1. Summary
This is the full report of a study we ran with the Spam Policy Audit on this page. We checked every URL of 662 small websites against Google’s spam policies, and we report every figure, how we got it, and every rule that decides what counts as a sign.
The study has two groups, and they behave so differently that we report them side by side as well as together.
- 463 ordinary sites: small websites (under 100 URLs each) picked at random from the Tranco list of the world’s top million sites. 22 of them (4.8%, about 1 in 21, with a 95% confidence range of 3.2% to 7.1%) showed signs against at least one of Google’s spam policies. 5 showed signs against two or more.
- 199 gambling sites: every gambling site the random sample turned up that could still be checked. 190 of them (95.5%) showed signs, almost all of them links with commonly sold casino link text that weren’t marked as paid.
- All 662 together: 212 sites (32.0%, about 1 in 3) showed signs against at least one policy.
The most common signs among ordinary sites were link spam (5 sites carried sponsor, advert or affiliate links without the rel="sponsored" or rel="nofollow" marking Google asks for) and keyword stuffing (5 sites). Next came expired domain abuse (4 of the 430 sites where it could be checked), cloaking (3), hacked content (3) and thin affiliation (3).
The most serious finding was three hacked sites: a clothing shop, an estate agent and a county agricultural show. Each one sent Googlebot a gambling page in Turkish or Indonesian, while visitors and the owners saw the normal site. On the estate agent’s site it happened on 43 pages. The county show also sent some visitors to other websites.
The gambling sites tell a different story. Most of them aren’t casinos. They’re blogs about lifestyle, business, coins or the outdoors, nearly all registered in July 2026, whose real purpose is to carry links with text such as “casino not on GamStop” to other websites. 78 of them also hid that link text in a box too small to show it. Three sat on domains that used to belong to a wedding directory, a parenting site and a London estate’s blog.
This is the eleventh full run of the study. Since the figures we published from run 9 on 1 October, we changed the audit in seven ways, each to fix a miss or a false alarm we had found and reported. Section 6 sets out each change, why we made it, and the proof that it works. The miss we reported in run 9, a hacked estate agent the audit caught under cloaking but not under hacked content, is now caught under both.
We reviewed every sign by hand against its evidence. Three ordinary-site signs (two cloaking and one keyword stuffing) were false alarms, and so were 32 “hacked content” signs on gambling sites, where the gambling articles were placed by the sites’ own owners. These are taken out of every figure above and explained in section 10. Nothing else was adjusted, and no rule was changed after we saw the results. Changes made to the live audit after the run are set out in sections 6.9 and 6.10; they don’t change these figures.
The biggest limit of run 9 has largely gone. Expired domain abuse could be checked on 430 of the 463 ordinary sites this time, against 369 of 469 before, and on 177 of the 199 gambling sites, against 54. Section 10 explains what is still left unchecked.
2. Why we did this study
Google updates the systems that find spam several times a year, and it lists these spam updates alongside its other ranking updates. Its advice to site owners is short. In its own words: “Sites that see a change after a spam update should review our spam policies to ensure they are complying with those.”
That advice assumes an owner can tell whether their site has a problem. Many can’t. A hacked site may look perfect to its owner, because the spam is only shown to Googlebot. An affiliate link a web designer added years ago may be missing a single attribute. A domain may have been bought after a charity let it lapse, and nobody running the new site may know. Google’s policies describe these practices clearly, but they don’t give owners a way to check for them.
We built the Spam Policy Audit to give them one. It reads a site’s public pages the way Google and visitors do, compares what each is shown, and reports the patterns Google’s policies describe. Before publishing figures about it, we wanted to answer four questions with real sites rather than test pages:
- How common are signs of spam on ordinary small websites? Not big brands, which have teams to watch for this, but the clubs, shops, local firms and hobby sites that make up most of the web.
- Which policies do they run into? Whether the problems are deliberate tricks, or ordinary mistakes such as unmarked affiliate links.
- What does the gambling corner of the web look like? Our first runs showed that a large share of small domains carry gambling content. We wanted to measure it properly instead of leaving it out.
- Can an automated audit tell real spam from ordinary website features? Menus that open and close, cookie notices, shop templates, firewalls and pages built by JavaScript all look like spam to a careless check. A tool that cries wolf on half the web is no use to anyone.
The fourth question shaped the whole project. Our first full run flagged 85.6% of sites, and nearly all of those signs were wrong. Over eleven runs we looked at every sign the audit raised, found the ones that were ordinary features, and changed the rules until they were no longer flagged, while making sure the real problems still were. We also looked for what it missed, and fixed that too. Section 5 tells that story, and section 6 sets out the changes made since the figures we published from run 9. The figures in this report come only from the last run, made with the current rules.
One thing this study doesn’t do is decide that any site is spam. Only Google can do that. The audit reports signs: patterns that Google’s policies describe, with the evidence for each. Throughout this report, “a site with signs” means the audit found at least one such pattern on it, and a person checked that the pattern was really there.
3. The sites
Where the sites came from
We started from the Tranco list, a free ranking of the top one million websites that academic studies of the web use because it’s stable and hard to manipulate. We shuffled its domains into a random order using a fixed seed (20260926). Anyone with the same list and seed gets the same order, so the sample can be repeated.
A random sample from the Tranco list is not a sample of every website. Sites on the list are ones that get some traffic, and sites with no visitors at all aren’t on it. But it isn’t a list of big brands either: the domains on it run from national newspapers to village clubs, and once the large sites are left out, most of what remains is small.
Small sites only
We kept only sites with fewer than 100 URLs, and checked every one of their URLs. We made that choice for three reasons:
- Every URL counts. A hacked page, a doorway page or a stuffed page can be anywhere on a site. Checking a sample of pages from a big site would miss it, and we wanted a clean answer for each site: signs or no signs, with nothing left unchecked.
- Small sites are the ones with no one watching. A large site usually has a developer or an agency. A small one often has an owner who set it up years ago.
- Time. Each URL is loaded five times, and up to 25 pages are opened in a real browser. A study of large sites would have taken weeks.
A site was set aside as “too big” as soon as its sitemaps listed more than 99 URLs on the same site (or more than 1,980 URLs of any kind), or as soon as following its links found a 100th URL.
How the ordinary group was fixed
The ordinary group was set in our fourth run, on 27 September 2026. That run went down the shuffled list and tried 836 domains. It skipped sites that were too big or couldn’t be loaded, and set aside every gambling site, until 487 sites had been checked in full. Those 487 sites were then carried through every later run, so each improvement to the rules was measured on the same sites.
