs found once the rating appears only on the testimonials page. - **Keyword stuffing** clears with the village list gone. - **Doorway abuse** clears once six town pages are merged and redirected and the remaining three describe real local projects. Two points are worth drawing out. First, a clean second report shows the patterns have gone from the pages read; it does not say anything about how Google will rank the site, which depends on far more than spam. Second, the owner keeps both reports, because they document what was found and fixed, which is useful if questions arise later, for example after a Google spam update. For the full repair instructions for every policy, see the [Spam Policy Audit Fixes](/aipageseo-demo-pages/spam-audit-fixes-index.html). For how each part of the report is produced, see the [Spam Policy Audit Guide](/aipageseo-demo-pages/spam-audit-guide.html), and if the ideas are new to you, start with the [beginner tutorial](/aipageseo-demo-pages/novice-tutorial-spam-audit.html). To run the real thing on your own site, go to the [Spam Policy Audit](/spam-audit.html). ### 1. Is this a real audit of a real company? No. Brookfield Garden Rooms is fictional and example.co.uk is a placeholder address used for this walk-through, and every finding, address and count on this page was written to illustrate how the report presents results. None of it comes from a real audit or from the study published on the tool page. The result types, the kind of evidence shown and the actions available under the report do match what the real Spam Policy Audit produces, so you can use it to learn how to read your own. ### 2. Why does the example show signs on an honest business? Because that is how most signs on ordinary sites arise. The audit reports patterns that Google's spam policies describe, whatever the intention behind them. A paid supplier box without the right link label, town pages written by a past agency and a plugin that adds ratings everywhere are all common on genuine small business sites. Showing them here makes the point that a sign is a prompt to tidy something up, not an accusation. ### 3. Would the free version have found the same things? Not necessarily. Signed out, the audit checks up to 20 URLs, starting with the homepage and following the sitemap order, and opens fewer pages in Chrome. On a site the size of the example, that could leave the later blog posts and several town pages unread, so some evidence lines, or whole signs, might not appear. For a site with more than twenty URLs, signing in and choosing a larger tier gives fuller coverage, up to 100 URLs. ### 4. What would a hacked site's report look like instead? It would typically show signs under cloaking, hacked content and sometimes sneaky redirects or hidden links, with evidence that appears only in the Googlebot, mobile or from-Google copies of pages. The quoted titles would often be gambling or pill pages, frequently in another language, that the owner never wrote. That pattern calls for an immediate clean-up rather than routine editing, and the fixes page explains the steps a developer or host will need to take. ### 5. Why is the spam score shown if it is not a sign? It is extra context available on signed-in runs. DataForSEO scores the audited site and the sites it links to, and the report lists the highest-scoring linked sites alongside the page that links to each. It is DataForSEO's own measure rather than anything Google publishes, so it never counts towards the policy results. It is most useful for spotting an outbound link to a site you would rather not be associated with. ### 6. Should Brookfield delete all its town pages to be safe? Not necessarily. Google's doorway policy targets near-copies made to catch searches for each place, not pages that genuinely help people in a particular area. Brookfield has real projects in a few towns, so pages built around those projects, with their own photos and details, can stay. The pages it cannot make genuinely different are better merged into one coverage page with redirects, which keeps any visitors and links that arrive at the old addresses. Spam Policy Audit Fixes covers each policy the audit reports, including link spam, doorway pages, keyword stuffing and spammy structured data, with the change that clears each sign. ### About aiwebpageseo aiwebpageseo.com is a data-driven SEO and AEO (Answer Engine Optimisation) platform providing a free suite of technical SEO tools. Rather than relying on AI-theorised assumptions, the platform analyses live URL performance, delivering objective diagnostics, page speed metrics, CLS debugging, and site crawl data alongside actionable technical tutorials. # Beginner Tutorial: Checking Your Website Against Google’s Spam Policies You do not have to be a spammer to have a spam problem. Most small business websites that run into Google’s spam policies got there by accident: a web designer left a sponsor link unmarked years ago, a plugin added star ratings nobody checked, or someone broke in through an old plugin and hid gambling pages that only Google can see. This tutorial explains, without jargon, what Google’s spam rules are, why they matter to a small firm, and how to run a first check of your own website calmly and make sense of what comes back. By John Carlsson · Updated 1 October 2026 · About 15 minutes to read 1. [What Google means by spam](#basics) 2. [Why this matters to a small business](#why) 3. [Seeing your site the way Google does](#googlebot) 4. [The checks, grouped in plain terms](#families) 5. [Your first audit, step by step](#fix) 6. [Making sense of the four answers](#results) 7. [Glossary](#glossary) 8. [What to do next](#next) 9. [Questions and answers](#faq) ## What Google means by spam When most people hear “spam” they think of junk email. Google uses the word more widely. In search, spam means a web page or a website trying to get a higher place in Google’s results by tricking Google rather than by being useful, or trying to mislead the people who visit it. Google writes these tricks down in a public document called its spam policies. Each policy names one kind of trick. Some sound technical, like “cloaking”, but the ideas behind them are simple. A few examples in everyday language: - **Showing Google one thing and customers another.** Like a shop that puts a respectable window display out for the inspector and something quite different inside. - **Stuffing a page with search words.** A footer listing sixty towns, or a page that repeats “cheap plumber Derby” in every sentence. - **Links that were paid for but pretend not to be.** A link to a sponsor or an online shop that pays you commission, without the small label Google asks for. - **Lots of near-identical pages.** Thirty “Our services in [town]” pages that are the same apart from the town name. - **Misleading or harming visitors.** Fake download buttons, pages pretending to be a government service, or star ratings that nobody gave. Google puts it in its own words for each policy. For example, it says keyword stuffing “refers to the practice of filling a web page with keywords or numbers in an attempt to manipulate rankings in Google Search results”. The idea running through all of them is the same: do not try to fool Google or your visitors. ## Why this matters to a small business If Google decides part of a site breaks its spam policies, those pages, or the whole site, can drop down the results or disappear from them. That can happen automatically, through Google’s spam-fighting systems and the regular “spam updates” it announces, or through a person at Google applying what is called a manual action, which shows up as a message in Google Search Console. For a small firm that relies on people finding it locally, losing those positions can mean the phone stops ringing, and it is often hard to work out why. A few points worth knowing: - **Most problems are accidents.** In the study published alongside the audit, 445 of 469 ordinary small UK websites (94.9%) showed no signs at all. Of the 24 (5.1%) that did, most had a single thing to fix, often affiliate or sponsor links not marked as paid. - **Hacks are the serious exception.** The same study found small business sites, including a shop and an estate agent, where criminals were showing Google gambling pages while the owners saw their normal website. - **Customers are affected too.** A hacked site can send visitors to scam or malware sites. Even when search rankings are not hit, that damages trust in your name. - **Fixing early is cheaper.** Marking a link or removing a fake rating takes minutes. Recovering from a manual action or a long-running hack takes much longer. ## Seeing your site the way Google does Google finds and reads websites with a program called **Googlebot**. It visits your pages, reads them and reports back to Google. When Googlebot visits, it announces itself by name, a bit like a courier saying who they are at the door. That politeness is exactly what criminals exploit. A common type of hack adds a small piece of hidden code to a website. When an ordinary person visits, the code does nothing and the site looks normal. When Googlebot visits, or sometimes when someone arrives from a Google search on their phone, the code serves up a page of gambling or pill adverts instead, often in another language. Google stores that page under the business’s name. The owner, who visits by typing the address into their own browser, never sees it. So the Spam Policy Audit does something an owner normally cannot: it visits each page several times, as an ordinary visitor, as Googlebot, as a phone user and as someone arriving from Google, and compares the results. If the versions disagree in a suspicious way, the report shows you what was found and which version of the page it was in. One honest caveat: the audit uses Googlebot’s name, but its visits do not come from Google itself. Some website security services spot that and block the visit, which is sensible behaviour. If your report shows a difference that turns out to be a security block page, that is not a problem with your site. ## The checks, grouped in plain terms The audit checks 15 of Google’s 16 spam policies, plus scam and fraud and spammy structured data, which Google also describes. It is easier to think of them in five groups. ### Things being hidden Cloaking (different content for Google), sneaky redirects (sending some visitors somewhere else), and hidden text and links (words or links on a page that visitors cannot see). On ordinary business sites, these usually mean a hack. ### Pages padded or copied to rank Keyword stuffing, scaled content (many near-copy pages), doorway pages (one page per town or product with only the name changed), thin affiliate pages (mostly shop links, little of your own writing) and scraping (pages that are little more than someone else’s video or post). ### Links Link spam (paid, sponsor and affiliate links without the right label, link swaps, and similar) and user-generated spam (junk left by visitors in comments, forums or member profiles). ### Things that harm or mislead visitors Hacked content, malicious practices (unsafe sites, hidden code, pop-unders, trapping the Back button), misleading functionality (things that promise content or a tool that is not really there), scam and fraud (pretending to be an official service) and spammy structured data (star ratings in the markup that the page does not show). ### Your domain’s past and other people’s content Expired domain abuse (a web address that used to belong to someone else, now used for something different) and site reputation abuse (a section about coupons, casinos or loans that your site is not otherwise about, usually placed there by a third party). Four further items cannot be seen from any website, such as sending automated searches to Google. The report simply lists them for you to think about. ## Your first audit, step by step Step 1 ### Gather what you need Set aside about forty-five minutes when you will not be interrupted. Have your website address ready, a notepad or a simple spreadsheet for writing down what you find, and the details of whoever looks after your site, whether that is you, a web designer or an agency. You do not need any passwords to run the audit itself, because it only looks at the public pages anyone can see. Step 2 ### Run the free check Go to the Spam Policy Audit page, type your full web address including `https://` and press **Check My Site**. There is no account or payment needed. It will look at up to twenty addresses on your site, starting with your homepage. Leave the page open while it works; this usually takes a few minutes because every page is visited several different ways and compared. Step 3 ### Look at the top of the report first Policies marked **Signs found** are listed first. If there are none and every policy says **No signs found**, that is good news for the pages it checked. Also note how many pages it found and how many it checked. If your site has more than twenty URLs, the free run will not have reached them all, so keep that in mind before deciding everything is fine. Step 4 ### Open one finding at a time For each sign, the report shows the page address, what was found and which version of the page it was in. Open that page in your own browser and look for the thing it describes. If the finding was only in the Googlebot version, you will not see it by browsing normally, so do not assume the report is wrong just because the page looks fine to you. Step 5 ### Sort findings into three piles Put each finding into one of three groups. First, urgent: anything suggesting a hack, such as gambling or pill words you never wrote, or visitors being sent to another website. Second, quick fixes you can do yourself, such as labelling a sponsor link or rewriting a list of towns. Third, bigger jobs that need your web designer, such as merging lots of similar pages. Step 6 ### Keep a record and check again later Save or print the report and keep your notes with the date. If there is an urgent pile, contact whoever manages your site that day and send them the report. Once fixes are made, run the audit again to confirm the signs have gone. After that, a check every few months, or after any big change to the site, keeps small problems from quietly growing. ## Making sense of the four answers Every policy in your report gets one of four answers. Here is what each means for you in practice. - **Signs found.