Over the following days, 15 of them dropped out: 11 had grown past 99 URLs and 4 could no longer be loaded. That left 472 going into the final run, the same 472 as run 9, in the same order. Nine couldn’t be checked on the day: two had grown past 99 URLs, four timed out, one refused every request (HTTP 403), one sent a homepage with no readable text, and one took longer than the 20-minute limit each site is given. 463 ordinary sites were checked in full.
How gambling sites were found
Gambling turned out to be everywhere in the list. Before our fourth run we removed every domain with a gambling word in its name (casino, poker, bingo, roulette, jackpot, GamStop, blackjack, betting, lotto, sportsbook, plinko): 1,453 of them. The same rule removed 23 more names from the list used for the final run. Even so, 185 of the 836 domains that run tried (22.1%) turned out to be gambling sites. 147 of those carried gambling link networks and 38 had a gambling homepage, including 13 on ordinary names that now show gambling.
A site counted as a gambling site when either of these was true:
- its homepage title was about gambling (words such as bet, casino, slots, bingo, poker, free spins, GamStop or the names of big bookmakers);
- its pages linked to 3 or more different websites with gambling link text (casino, GamStop, betting, bookmaker, poker, roulette or jackpot).
The exact word lists are in section 13.
Why gambling sites are in the study
When we first published, we left gambling sites out. They distort every total, and a reader who wants to know about ordinary websites doesn’t want a quarter of the sample to be casino networks.
We changed our minds for two reasons. First, leaving them out hides something real: a fifth of the small domains we tried were gambling sites. Second, gambling sites are exactly where Google’s spam policies bite hardest, so they’re the best test of whether the audit finds what it should. A check that found nothing on a casino link network would be broken.
So the final run checked a gambling group as well, in full, with the same audit: every gambling site from the earlier runs that could still be checked, 199 in all, the same 199 as run 9. We planned 200. One fewer was available because the earlier runs had found no more. All 199 were checked in full. The results are reported together, so the study covers small websites as we found them, and separately, because the two groups are so different that a single figure would mislead.
The final sample
| Ordinary | Gambling | All | |
|---|---|---|---|
| Sites checked in full | 463 | 199 | 662 |
| URLs checked | 12,130 | 5,766 | 17,896 |
| URLs per site (median) | 18 | 2 | 16.5 |
| Sites with only one URL | 114 | 7 | 121 |
| URLs found through a sitemap | 273 sites | 108 sites | 381 sites |
| URLs found by following links (no sitemap) | 190 sites | 91 sites | 281 sites |
| Pages opened in Chrome | 7,819 | 2,529 | 10,348 |
| Sites where every HTML page was opened in Chrome | 309 | 108 | 417 |
The gambling sites have a small median (2 URLs) but a higher average (29), because the link blogs split in two: 80 of them have only 2 URLs, while 63 have 20 or more articles.
Every URL was loaded five ways, so the run made about 89,500 page loads with the plain audit, on top of the 10,348 pages opened in Chrome. Each of those Chrome pages was opened three times, as a visitor, as Googlebot and as a phone user arriving from Google: about 31,000 browser views in all.
4. How each site was checked
Every site in the study was checked with the same audit that runs on this page, using the same code file. The only differences are the ones a study needs: every URL was checked instead of the first 20 or 100, up to 25 pages per site were opened in a real browser, and Google Web Risk was asked about the homepage only. The study made no calls to paid data services.
Step 1: the homepage
The audit starts by loading the homepage twice at the same time: once as a visitor on a computer, and once as a visitor arriving from Google (with Google as the referring page). At the same time it asks Google Web Risk, Google’s own list of unsafe sites, whether the homepage is listed. If the homepage can’t be loaded, or returns an error, the site is recorded as “could not load” and isn’t counted.
Step 2: finding every URL
The audit reads every Sitemap: line in the site’s robots.txt, or tries /sitemap.xml if there are none. It follows a sitemap index to every sitemap it lists. A sitemap only counts if it loads and really is a sitemap.
If there’s no sitemap, or the sitemaps list nothing, the audit follows every link on every page it loads, staying on the same site. 273 ordinary sites had a working sitemap, and 190 were checked by following links.
Some homepages are built entirely by JavaScript: the HTML the server sends is an empty shell, and the links only appear once a browser runs the page. When there’s no sitemap and the homepage HTML has under 150 words and fewer than 3 links to the site itself, the audit opens the homepage once in Chrome and follows the links it finds there, including links inside web components, which ordinary page code doesn’t show. Section 6 explains why we added this.
Duplicate addresses are removed (ignoring www., a trailing slash, letter case and anything after #). Files that aren’t text, such as images, PDFs, videos and Office documents, are listed but not downloaded. Pages and text files such as .txt, .md, .json and .xml are checked.
Step 3: five loads of every URL
Every text URL is loaded five times, one after another:
- as a visitor on a computer (a current desktop Chrome identity);
- as Googlebot (Googlebot’s own identity string);
- as a visitor on a mobile phone (an Android Chrome identity);
- as a visitor on a computer arriving from Google;
- as a visitor on a phone arriving from Google.
Comparing the five copies is how cloaking and sneaky redirects are found: a hacked site often shows spam only to Googlebot, or sends only visitors from Google somewhere else, because that’s what earns money while keeping the owner unaware.
Each request asks for English, follows up to 5 redirects (checking each step is a public address), and gives a page 9 seconds to load. A page is read up to 2 MB. A page that answers “temporarily unavailable” gets one more try after 3 seconds. After the first “too many requests”, the audit slows down for the rest of the site and waits as the site asks (section 6.7). Up to 5 URLs of a site are checked at once.
One point matters for every cloaking result. The audit’s Googlebot requests use Googlebot’s name but don’t come from Google’s network. A site that checks where requests really come from, as Google advises, will treat them as an ordinary visitor or block them as an impostor. So a firewall can make a page look different to the audit’s “Googlebot” without any cloaking. The audit recognises firewall, bot-check, maintenance and error pages and never compares them. In the final run, 89 URLs on 8 ordinary sites returned such pages and weren’t compared.
Step 4: a real browser
Many tricks only show up when a page’s JavaScript runs: redirects made by scripts, links hidden by stylesheets, text pushed outside a box, pop-up windows. So the audit also opens pages in Chrome, three times each:
- as a visitor on a computer (a 1366 × 900 screen);
- as Googlebot;
- as a mobile visitor arriving from Google (a 390 × 844 touch screen).
Chrome can’t run on every URL of a large site, so the audit chooses. The homepage always goes first. Then come pages whose HTML already looks suspicious: redirect code, hidden or packed code, code that checks who’s visiting, rare scripts from other sites, hidden iframes, pop-up or back-button code, or very little text with scripts. Then one page from each section of the site not yet covered. The rest of the allowance is filled with other pages in order.
In the study the allowance was 25 pages and 240 seconds per site, the same as a signed-in audit on this page. Chrome opened 10,348 pages across 661 sites. On 417 sites, every HTML page was opened in Chrome. Pages load four at a time with a 15-second limit, plus up to 5 more seconds while short timers or network activity are still running, so delayed redirects are seen.
If the pages opened first show that the site is built by JavaScript (on at least half of them, the browser shows 150 or more words and at least twice the words of the page’s HTML), its HTML can’t be trusted, so every other page is opened in Chrome too, within a 20-minute limit, and its text is checked as the browser shows it.
The browser runs behind a safety proxy that refuses private and internal network addresses and any port other than 80 and 443. Downloads are refused, pop-up windows are closed and recorded, and Chrome’s own sandbox stays on.
Step 5: the checks
With every copy loaded, the audit applies its rules for each policy. It checks 15 of Google’s 16 spam policies, plus scam and fraud and spammy structured data, which Google also describes. Machine-generated traffic can’t be seen from a website, and neither can three of the “other practices” Google lists (legal removals, personal information removals and policy circumvention). The report lists those for review by hand. Since run 11, the live audit marks the first three as “Can’t be checked” with a link to check them, and reports policy circumvention from the other checks’ findings (see 6.9).
Each policy ends up as one of four results: signs found, no signs, information (something worth knowing that isn’t a sign) or not checked. Every sign comes with its evidence: the URL, what was found, and which copy it was found in. Section 13 sets out every rule.
Step 6: registration and the Wayback Machine
To check for expired domain abuse, the audit reads the date the domain’s current registration started, from the public registration record (RDAP). It then asks the Wayback Machine, the Internet Archive’s record of old web pages, for copies of the homepage saved more than 30 days before that date.
If there’s an older copy, the audit skips parked, for-sale and placeholder pages, loads the last real one, and compares its main words with today’s homepage. A domain registered again after holding a site about something quite different is a sign. If both the old and new titles carry the domain’s name, it’s treated as the same owner rebuilding their site.
The Wayback Machine is often slow and sometimes refuses busy callers, so the audit allows it 45 seconds and 3 tries. At the end of the study run, every site where it still hadn’t answered was tried again, one at a time, for up to 60 minutes. Section 10 explains how many sites that left unchecked.
How the run was organised
- Three sites at a time. Each site ran in its own process with a memory limit of 768 MB and a time limit of 20 minutes. If a site went over either, only that site would stop and be recorded as an error. In the final run one ordinary site hit the time limit, and it’s counted among the nine that couldn’t be checked.
- Every result saved as it finished. Each site’s result was written to the results file the moment it finished, so a stopped run could carry on without repeating work.
- The same script and settings as run 9. The study script, its settings and the list of sites were the same as in run 9. Only the audit had changed (section 6). Before the run started, the live audit files were checked against their expected fingerprints, so the run used exactly the code described in this report.
- Timing. The run started at 05:43 on 4 October 2026 (UK time). The last site finished at 12:39, and the expired-domain retries ran until 13:40. The ordinary sites took a median of 79 seconds each, and the slowest 1,021 seconds. The gambling sites took a median of 74 seconds.
- Polite crawling. Each site saw at most 5 requests at once from the audit, plus up to 4 pages in Chrome. Nothing was submitted, no forms were filled in, and no one signed in.
Why these settings
- Under 100 URLs. Large enough to include real small businesses with blogs and service pages, small enough that every URL could be loaded five times and a quarter or more of each site opened in a browser.
- 25 browser pages. The same as a signed-in audit, so the study measures what a customer gets. On 417 of the 662 sites that covered every HTML page.
- Three sites at a time. Fast enough to finish in one night, slow enough that no site saw more than a handful of requests at once, and that the server running the study wasn’t overloaded.
- Web Risk on the homepage only. The page checks every URL and linked domain. Across 17,896 URLs and the domains they link to, that would have meant tens of thousands of lookups, so the study asked about each homepage. None was listed.
- No paid data. The study used only what any visitor or search engine can see, so anyone can repeat it.
What was recorded
For each site, the results file holds: the number of URLs found and checked, how they were found, how many failed or returned bot checks, how many pages Chrome opened, the Web Risk answer, and every policy’s result with its evidence (up to 25 lines each, plus the full count). It also holds some details that aren’t part of the audit but describe the sites, such as the platform, security headers, tracking and consent, and email security records. Section 7 reports those.
No page content was kept, only these results. No site is named in this report.
5. How the study got here: eleven runs
An audit like this is only as good as its rules, and you can’t write good rules from Google’s descriptions alone. “Hiding text” describes a spammer’s trick, but it also describes every drop-down menu on the web. So we ran the audit on real sites, read every sign it raised, and asked of each one: is this the practice Google describes, or an ordinary feature that looks like it? Where it was an ordinary feature, we changed the rule, added a test site that copies the innocent pattern, and checked that the real problems were still found.
This section lists every run, so readers can see how far the figures moved and why.
| Run | Date | Sites | Ordinary sites with signs | What it led to |
|---|---|---|---|---|
| 1 | 26–27 Sep | 250 | 85.6% | Most signs wrong; rules rewritten |
| 2 | 27 Sep | 250 (different sites) | 81.6% | Firewall pages recognised |
| 3 | 27 Sep | 500 | 25.4% | Templates, menus and social links left out |
| 4 | 27 Sep | 487 | 12.0%, then 4.1% | The ordinary group fixed; first figures published |
| 5 | 28 Sep | 4 | (stopped) | Gambling group added to the study |
| 6 | 28–29 Sep | 687 | about 5% | Chrome added to the audit |
| 7 | 30 Sep | 674 | about 25% | 19 rule changes |
| 8 | 30 Sep | 472 | 7.2% | 9 more rule changes |
| 9 | 30 Sep – 1 Oct | 668 | 5.1% | Figures published on 1 October; one miss and two weak spots found |
| 10 | 3–4 Oct | 325 (stopped) | (not used) | Stopped when the last fixes went live |
| 11 | 4 Oct | 662 | 4.8% | The figures in this report |
Runs 1 to 4: from 85.6% to 4.1%
The first full run, on 250 sites, flagged 85.6% of them. Reading the evidence showed why. Shop templates, where every product page shares most of its text, were flagged as mass-produced content. Cookie notices and pop-ups that start hidden were flagged as hidden text. Links to Facebook and Instagram were flagged as unmarked links. Firewalls that block anything calling itself Googlebot were flagged as cloaking. Gambling sites that mention gambling were flagged as hacked.