** The audit spotted something that matches what a Google spam policy describes. This is not Google’s judgement and it does not mean your site has been punished. Think of it like a warning light in a car: worth looking at soon, and occasionally it turns out to be nothing. - **Information.** Something useful to know that is not a warning in itself. Read it, but it does not need fixing unless it surprises you. - **No signs found.** The audit looked for that kind of problem on the pages it checked and did not see it. - **Not checked automatically.** This is something no website check can see, so you are asked to think about it yourself. For most small businesses the answer is simply “we don’t do that”. The same label is used when the check on your web address’s history could not be completed, for example because the Wayback Machine archive did not answer; that is not a warning either. If the report shows nothing at all, that is the most common outcome for ordinary small sites. It is still worth running again after you change web designer, install new plugins or add a big section to the site. ## Glossary | Term | Plain meaning | | Googlebot | Google’s program that visits and reads web pages so they can appear in search results. | | Spam policies | Google’s published list of tricks it does not allow in search. | | Spam update | An announced improvement to Google’s automatic spam detection. Rankings can move when one rolls out. | | Manual action | A penalty applied by a person at Google, reported in Search Console with the reason. | | Search Console | Google’s free service for website owners, showing how Google sees and reports on your site. | | Sign | A pattern on your site that matches a spam policy description, with the evidence. Not a verdict. | | Cloaking | Showing search engines different content from what people see. | | Redirect | Automatically sending a visitor from one web address to another. | | Affiliate link | A link to a shop that pays you a commission if someone buys. | | `rel="sponsored"` | A small label added to a link’s code telling Google it was paid for or earns you money. | | Structured data | Hidden labels in a page’s code describing it to search engines, such as a business name or a star rating. | | Doorway page | One of many near-identical pages made only to catch searches for each town or variation. | | Expired domain | A web address that someone let lapse and someone else later registered. | | Wayback Machine | A free public archive of old copies of websites, kept by the Internet Archive. | | Plugin | An add-on that gives a website extra features, common on WordPress. Old ones are a frequent way in for hackers. | ## What to do next Once you have your first report, these are sensible next moves, in order. 1. **Handle anything urgent.** A suspected hack comes before everything else. 2. **Do the quick wins.** Labelling paid and affiliate links, removing star ratings that the page does not show, and replacing long town lists with a short sentence are all jobs most owners or designers can finish in an afternoon. The [Spam Policy Audit Fixes](/aipageseo-demo-pages/spam-audit-fixes-index.html) page has the exact change for each. 3. **Ask for help where you need it.** The report has a button to copy an AI fix prompt for changes to your site’s own files, and another to request a quote if you would like the work done for you. Always back up your website before anyone, or any tool, changes it. 4. **Learn the rest gradually.** The [Spam Policy Audit Guide](/aipageseo-demo-pages/spam-audit-guide.html) explains every part of the tool in more depth, including the signed-in options for checking more pages, and the [example report](/aipageseo-demo-pages/demo-spam-audit.html) walks through a made-up business’s results line by line. 5. **Keep the habits that prevent problems.** Keep plugins and themes updated, remove ones you no longer use, use strong unique passwords, and ask any designer or marketing agency to label paid links and avoid near-copy pages. ### 1. Could my website be breaking Google's rules without me knowing? Yes, and it is more common than people think. A web designer may have added sponsor or affiliate links without the label Google asks for, a plugin may be adding star ratings or keyword-heavy titles automatically, or the site may have been hacked in a way that only shows spam to Google. None of these needs any deliberate wrongdoing by the owner, which is exactly why running a check from the outside is useful even for honest businesses. ### 2. Does a sign in the report mean Google has penalised me? No. The audit cannot see Google's decisions; it only looks at your public pages for patterns described in Google's spam policies. A sign means something matches one of those descriptions and deserves a look. Only Google decides whether a site breaks its rules. If you want to know whether Google has taken action, check the Manual actions and Security issues reports in Google Search Console, which are free for any site owner. ### 3. I'm not technical. Can I still fix what the audit finds? Often, yes. Several common fixes are changes you can make in your website editor, such as rewriting a long list of towns, changing a repetitive page title or removing a fake rating in a plugin's settings. For changes to code, the report can give you an AI fix prompt to use with an AI coding tool, or you can send the report to your web designer. There is also a button to request a quote if you want the work done for you. ### 4. Is it safe to run the audit on my live website? Yes. It only reads pages that anyone on the internet can already see, in the same way a visitor or search engine does. It does not log in, fill in forms, install anything or change any files on your server. It does visit each page several times to compare versions, which is a light load for normal hosting. If your security service blocks some of those visits, the report simply shows which