The second run, on 250 different sites, added recognition of firewall and bot-check pages and still flagged 81.6%. The third, on 500 sites with version 12 of the rules, flagged 25.4%. By then the rules left out shop and account pages, listing pages, menus, tabs and accordions, social links and a site’s own subject.
The fourth run fixed the ordinary group: 487 sites checked in full with version 13 of the rules, 12.0% with signs. Version 14 tightened the rules again, and was applied to the evidence that run had saved, giving 20 sites with signs (4.1%). Those were the figures we first published on 28 September. We said at the time that they came from rules applied to saved evidence rather than a new crawl. This report replaces them.
Runs 5 and 6: gambling sites added, and the move to a browser
Run 5 was stopped after 4 sites when we decided to add the gambling group. Run 6 checked the 487 ordinary sites again, plus 200 gambling sites, with the HTML-only audit. About 5% of ordinary sites showed signs.
Run 6 also showed the limits of reading HTML alone. The audit couldn’t see redirects made by scripts, links hidden by stylesheets, or anything on pages built by JavaScript. In the fourth run, 41 of the 122 sites with a single URL had turned out to be built with Next.js, a JavaScript framework. So over 29 September we added Chrome in three stages: first to open pages and record what it saw, then to compare the browser’s views for cloaking, redirects, hidden text and malicious behaviour, and finally to fill in checks that don’t need a browser, such as structured data and scam claims.
A first run of the finished audit on 84 real sites showed ten rules were too loose. For example, long descriptive image captions were flagged as stuffed alt text, hidden tracking iframes as hacks, and fade-in animations as hidden links. Each was changed.
Run 7: the browser finds more, and more false alarms
Run 7 was the first full study with the finished audit and Chrome, on 674 sites. Ordinary sites with signs jumped from about 5% to about 25%. That was expected: the browser sees far more than HTML. But reading every sign showed that most of the new ones were wrong. Some examples:
- a body class called “category-advertising” turned every link on a page into an “advert link”;
- a restaurant’s “book now for” was read as an auto-generated keyword page;
- a band’s newsletter page sent every visitor to its record label’s sign-up form, which was flagged as a sneaky redirect, though everyone went to the same place;
- a privacy page saying “complete a survey” was flagged as a content locker;
- phone layouts and app sign-in screens were flagged as mobile cloaking;
- a news slider headline that mentioned a pill was flagged as hidden spam;
- donation links such as “Buy me a coffee” were flagged as sold links.
We made 19 rule changes, each with a test site copying the innocent pattern. By run 7 the audit had found four hacked sites, which we confirmed ourselves by requesting their pages as Googlebot and as a visitor. Each change was checked against them: all four had to stay flagged.
Run 8: the last false alarms
Run 8 checked the ordinary sites again with the 19 changes. 34 of 472 (7.2%) showed signs. Reading every one found 9 more patterns that weren’t spam:
- two sites whose computer copy came back empty while phones got the full page, which looked like “0% the same” mobile cloaking;
- a restaurant’s branch pages, which listed the head office postcode first on every page, so the branch-page exception missed them;
- a second restaurant whose branch pages each listed every branch’s postcode;
- a chat site’s help articles, which all pointed to its contact page and looked like doorway funnels;
- a betting site’s own promotions in a zero-size tab, flagged as hidden spam on a site whose subject is betting;
- a second betting site whose homepage HTML was empty, so its subject couldn’t be read;
- a racing guide titled “Free Tools”, flagged as a tool page with no tool;
- pages whose videos or products change on every load, flagged as cloaking.
The ninth pattern was a question rather than a fix. Sponsor and advert links without rel="sponsored" were still flagged, and we kept them as signs: Google’s policy asks for paid links, sponsorship included, to be marked. We fixed the other eight, added a test site for each, and checked them against the real pages on the live server. All eight sites were clean when checked again. One of them, an IT firm whose pages change on every load, was flagged again in run 9 on two pages the fix didn’t cover. It wasn’t flagged in run 11.
Run 9: the figures we published on 1 October
By then the ordinary sites’ figures had been measured with two versions of the rules on different days. For a study we were going to publish, that wasn’t good enough. So we ran everything once more: all 472 ordinary sites and all 199 gambling sites, on the final rules, in one run. We reviewed every sign it raised against its evidence and published the result on 1 October, false alarms and one miss included. We didn’t change any rule after seeing the results.
Runs 10 and 11: fixing what run 9 showed
Publishing run 9 was not the end of it. Its review had named one miss (a hacked estate agent caught under cloaking but not under hacked content) and listed the false alarms we took out. Using the audit on real sites afterwards showed three more weak spots: a page that explains spam policies was flagged as hacked for naming spam phrases, websites built entirely by JavaScript were checked as a single empty page, and a site’s own broken links could stop the audit giving a result at all. Section 6 sets out each of the seven changes, why we made it, and the proof.
Run 10 started on the night of 3 to 4 October, while those changes were still being made. We stopped it after 325 ordinary sites, when the last changes went live, because a run that used two versions of the audit couldn’t give one set of figures. Its results aren’t used anywhere in this report.
Run 11 checked the same 472 ordinary sites and the same 199 gambling sites as run 9, in the same order, with the current audit, in one run on 4 October. Every figure in this report comes from that run’s results file. We reviewed every sign it raised against its evidence and report the result, false alarms included, in section 10. We didn’t change any rule after seeing the results.
Keeping the rules honest
Every rule is written down in a rules record, and a check compares that record with the code. At run 9 it covered 361 named patterns, constants and thresholds. If any of them changes, the check fails until the record is updated.
Fixes also come with test sites. The test suite has over 100 sites. Some copy spam patterns, which must be flagged. Others copy innocent patterns from real sites, such as branch pages, help centres, rotating products, ticker slides, cookie notices and empty computer copies, which must not be flagged. The suite ran with and without a browser before every change up to run 9. The changes made since were each tested on stand-in sites before going live, old audit against new, including sites that must not change, and then on the real sites that showed the problem (section 6).
6. What changed since run 9, and the proof
When we published the run 9 figures on 1 October, we listed the false alarms we had taken out and one thing the audit had missed. We said each one pointed to a rule that could be improved. This section reports what we did about them, and about three more weak spots we found by using the audit on real sites in the days after.
There were seven changes. For each one we give the problem, why it mattered, what the rule now does, and the proof: what the audit reported before the change and after it, on the same pages. No site is named. Where a change was tested on a site outside the study, we say so.
Every change follows the same principle as the rest of the audit: it has to work for any site, not just the one that showed the problem. None of them is tuned to a particular site, and each was checked against sites that must not change.
6.1 Hacked pages in another language
The problem. Run 9’s biggest gap. A hacked estate agent sent Googlebot a Turkish betting page on 41 of its URLs, while visitors and the owner saw the normal site. The audit flagged it under cloaking, because Googlebot’s copy was almost entirely different, but not under hacked content. The hacked-content check looked for listed spam words, and the betting brand on the page wasn’t one of them. We reported it as a miss: hacked content should have read 4 ordinary sites, not 3.
Why it mattered. A word list can never keep up with hackers. New betting and pill brands appear every week, in many languages. What doesn’t change is the shape of the hack: a page in one language for visitors and a page in another language for Googlebot. Google itself notes that hackers use cloaking so that site owners don’t see what they’ve done.
What the rule does now. When Googlebot is sent a page with a different title and under 30% of the visitor’s text, the audit works out the language of each copy. A page is in Chinese, Japanese or Korean, Cyrillic, Thai, Arabic, Hebrew or Greek script when more than 30% of its letters are in that script. Otherwise the audit counts the common words of 11 languages (English, Turkish, Indonesian, German, French, Spanish, Italian, Dutch, Portuguese, Vietnamese and Polish). A language wins when its common words make up at least 6% of the page’s words and at least one and a half times as many as the runner-up. A page needs 200 or more letters and 40 or more words to be judged at all. If the two copies are in different languages, it’s a sign under hacked content as well as cloaking, whatever words the page uses.
The proof.
| Run 9 (old rule) | Run 11 (new rule) | |
|---|---|---|
| Cloaking | Sign, 41 pages | Sign, 43 pages |
| Hacked content | No sign (missed) | Sign, 43 pages: “Googlebot is sent a page in Turkish that visitors don’t see (visitors get a page in English)” |
The rule can only add a sign to a page that is already almost entirely different for Googlebot, so it can’t create a false alarm on an ordinary page. Across all 463 ordinary sites in run 11, hacked content was flagged on 3, and all three are confirmed hacks. No site was flagged under hacked content because of a language difference that turned out to be innocent. The miss we reported in run 9 is fixed.
6.2 Pages that explain spam
The problem. A page that explains Google’s spam policies, or lists the phrases a spam checker looks for, contains those phrases. The hacked-content check saw “payday loans” on such a page, off the site’s own subject, and flagged it as injected spam. The page was our own: the page you’re reading this study on.
Why it mattered. Security firms, SEO agencies, web hosts and anyone who writes about spam would all be told they’d been hacked, for describing the thing they protect against. A false alarm like that on a security page does real harm: it’s the kind of claim a customer would pass on.
What the rule does now. A page is treated as being about spam when it uses the word “spam” 3 or more times and names spam phrases from 3 or more different subjects (pills, gambling, payday loans, essays, replica goods, adult content and escorts). Injected spam sells one thing and never calls itself spam; a page about spam does both. On such a page, spam phrases aren’t counted as hacked content. Nothing else changes: the page is still checked for cloaking, hidden links, redirects and every other policy.
The proof. On the page that showed the problem, tested before the change went live, hacked content went from a sign (“payday loans”) to no signs. In run 11, the three confirmed hacked sites were all still flagged under hacked content, so the exception didn’t hide a real hack.
6.3 The same rating on many pages
The problem. The structured data check looked for one kind of fake rating: a rating in a page’s markup when the page shows no reviews. It didn’t look for the other common kind: the same rating, with the same number of reviews, copied onto every product or service a site sells.
Why it mattered. Real ratings for different products are almost never identical. A site whose markup claims “4.60 from 157 reviews” for a cheap loan, a fast loan and a bad-credit loan didn’t collect those reviews. Since April 2025, fake consumer reviews have also been banned outright in the UK under the Digital Markets, Competition and Consumers Act 2024, so this matters to site owners beyond Google.
What the rule does now. A sign when the same rating value and review count appear in the markup of 5 or more pages about 3 or more different things. Only ratings of a single item count: a product, an app, a book, a course, a recipe, an event and similar. A business showing its own rating on every page isn’t counted, because one business really can have one rating. Colour and size words are ignored, so a red and a blue version of one shirt count as one thing.
The proof. The loan comparison site was flagged in run 9 for ratings its pages don’t show, with 2 lines of evidence. In run 11 it has 10, including its markup claiming the same rating, 4.60 from 157 reviews, on 8 pages about different loans. On the other sites flagged for structured data in run 11, the signs came from the older rule.
6.4 Tool pages that link to the tool
The problem. The misleading functionality check flags a page that offers a free tool but has nothing to use. Some pages offer a tool and then send visitors to it: a landing page with a “Try it free” or “Run the check” button that opens the tool on another page of the same site.
What the rule does now. A tool page isn’t counted when its main content (not its menu, header or footer) links to another page on the same site with words such as try, use, run, open, start, launch, check, test, scan or analyse. A page that offers a tool and links only from its menu is still flagged, because a visitor reading the page has nothing to use.
The proof. No site in run 11 was flagged for misleading functionality, as in run 9, so the change removed no real sign. It matters most for tool and software sites, which the study sample has few of.
6.5 Sites built entirely by JavaScript
The problem. Some websites send an almost empty page and build everything in the browser. Their HTML has no text and no links. The audit used to find a site’s URLs from its sitemap or from the links in its HTML, so a site with no sitemap and an empty homepage was checked as one empty page. Worse, on some of these sites every link sits inside web components, parts of a page whose content a browser keeps separate, and the copy of the page that Chrome hands back doesn’t include them at all.
Why it mattered. An audit that checks one empty page and reports “no signs” is giving a clean bill of health it hasn’t earned. JavaScript sites are common, and growing more so.
What the rule does now. Two parts. First, when a site has no sitemap and its homepage HTML has under 150 words and fewer than 3 links to the site, the audit opens the homepage once in Chrome and follows the links it finds there. Second, Chrome now collects every link on the built page, including links inside web components (up to 2,000, within 3 seconds), not just the links in its HTML. The report says how many more URLs were found this way. Third, also new since run 9: when the first pages opened in Chrome show that the site is built by JavaScript, every other page is opened in Chrome too, within 20 minutes, and each page’s text is checked as the browser shows it, not from its near-empty HTML (section 4, step 4). Before, only the 25 chosen pages were opened, and the text checks always read the HTML.