pages it could not compare. ### 5. Why would someone hack a small business website? Usually for its reputation with Google rather than for anything on it. An established local business site is trusted by search engines, so criminals hide pages on it promoting gambling, pills or loans, hoping to borrow that trust to rank their pages. Some also redirect visitors arriving from Google to scam sites. They hide this from the owner deliberately, so the hack can carry on for months. Outdated plugins and weak passwords are the usual way in. ### 6. What is rel=sponsored and do I really need it? It is a short label added to a link in your page's code, telling Google that the link was paid for, sponsored or earns you commission. Google asks for it on adverts, sponsor links and affiliate links, and accepts nofollow as an alternative. It does not change what visitors see or stop the link working. If your site thanks sponsors with logos or recommends products through affiliate links, adding the label is one of the quickest fixes there is. ### 7. How often should I run a spam check? A check every few months is reasonable for most small business sites, plus an extra run after any big change, such as a new website, a new web designer, new plugins or a large batch of new pages. Run one straight away if your traffic or enquiries drop suddenly, if Google announces a spam update and your rankings move, or if customers mention being sent to strange websites from yours. The Spam Policy Audit Fixes page explains, policy by policy, how to clear each sign the audit can report, from hacked pages and hidden links to unmarked sponsor links, town-swap pages and fake star ratings. ### About aiwebpageseo aiwebpageseo.com is a data-driven SEO and AEO (Answer Engine Optimisation) platform providing a free suite of technical SEO tools. Rather than relying on AI-theorised assumptions, the platform analyses live URL performance, delivering objective diagnostics, page speed metrics, CLS debugging, and site crawl data alongside actionable technical tutorials. # Spam Policy Audit Guide: The Complete Reference The Spam Policy Audit is a reader, not a judge. It fetches the public pages of a website in several guises, compares what each guise receives, and reports for every one of Google’s spam policies it can test whether it saw signs of the practice that policy describes. This reference covers the whole tool: how it chooses which URLs to read, why each page is fetched as more than one kind of visitor, what each of the 17 checks covers, how to read the four result types, what changes when you sign in, and the boundaries of what any outside check can see. By John Carlsson · Updated 1 October 2026 · About 20 minutes to read 1. [What the audit does and does not claim](#what) 2. [Which URLs are read](#coverage) 3. [Five fetches and a real browser](#views) 4. [The 17 checks](#checks) 5. [Reading the four result types](#statuses) 6. [Running the audit, step by step](#fix) 7. [Signed-in Advanced controls](#advanced) 8. [After the report](#after) 9. [Known limits](#limits) 10. [Questions and answers](#faq) ## What the audit does and does not claim Google publishes a set of spam policies describing practices that can cause pages or whole sites to rank lower or disappear from results. They range from deliberate tricks, such as showing search engines different content from visitors, to things owners do without realising, such as leaving sponsor links unmarked. Google enforces them with automated systems and, sometimes, human reviewers. It does not offer site owners a way to test their own site against them. The audit fills that gap from the outside. It does three things: 1. It reads your public pages, exactly as anyone on the internet could, and never logs in, installs anything or writes to your server. 2. It looks in those pages for the patterns Google’s policies describe, at the level shown in the tool’s feature list: for example hidden links, repeated place names, unmarked affiliate links or ratings in markup that the page does not display. 3. It reports each policy with a status and, where it found something, the evidence: the URL, what was found and which copy of the page it appeared in. What it does not do is decide that your site is spam. Google weighs intent, scale and signals no outside tool can see. The tool page puts it plainly: a sign is something worth looking at, not a verdict. Equally, a clean report is not a guarantee. It means none of the patterns the audit tests for showed up on the URLs it read. To show how the finished audit behaves on real websites, we ran it on every URL of 469 ordinary small UK sites picked at random, plus 199 gambling sites found among them. Of the ordinary sites, 445 (94.9%) showed no signs and 24 (5.1%) showed signs against at least one policy. The full write-up, including every rule and threshold the audit uses, is published as the [study on the tool page](/spam-audit.html#study). This guide deliberately describes the checks in plainer, less technical terms. ## Which URLs are read The audit always starts with your homepage. If the homepage cannot be loaded or returns an error, the audit stops and tells you, because nothing else can be judged reliably. ### Finding the rest - **Sitemaps first.** It reads the sitemaps declared in your `robots.txt`, or tries `/sitemap.xml` if none are declared, and follows a sitemap index to every sitemap it lists. URLs are then taken in the order your sitemaps list them. - **Links as a fallback.** If there is no working sitemap, it follows internal links from the homepage, staying on the same site. - **Duplicates removed.** Addresses that differ only trivially are checked once, and a URL that simply redirects to a page already checked is not checked again. ### What counts as checkable Web pages and text files such as `.md`, `.txt`, `.json` and `.xml` are read and checked. Images, PDFs and other non-text files are listed in the report as not checked, as is any URL that could not be loaded. That listing is useful in itself: a long run of failed URLs can point to an overloaded server or an over-eager firewall. ### How many | How you run it | URLs checked | Pages also opened in Chrome | Choice of URLs | | Signed out (free) | Up to 20 | Up to 10 | Homepage, then sitemap order | | Signed in, Advanced controls | 20, 50 or 100, depending on the tier you choose | Up to 10 or up to 25 | Whole site, one folder, or your own list | The report shows how many URLs were found and how many were checked, so you can see at a glance whether a run covered the whole site or only its first pages. The free version has a daily allowance for each connection; the page says so if you reach it. A run usually takes a few minutes. ## Five fetches and a real browser Several spam practices only show up when you compare what