The proof. We tested it on a large, well-known site built entirely with web components, outside the study:
| Before | After | |
|---|---|---|
| Links in the homepage HTML | 0 | 0 |
| Links in Chrome’s copy of the page | 0 | 0 |
| Links found on the built page, inside web components | not read | 52 |
| URLs found | 1 | 1,153 |
| URLs tried (100 limit) | 1 | 100 |
| Pages opened in Chrome | 1 | 25 |
| Result | 0 signs, from one empty page | 0 signs, from 36 pages, the same on a second run |
Before going live, the change was tested end to end on stand-in sites with a real copy of Chrome: a site built like the one above went from 1 page checked to 6, a site with 12 more JavaScript pages behind it went from 1 to 13 with no false alarms, and an ordinary site and a site with a sitemap were checked exactly as before, page for page and browser load for browser load.
On the study sites the effect is smaller, because almost every one has a sitemap or ordinary links. Chrome opened 10,348 pages in run 11, against 9,447 in run 9, and opened every HTML page on 417 sites, against 381.
6.6 A site’s own broken links no longer spoil the result
The problem. The audit says “Not an accurate reading” when more than 10% of the URLs it tried couldn’t be loaded, rather than show a clean result it can’t stand behind. It counted every failure the same way. But a page that doesn’t exist (HTTP 404 or 410), or a link that sends every visitor to another website, hides nothing: there’s no content there to check.
Why it mattered. A site with many broken links, which is common, could never get a result, however clean its real pages were. The warning is there for pages the audit couldn’t read, not for pages that aren’t there.
What the rule does now. The warning counts only URLs that may have content the audit couldn’t read: timeouts, “too many requests” (HTTP 429), firewall refusals (403), server errors (5xx) and network failures. Pages that don’t exist and off-site redirects are still listed in full under “URLs not checked”, so the owner can see and fix them. They just don’t count towards the warning.
The proof. On the large site from 6.5, 61 of the 97 URLs the audit tried failed. Every one we checked by hand was a link that redirects to a missing page (HTTP 404) or a link that sends visitors to another website. Before the change the report said “Not an accurate reading: 61 of 97 URLs could not be loaded” and gave no result. After it, the report gave its result (0 signs) with no warning, which means at most 9 of the 61 could have been other kinds of failure, and it still listed all 61. On stand-in sites, old rule against new:
| What 10 of the URLs returned | Before | After |
|---|---|---|
| 5 × 404, 3 × 410, 2 redirects to another site | Warning: 10 of 15 | No warning; all 10 listed |
| 4 × 429, 3 × 503, 3 × 403 | Warning: 10 of 15 | Warning: 10 of 15 (unchanged) |
| 8 × 404, 2 × 500 | Warning: 10 of 15 | Warning: 2 of 15 (the server errors) |
| None (a normal site) | No warning | No warning |
The study’s figures aren’t affected: in run 11, no site had an inaccurate reading under either rule.
6.7 Sites that say “too many requests”
The problem. Some sites, or the firewalls in front of them, answer “too many requests” (HTTP 429) when pages are asked for quickly. In run 9 the audit tried such a page once more after 3 seconds, and if it was still refused, recorded it as not loaded. On a site that limits visitors firmly, that could leave many pages unchecked.
What the rule does now. After the first “too many requests” from a site, the audit slows down for the rest of that site: one request at a time, a second apart (two seconds after further refusals). It waits as long as the site asks, using the site’s own Retry-After header, up to a minute, or 5, 10, 20 and 40 seconds if the site doesn’t say, and tries each refused page up to 4 times. The waiting stops once it adds up to 10 minutes for the site, so a site that never lets up can’t hold the audit for ever. Pages it still refuses are listed as not loaded, and if they’re more than 10% of the site, the report says how many the site turned away and that the reading isn’t accurate. A page that’s briefly unavailable (HTTP 503) still gets one more try after 3 seconds.
The proof. The results file keeps up to 10 failed URLs per site. Among those, one ordinary site still refused pages with “too many requests” after the slow-down, and its other pages were checked. No site in run 11 had an inaccurate reading, so the study’s figures weren’t affected either way. The change matters most for larger sites behind strict firewalls, which this study of small sites has few of.
6.8 What didn’t change
Every other rule is as it was in run 9, and so is the study itself: the same 472 ordinary sites and 199 gambling sites, in the same order, the same five loads of every URL, the same 25 browser pages per site, the same review of every sign. That’s what makes run 9 and run 11 comparable.
| Run 9 (1 Oct) | Run 11 (4 Oct) | |
|---|---|---|
| Ordinary sites checked | 469 | 463 |
| Ordinary sites with signs | 24 (5.1%) | 22 (4.8%) |
| Gambling sites with signs | 187 of 199 (94.0%) | 190 of 199 (95.5%) |
| All sites with signs | 211 of 668 (31.6%) | 212 of 662 (32.0%) |
| Hacked sites found | 4 (one missed under hacked content) | 3 (none missed) |
| Expired domain abuse checked (ordinary) | 369 of 469 | 430 of 463 |
| Expired domain abuse checked (gambling) | 54 of 199 | 177 of 199 |
| False alarms taken out in review | 34 | 35 |
The figures moved a little, for real reasons. Sites change between runs: one hacked site from run 9, a holiday attraction, was checked in full in run 11 and showed no signs, so the hack had gone, and a car key firm was still flagged for doorway pages but no longer for scaled content. Six fewer ordinary sites could be checked, because they had grown past 99 URLs or wouldn’t load on the day. And the Wayback Machine answered far more often, so three gambling domains could be checked for expired domain abuse and turned out to be old domains of other organisations (section 9).
6.9 After run 11: checks that couldn’t be made
The problem. Expired domain abuse depends on the Wayback Machine, which holds old copies of websites. When it was busy or refused requests, the check couldn’t be made. The report listed it as not checked, but the score could still read 0, and a reader could take that as a clean result. In run 11, expired domain abuse couldn’t be checked on 33 of 463 ordinary sites and 22 of 199 gambling sites.
What the report does now. These changes were made on 4 October, after run 11, and are live in the audit on this page:
- When the Wayback Machine doesn’t answer, the audit asks it once more after the other checks are done.
- When it is limiting requests (“too many requests”), the audit waits as long as it asks, up to 15 seconds, asks once more, and then stops asking rather than keep the limit on.
- A definite answer from the Wayback Machine about a domain is kept for 24 hours, so the same question isn’t asked again and again.
- A check that still couldn’t be made is labelled “Couldn’t be checked this time”, named under the score, and never shown as clean. A free “Re-check” button runs that one check again.