different visitors receive. A hacked site may serve spam only to Google’s crawler, or redirect only people who arrive from a search result on a phone, precisely so that the owner, typing the address directly on a desktop, sees nothing wrong. So every checkable URL is fetched: 1. as an ordinary visitor on a computer; 2. as Googlebot; 3. as a visitor on a mobile phone; 4. as a visitor arriving from Google on a computer; 5. as a visitor arriving from Google on a phone. The copies are then compared for content and for where each one finally lands. ### The Chrome pass Plain HTML does not show everything. Redirects written in JavaScript, links hidden by a stylesheet, content built by a framework and windows that open by themselves only appear when a page actually runs. So a selection of pages, always including the homepage, is also opened in Chrome as a visitor, as Googlebot and as a mobile visitor from Google. Pages that already look suspicious in their HTML are given priority for this pass. Stylesheets, scripts and comments loaded by JavaScript are checked on those pages; every other page is checked from its HTML. ### The Googlebot caveat The audit’s Googlebot requests use Googlebot’s name, but they do not come from Google’s own network. Many security services verify crawlers by their network origin, as Google recommends, and challenge or block impostors. The audit recognises common firewall, bot-check and maintenance pages and does not compare them, but if your security layer treats unverified Googlebot requests differently in an unusual way, the result can look like cloaking. If that is the explanation, nothing needs changing. Search Console’s URL Inspection tool shows what the genuine Googlebot receives and settles the question. ## The 17 checks Google lists 16 spam policies. The audit checks 15 of them automatically, plus two further areas Google also describes: scam and fraud, and spammy structured data. The descriptions below are the level of detail the tool publishes in its feature list; the precise rules are in the study. | Check | What the audit looks for | | Cloaking | Each URL fetched as a visitor, as Googlebot and on mobile, then compared; selected pages also compared in Chrome. | | Sneaky redirects | Where visitors, Googlebot, mobile users and visitors from Google each end up, including script redirects. | | Hidden text and link abuse | Links and text hidden from visitors, including by stylesheets, colour and position. | | Keyword stuffing | Repeated phrases, lists of phone numbers and places, repeated words in alt text and titles. | | Hacked content | Spam words in 11 languages, hidden iframes, suspicious scripts and auto-generated pages. | | Malicious practices | Google Web Risk on every URL and linked site, hidden code, mining, pop-under and back-button tricks. | | Link spam | Sold, affiliate and advert links, link exchanges, sponsored posts and site-wide keyword links. | | User-generated spam | Spam in comments, forum signatures, member profiles and uploaded files. | | Thin affiliation | Pages that are mostly affiliate links with little of the site’s own text. | | Scaled content abuse | Near-copies, reworded copies and pages assembled from other sites’ snippets. | | Doorway abuse | Near-identical town or keyword pages, and short pages that funnel visitors onward. | | Site reputation | Coupon, casino, loan and similar sections on a site that is not about those subjects. | | Expired domain abuse | Whether the domain was registered again after holding a different site. | | Misleading functionality | Content lockers, fake download buttons and tool pages with nothing to use. | | Scraping | Pages that are mostly media embedded from other sites. | | Scam and fraud | Pages posing as a brand’s or a government’s official service. | | Spammy structured data | Ratings and reviews in the markup that the page does not show. | ### How the expired domain check works This one draws on outside records rather than your pages alone. The audit reads when the domain’s current registration began from the public registration record (RDAP), then asks the Wayback Machine whether a site existed on the domain before that date. If one did, the old site’s main words are compared with your homepage, and a domain registered again after holding a site about something else is reported as a sign. If no registration date can be found, or the Wayback Machine does not answer or its old copies cannot be loaded, the report says the check could not be completed. If the archive simply holds no copy from before the current registration, there is no earlier site to compare, and the result is no signs found. ### Ordinary features the checks leave alone Much of a normal website looks suspicious to a careless scanner: drop-down menus hide text, shop templates repeat wording across hundreds of products, cookie banners start invisible, and social icons link out on every page. The audit was tuned over nine study runs specifically to leave these alone, so a sign on your report has already passed a filter for the most common innocent patterns. ## Reading the four result types Every policy in the report ends up with one of four statuses. Policies with signs are listed first. | Status | What it means | What to do | | **Signs found** | The audit found at least one pattern the policy describes, and lists each one with its URL, what was found and which copy it came from. | Open each URL, confirm the evidence, then fix or explain it. | | **Information** | Something worth knowing that is not a sign. | Read it; act if it reveals something you did not intend. | | **No signs found** | None of the patterns the audit tests for appeared on the URLs it checked. | Nothing, though remember the run may not have covered every URL. | | **Not checked automatically** | The practice cannot be seen from a website, or the expired domain check could not be completed. | Review it yourself against Google’s description. | ### The evidence lines Each sign is backed by evidence, usually one line per URL or per link. The line tells you which version of the page held the problem. That matters more than it sounds. A problem in the visitor copy is something you can see by opening the page yourself. A problem that appears only in the Googlebot or visitor-from-Google copy will not show up when you browse your own site normally, which is why owners of hacked sites are so often unaware. ### What sits in Not checked automatically Machine-generated traffic is the one Google spam policy the audit cannot test, because it concerns automated queries sent to Google, not anything a site shows. Three of the other practices Google lists as leading to demotion or removal are also outside reach: legal removals, personal information removals and policy circumvention. They depend on Google’s own records. The report lists all four so that you can tick them off by hand. Expired domain abuse can also be marked Not checked automatically on a particular run. That happens when no registration date could be found for the domain, when the Wayback Machine did not answer, or when its old copies could not be loaded. It is not a sign; running the audit again later may complete the check. ### The DataForSEO spam score Signed-in runs add a spam score from DataForSEO for your site and the sites it links to. It is shown as information only. It is DataForSEO’s own measure, not something Google publishes, so it never counts as a sign. A high score on a site you link to is a prompt to look at that link, nothing more. ## Running the audit, step by step Step 1 ### Decide how much of the site to cover For a small site of twenty pages or fewer, the free run covers everything, so use it as it is. For a larger site, sign in and open **Advanced controls**. Pick the URL tier that fits, and decide whether to read the whole site from its sitemaps, a single folder such as `/blog/` where trouble is suspected, or your own list of key pages. You can also limit the report to particular policies, which helps when rechecking one fix. Step 2 ### Enter the address and confirm consent Type the full address of the site, including `https://`. Any public website can be checked, so agencies can audit client sites and owners can audit a site before buying it. Where the form asks, tick the box confirming you are happy for the address to be checked by the audit tools, then run it. The audit only reads public pages, so you never need to provide a login or install anything on the server. Step 3 ### Wait for every URL to be read Keep the page open while the audit works. Each URL is fetched several ways and selected pages are opened in Chrome, so a run normally takes a few minutes and can take longer on slow servers. If your hosting has strict rate limits or bot protection, some fetches may fail; that usually shows in the coverage figures or as “not compared” rather than as a sign. Avoid running several audits on the same site at once, which only adds load. Step 4 ### Start with the coverage summary Before reading any policy result, compare how many URLs were found with how many were checked, and look at the list of URLs that were not checked or could not be loaded. If important sections were missed, the clean results below do not cover them. Fix sitemap order, use the folder option or supply your own URL list, and run again before drawing any conclusions about pages the audit never read. Step 5 ### Work through each policy with signs Take the policies at the top of the report one at a time. For each evidence line, open the URL, find the quoted link, text, title or markup, and note which copy it came from. Decide whether it is the practice Google describes, a security layer reacting to an unverified crawler, or an innocent pattern the rules did not expect. Record your decision next to each line, so that nothing gets fixed twice or forgotten. Step 6 ### Note the Information and unchecked items Read every Information result, because some point to useful tidying even though they are not signs, such as a linked site with a high third-party spam score on a signed-in run. Then read Google’s descriptions of machine-generated traffic, legal removals, personal information removals and policy circumvention, and confirm that none applies to how you run the site. Write that confirmation down with the date of the audit. Step 7 ### Choose how the fixes get done Use **Copy AI fix prompt** to hand the HTML, CSS and JavaScript changes to an AI coding tool; server, hosting and DNS changes are listed separately and are not part of the prompt. Back up the site before any tool edits it. Alternatively, choose **Request a quote for this work**, which sends the signs and their fixes automatically. When the changes are live, clear any caches and run the same audit again. ## Signed-in Advanced controls Signing in unlocks a form that shapes the run. Every option changes what is read or reported; none changes how strictly a policy is judged. - **How many URLs to check:** up to 20, 50 or 100. - **Which URLs:** the whole site from your sitemaps, one folder only, or your own list of URLs (one per line, up to 100, all on the same site). Your homepage is always checked first whichever you pick. - **Pages opened in a real browser:** up to 10 or up to 25. More pages in Chrome means more script-driven redirects and stylesheet tricks can be seen, at the cost of a longer run. - **Which policies:** tick the ones you want in the report, with All and None shortcuts. The four practices that cannot be checked automatically are still listed. ### When to use each option The folder option suits a site where one section has a different history: a blog written by a past agency, a `/shop/` with affiliate feeds, or a `/locations/` folder full of town pages. The URL list suits a quick recheck after fixes, and sites whose sitemaps are missing or untrustworthy. Narrowing the policies makes a follow-up report shorter and easier to share with whoever made the fix. A 25-page Chrome allowance matches what the published study used for every site, so a signed-in run gives the same depth of browser checking the study figures are based on. ## After the report Below every report are three actions: copy the AI fix prompt, request a quote for the work, or check another site. ### The AI fix prompt The prompt summarises the signs found and the changes needed, ready to paste into an AI coding tool. It deliberately covers only changes to your site’s own files, meaning HTML, CSS and JavaScript. Anything involving server configuration, hosting settings or DNS is listed separately, because those changes carry more risk and depend on your provider. Back up the site before letting any AI tool change it, and review its edits before publishing. ### Requesting a quote If you would rather someone else made the changes, Request a quote for this work sends a request that already includes the signs found and their fixes, so you do not need to explain the problem again. ### Following up with Google After fixing, check Search Console for manual actions and security issues. If either report lists a problem, request a review or reconsideration there once the site is clean. If your traffic changed after a spam update, Google’s advice is to review its spam policies, and the audit gives you a structured starting point for that. The [fixes page](/aipageseo-demo-pages/spam-audit-fixes-index.html) covers the repair for each policy family. ## Known limits An outside audit sees what the public sees. These limits come from that, and from choices made to keep false alarms down. - **Backlinks.