- Policy circumvention, listed as not checkable in run 11, is now reported as information from what the cloaking, hidden text, sneaky redirect and expired domain checks find. It isn’t counted in the score.
- Machine-generated traffic, legal removals and personal information removals, which depend only on Google’s own records, are marked “Can’t be checked”, each with a link to where it can be checked.
The proof. Sites from the study, re-run with the live audit after these changes, showed the same signs as in run 11. On a site whose expired domain check couldn’t be made in run 11, the second try got an answer, and it showed signs. On a site where the Wayback Machine was refusing requests, the report said so and showed no clean result; once the limit lifted, the re-check returned the same signs as run 11.
The study’s figures aren’t affected: they come from run 11, nothing that is counted has changed, and policy circumvention isn’t counted.
6.10 After run 11: text written by a site’s visitors
The problem. In run 11 a football rumours site was flagged for keyword stuffing because one member’s forum post listed 71 players by surname. We took it out by hand as a false alarm (section 10), but the audit itself would still have flagged it. Text that visitors post isn’t the site’s own keyword stuffing: Google covers spam posted by users under its user-generated spam policy, which the audit checks separately.
What the audit does now. This change was made on 4 October, after run 11, and is live in the audit on this page. When it looks for keyword stuffing, the audit leaves out comments, forum posts and signatures, and the text of a post signed with a link to a member’s page. An article’s own author line is the site’s writer, so a site’s own articles are still checked.
The proof. On a test site, a forum post listing footballers was flagged before the change and not after. A place list on a business page, and one in an article signed by its writer, were still flagged; the same list in a blog comment was not. Re-run with the live audit, the football rumours site showed no signs.
The study’s figures aren’t affected: the football site’s sign had already been taken out by hand, and the other keyword stuffing signs in run 11 come from the sites’ own pages.
7. Results
Sites with signs
| Group | Sites | With signs | Share | 95% confidence range |
|---|---|---|---|---|
| Ordinary sites | 463 | 22 | 4.8% | 3.2% to 7.1% |
| Gambling sites | 199 | 190 | 95.5% | 91.6% to 97.6% |
| All sites | 662 | 212 | 32.0% | 28.6% to 35.7% |
The confidence range is how far the true share among all similar sites could reasonably be from what we measured, given the sample size (a Wilson 95% interval). For ordinary sites, the share of small sites with signs is very likely between 3.2% and 7.1%: somewhere between about 1 in 31 and 1 in 14, with 1 in 21 the best estimate.
The “all sites” figure depends on how many gambling sites are in the sample, and we chose that number. It describes this sample, not the whole web. For the web as a whole, the ordinary-site figure is the one to use, along with the finding from our fourth run that 22.1% of the small domains we tried were gambling sites.
How many policies per site
| Policies with signs | Ordinary sites | Gambling sites | All sites |
|---|---|---|---|
| None | 441 (95.2%) | 9 (4.5%) | 450 (68.0%) |
| One | 17 (3.7%) | 110 (55.3%) | 127 (19.2%) |
| Two | 3 (0.6%) | 78 (39.2%) | 81 (12.2%) |
| Three | 1 (0.2%) | 2 (1.0%) | 3 (0.5%) |
| Four | 1 (0.2%) | 0 | 1 (0.2%) |
Most ordinary sites with signs had one problem. The five with two or more were the three hacked sites (between them: cloaking, hacked content, sneaky redirects and link spam), a site selling driving licences (keyword stuffing, expired domain and scam) and a product review site (link spam and thin affiliation).
Among gambling sites, the usual pair was link spam with hidden text: casino link text both linked and hidden on the page.
Policies with no signs
Five policies had no signs on any site: scaled content abuse, user-generated spam, site reputation abuse, scraping and misleading functionality. That doesn’t mean these practices don’t exist. It means the sites we checked didn’t show the patterns the audit looks for. Small sites rarely have open comment sections or forums, rarely host other companies’ coupon or casino sections, and rarely offer tools, and only one site in run 9 had near-copies on the scale scaled content abuse needs. Section 8 explains each.
Google Web Risk
Not one of the 662 homepages was on Google Web Risk’s list of unsafe sites, including the three hacked sites. Web Risk lists sites that spread malware or phishing. Sites that only show spam to Googlebot are usually not on it, which is one reason those hacks go unnoticed.
Expired domain abuse: what was checked
| Result | Ordinary sites | Gambling sites |
|---|---|---|
| No copy on the Wayback Machine from before the current registration | 397 | 173 |
| Public-body domain (allocated by its registry) | 15 | 0 |
| Only parked or placeholder pages before | 6 | 1 |
| Same owner rebuilt the site | 3 | 0 |
| Same subject before and after | 3 | 0 |
| Registered 10 or more years ago | 2 | 0 |
| Signs found | 4 | 3 |
| Not checked: the Wayback Machine didn’t answer | 10 | 19 |
| Not checked: old copies couldn’t be loaded | 23 | 3 |
The registration records also show how differently the two groups were built. More than half the ordinary sites whose registration date could be read (239 of 448) were registered before 2010, and the median falls in 2008. Every one of the 199 gambling domains was registered in 2024 or later, and 172 of them in July 2026.
Every ordinary site with signs
The 22 ordinary sites with signs, described by what they are rather than named. “Evidence” is the number of lines of evidence the audit recorded for each policy, usually one per URL or per link.
| Site | URLs checked | Policies with signs (evidence) |
|---|---|---|
| County agricultural show (hacked) | 39 | Cloaking (20), sneaky redirects (8), hacked content (8), link spam (30) |
| Estate agent (hacked) | 46 | Cloaking (43), hacked content (43) |
| Site selling driving licences | 41 | Keyword stuffing (2), expired domain (3), scam and fraud (40) |
| Motorbike and fashion clothing shop (hacked) | 10 | Cloaking (8), hacked content (1) |
| Product review site | 9 | Link spam (77), thin affiliation (8) |
| Motor rally club | 27 | Link spam (172) |
| Fashion news site | 10 | Link spam (42) |
| Polish community classifieds | 64 | Link spam (9) |
| Plant and transport hire firm | 40 | Keyword stuffing (4) |
| Essay-writing service | 43 | Keyword stuffing (1) |
| Business credit report site | 61 | Keyword stuffing (1) |
| Film scenery maker | 26 | Keyword stuffing (1) |
| Car key repair firm | 74 | Doorway (2) |
| Web hosting firm | 89 | Doorway (2) |
| Loan comparison site | 83 | Spammy structured data (10) |
| Web and PDF form designer | 55 | Spammy structured data (33) |
| Classic literature site | 38 | Malicious practices (38) |
| Cycling deals site | 7 | Thin affiliation (2) |
| Small site with a shop page | 23 | Thin affiliation (1) |
| AI tools guide (old volunteering charity domain) | 14 | Expired domain (3) |
| IT and telecoms firm (old file-sharing domain) | 1 | Expired domain (3) |
| Bare page (old film news domain) | 11 | Expired domain (3) |
All three hacked sites run WordPress, as do 115 of the 463 ordinary sites. WordPress isn’t less safe than other platforms, but it’s the most common target, and out-of-date plugins and themes are the usual way in.