** The policy checks read only your own pages. Links pointing to you from elsewhere are covered by Google’s link spam policy but are not part of any sign. - **Copied text.** Scraping and thin affiliation are judged on what a page shows, not on whether its words were lifted from another site. That needs a manual check. - **Cloaking aimed at Google’s real network.** A site that only serves spam to requests from genuine Google addresses will not be caught, because the audit’s requests do not come from Google. - **Pages outside the Chrome pass.** Those are checked from their HTML only, so script-driven tricks on them may go unseen. - **Expired domains.** The check depends on the registry publishing dates and the Wayback Machine answering. When either fails, the result says so. - **Networks of sites.** Each audit looks at one site. Patterns that only appear across many domains are out of scope. - **Coverage.** A run reads at most 100 URLs. On a larger site, a problem in an unread section will not be reported. - **Tuned to avoid false alarms.** The rules favour precision. A stricter tool would flag more, along with many more innocent pages. The study on the tool page reports the misses it knows about, including one hacked site caught under cloaking but not under hacked content, and explains how many sites the expired domain check could not complete. ### 1. Is the Spam Policy Audit free to use? The signed-out audit is free. You do not need an account or a card: enter a website address and the report appears on the same page, covering up to 20 URLs. There is a daily free allowance for each connection, and the page tells you if you reach it. Signed-in runs through Advanced controls are charged in credits, in tiers of 20, 50 or 100 URLs, and add a folder option, your own URL list, more Chrome pages and a choice of policies. ### 2. Why does my report say some URLs were not checked? Images, PDFs and other files that are not text are listed but not downloaded, because the checks work on page text and markup. Any URL that could not be loaded, for example because it timed out or returned an error, is listed too. On a free run, URLs beyond the first 20 are simply not reached. The coverage figures show how many URLs were found and how many were actually checked, so you can judge how complete the picture is. ### 3. Does the audit see JavaScript-built pages? Partly. Every URL is fetched as HTML, and a selection of pages, always including the homepage and favouring any that look suspicious, is also opened in Chrome so that scripts run. Stylesheets, scripts and comments loaded by JavaScript are checked on those pages. Pages outside that selection are checked from their HTML only. Signing in lets you raise the number of pages opened in Chrome, which helps on sites built with a JavaScript framework. ### 4. Can I audit a site I do not own? Yes. The audit reads only public pages, as any visitor or search engine would, so it can check any public website. That makes it useful for agencies reviewing a prospective client, for buyers looking at a site or domain before purchase, and for owners checking a competitor's practices. It never logs in, never submits forms and writes nothing to the server. You confirm you are happy for the address to be checked before the run starts. ### 5. Why is machine-generated traffic always marked Not checked automatically? Because it concerns what a site owner does to Google rather than anything a website displays. Google's policy covers sending automated queries to Google, such as scraping its results or running rank checks with bots. Nothing in a site's pages reveals that. The same goes for legal removals, personal information removals and policy circumvention, which depend on Google's own records. The report lists all four so that you can review them yourself instead of assuming they were tested. ### 6. Where can I see the exact rules and thresholds? The audit's detailed rules, including the thresholds and word lists it uses, are published in the study on the Spam Policy Audit page, in its section on rules and thresholds. The study also explains how the rules were refined over nine runs to stop ordinary features such as menus and shop templates being flagged. This guide and the other support pages describe the checks in plain terms, which is enough to understand and fix any sign. ### 7. How accurate is the audit? In the published study, every sign raised on the final run was reviewed by hand against its evidence. On ordinary sites, three signs, all cloaking, turned out to be false alarms and were removed from the figures. The study also reports a known miss and explains why the expired domain check could not be completed on some sites. No automated check is perfect, which is why every sign shows its evidence so that you can confirm it yourself. The Spam Policy Audit Fixes page takes each policy family in turn, from cloaking and hidden links to doorway pages, expired domains and fake ratings, and explains the change that removes each sign. ### About aiwebpageseo aiwebpageseo.com is a data-driven SEO and AEO (Answer Engine Optimisation) platform providing a free suite of technical SEO tools. Rather than relying on AI-theorised assumptions, the platform analyses live URL performance, delivering objective diagnostics, page speed metrics, CLS debugging, and site crawl data alongside actionable technical tutorials. # How to Fix Every Spam Policy Audit Finding The Spam Policy Audit reads your public pages the way visitors and Googlebot do and reports, policy by policy, whether it saw signs of the practices described in Google’s spam policies. A sign is a pointer to something worth checking, never a ruling: only Google decides whether a site breaks its policies. This page is the repair manual. Each section below covers one family of policies, explains what kind of evidence the report shows for it, and gives the changes that remove the underlying problem rather than hide it. Start with the priority list if your report shows several signs. By John Carlsson · Updated 1 October 2026 · About 25 minutes to read 1. [Where each finding is fixed](#findings) 2. [Cloaking and sneaky redirects](#cloaking-redirects) 3. [Hidden text and link abuse](#hidden-text-links) 4. [Keyword stuffing](#keyword-stuffing) 5. [Hacked content and malicious practices](#hacked-malicious) 6. [Link spam, user-generated spam and thin affiliation](#links-ugc-affiliate) 7. [Scaled content, doorways and site reputation](#scaled-doorway-reputation) 8. [Expired domain abuse](#expired-domains) 9. [Scam and fraud, and spammy structured data](#scam-structured-data) 10. [Misleading functionality and scraping](#misleading-scraping) 11. [Which signs to fix first](#priority) 12. [A sensible order of work](#workflow) 13. [Questions and answers](#faq) ## Where each finding is fixed The report groups its results by policy and lists any policy with signs found at the top, each with the URL, what was found and which copy of the page it was found in. Use the list below to jump to the section that matches the heading in your report. Related policies share a section because the same change often clears several of them at once: removing a hack, for instance, usually clears cloaking, sneaky redirects and hacked content together. - [Cloaking and sneaky redirects](/aipageseo-demo-pages/spam-audit-fixes-index.html#cloaking-redirects): Googlebot, phones or visitors arriving from Google being shown something different, or sent somewhere else. - [Hidden text and link abuse](/aipageseo-demo-pages/spam-audit-fixes-index.html#hidden-text-links): links or wording placed in the page but kept out of sight. - [Keyword stuffing](/aipageseo-demo-pages/spam-audit-fixes-index.html#keyword-stuffing): runs of town names or phone numbers, phrases repeated far beyond normal writing, and repetitive titles or alt text. - [Hacked content and malicious practices](/aipageseo-demo-pages/spam-audit-fixes-index.html#hacked-malicious): injected spam, suspicious scripts, hidden iframes, Web Risk listings, pop-unders, mining code and back-button tricks. - [Link spam, user-generated spam and thin affiliation](/aipageseo-demo-pages/spam-audit-fixes-index.html#links-ugc-affiliate): unmarked paid, sponsor and affiliate links, spam in comments and profiles, and pages that are mostly affiliate links. - [Scaled content, doorways and site reputation](/aipageseo-demo-pages/spam-audit-fixes-index.html#scaled-doorway-reputation): near-copy pages, town-swap pages and sections about subjects your site is not about. - [Expired domain abuse](/aipageseo-demo-pages/spam-audit-fixes-index.html#expired-domains): a domain registered again after it held a site on a different subject. - [Scam and fraud, and spammy structured data](/aipageseo-demo-pages/spam-audit-fixes-index.html#scam-structured-data): claims to be an official service, and ratings in the markup that the page does not show. - [Misleading functionality and scraping](/aipageseo-demo-pages/spam-audit-fixes-index.html#misleading-scraping): content lockers, fake download buttons, empty tool pages and pages built from other sites’ embedded media. Four items always appear as **Not checked automatically**: machine-generated traffic, legal removals, personal information removals and policy circumvention. They depend on what a site owner does towards Google or on Google’s own records, so nothing on your pages can show them. There is nothing to fix in your HTML for those; simply read Google’s description and confirm none applies to you. The same status is also given to expired domain abuse when that check could not be completed: no registration date could be found, the Wayback Machine did not answer, or its old copies could not be loaded. Results marked **Information** are worth knowing but are not signs, and **No signs found** means the audit saw none of the patterns it looks for in that policy on the URLs it checked. For the full explanation of how the report is laid out and what each status means, see the [Spam Policy Audit Guide](/aipageseo-demo-pages/spam-audit-guide.html). ## Cloaking and sneaky redirects Google describes cloaking as “presenting different content to users and search engines with the intent to manipulate search rankings and mislead users”. Sneaky redirecting is sending people somewhere they did not expect, or sending search engines and users to different places. The audit loads every URL as a visitor, as Googlebot, on a phone and as a visitor arriving from Google, opens selected pages in Chrome the same ways, and compares where each one ends up and what each one is shown. ### First, rule out your own firewall The audit’s Googlebot requests carry Googlebot’s name but do not come from Google’s network. Google itself recommends that sites verify Googlebot by checking where a request really comes from, so a firewall, security plugin or CDN bot filter may block or challenge the audit’s Googlebot. The audit recognises common bot-check, firewall and maintenance pages and does not compare them, but an unusual challenge page can slip through. Look at the evidence: if the Googlebot copy is a block page, a loading screen or a “checking your browser” message, the cause is your security layer and no change is needed. Confirm with Search Console’s URL Inspection tool, which fetches the page from Google’s real network. ### When the difference is real If the Googlebot copy carries a title or wording you did not write, often gambling, pills or loans and frequently in another language, treat it as a hack and go straight to the [hacked content section](/aipageseo-demo-pages/spam-audit-fixes-index.html#hacked-malicious). The injected code checks the visitor’s user agent or referrer and only serves spam to Google or to people arriving from search, which is why the owner never sees it. Search your theme files, `.htaccess`, `wp-config.php`, must-use plugins and database options for the words `googlebot`, `HTTP_REFERER` and `HTTP_USER_AGENT`, and for long encoded strings. If the difference is deliberate, for example a plugin that serves a stripped-down page to crawlers, or a mobile redirect to a separate domain for phone users only, remove it. Give every visitor and Googlebot the same content at the same address. Responsive design, or a mobile page that shows equivalent content, is fine. A redirect that sends everyone to the same place is not sneaky. ### Redirects made by scripts Script redirects that only fire for phones, after a delay, or only for visitors from Google are a common payload of hacked advert scripts. Remove third-party scripts you cannot account for, and replace any intentional JavaScript or meta refresh redirect with a server-side 301 that applies to everyone. Old event or campaign pages that bounce to link shorteners should be removed or redirected to a relevant page on your own site. ## Hidden text and link abuse In Google’s words, this is “placing content on a page in a way solely to manipulate search engines and not to be easily viewable by human visitors”. The audit looks for links and text hidden from visitors, including by stylesheets, colour and position, and it leaves out ordinary hidden interface parts such as menus, tabs, accordions, sliders, cookie notices and screen-reader text. ### Finding the hidden element Open the flagged URL in Chrome, press `Ctrl+F` (or `Cmd+F`) in the developer tools Elements panel and search for the link text or address the report quotes. Look at the element’s computed styles. Typical tricks are a zero font size, text the same colour as the background, a box with `overflow:hidden` that is too small to show its contents, an element pushed far off-screen, or links tucked inside `