Which ordinary sites had signs
The numbers are small, so these splits show tendencies, not firm rates. Still, three stand out.
- Bigger sites showed signs more often. 1 of the 114 single-URL sites (0.9%) had signs, against 2 of 68 sites with 2 to 9 URLs (2.9%), 13 of 193 with 10 to 49 (6.7%), and 6 of 88 with 50 to 99 (6.8%). More pages mean more places for a problem, and more pages built from templates, plugins and affiliate feeds.
- WordPress sites showed signs more often. 12 of 115 WordPress sites (10.4%) had signs, against 10 of the other 348 (2.9%). All three hacked sites run WordPress. Part of this is size: the WordPress sites had a median of 35 URLs, against 13 for the rest. Plugins can also add links, ratings and markup that an owner never looks at.
- Age made little difference. Sites registered before 2005 showed signs at 3.6%, 2005 to 2014 at 4.4%, 2015 to 2022 at 7.6%, and 2023 or later at 4.8% (2 of 42). Old sites aren’t safer, and new ones aren’t worse.
Sites with a sitemap (5.9%) showed signs a little more often than sites without one (3.2%), mostly because sites with sitemaps are bigger.
How these figures compare with what we published before
This is the third set of figures we’ve published from this study, and the one to use.
- 28 September: 20 of 487 small sites (4.1%) showed signs. That figure came from reading HTML only, with rules applied to saved evidence rather than a new crawl. We said so at the time.
- 1 October (run 9): 24 of 469 (5.1%). The audit by then opened pages in Chrome, loaded every URL five ways and checked scam claims, structured data, misleading functionality and scraping, which found real problems the HTML-only audit couldn’t, such as self-opening windows, fake review ratings and a driving licence scam.
- 4 October (run 11): 22 of 463 (4.8%). The same sites, minus six that had grown or wouldn’t load, checked with the seven changes in section 6. All three figures sit inside each other’s confidence ranges: the share of small sites with signs has been about 1 in 20 every time we’ve measured it properly.
What changed most between the runs isn’t the total but how sure we are of it. Run 11 caught the hacked estate agent under every policy it breaks, checked expired domain abuse on 430 sites instead of 369, and needed only three ordinary-site signs taken out in review.
Other things we noticed
These aren’t part of Google’s spam policies, but the study recorded them for every site, and they say a lot about how small sites are run. They cover the 463 ordinary sites only.
- Platform: 115 sites (24.8%) run WordPress, 48 (10.4%) are built with Next.js, and smaller numbers use Drupal, Shopify, HubSpot, Magento, Joomla, Webflow and Hugo. On 258 sites (55.7%) the platform couldn’t be identified from the page.
- HTTPS: 462 of 463 sites use it.
- Security headers: 237 sites (51.2%) send none of HSTS, Content Security Policy or X-Frame-Options on the homepage. 180 (38.9%) send HSTS and 117 (25.3%) a Content Security Policy.
- Tracking before consent: 278 sites load a tracker, such as Google Analytics or the Meta Pixel, on the homepage. 166 of them (59.7%) do it with no cookie banner, consent tool or Google consent mode that we could detect. 64 set Google consent mode, and 48 show a banner or consent tool (we didn’t test whether it works).
- Old analytics code: 118 sites carry only Google’s old Universal Analytics code, which stopped collecting data in 2023 and 2024, and no Google Analytics 4. 90 sites use Google Analytics 4.
- Email security: 324 sites (70.0%) have no DMARC record or a DMARC policy of “none”, so anyone can send email that looks like it comes from their domain. 96 have a policy of “quarantine” and 43 “reject”.
- AI crawlers: 73 sites (15.8%) block at least one AI crawler in
robots.txt. 25 (5.4%) have anllms.txtfile. - Robots: 368 sites have a
robots.txt. 9 block Googlebot in it. - Structured data and descriptions: 224 sites (48.4%) use structured data. 175 (37.8%) have a meta description on every page checked.
- Who runs the site: 335 sites have a contact page, 303 a privacy page and 255 an about page. 217 show a postcode and 82 a company registration number.
- Marking links: 97 sites use
rel="nofollow"on at least one outbound link. Only 3 userel="sponsored", the marking Google prefers for paid links. - Broken links: 52 sites have at least one internal link to a page that returns “not found”.
- Networks: 38 sites (8.2%) are local job sites sharing one Google Analytics and Tag Manager account. In run 9 we also saw 30 local newspaper sites sharing one analytics account; in run 11 we found no other tracking ID shared by five or more sites. Sharing an owner isn’t a spam policy problem, but it shows how many small sites are run in groups.
The gambling sites were strikingly uniform. None loaded a tracker. All 199 had DMARC set to none or missing. 186 blocked AI crawlers. 194 named an author, but only 6 had a privacy page and none showed a postcode or company number.
8. Each policy: what Google says and what we found
This section takes each policy in the order Google lists them. For each one: Google’s own words, what the audit checks, what the study found, and any false alarms we saw. Examples are real, from the final run, with the sites’ names left out.
8.1 Cloaking
“Cloaking refers to the practice of presenting different content to users and search engines with the intent to manipulate search rankings and mislead users.”
What is checked. The copies served to a visitor, to Googlebot and to phones are compared on every URL, from the HTML and in a browser. A sign is either spam sent only to Googlebot (or only to phones), with a different title or 3 or more different spam words, or a page that is mostly different (under 50% the same with a different title, or under 30% the same whatever the title). Firewalls, bot checks, maintenance pages, empty copies, pages built by JavaScript, paywalls, search pages and pages that change on every load are never counted.
What we found. 3 ordinary sites (0.6%) and no gambling sites. All three were hacked. Googlebot was shown gambling pages that visitors never see:
- a motorbike and fashion clothing shop whose homepage, as Googlebot sees it, is titled “Goldenbahis .com Orjinal Adres – Goldenbahis 896 Login …”, a Turkish betting site, on 7 URLs;
- an estate agent whose 43 URLs showed Googlebot “BayWin Nedir? Güncel Erişim ve Sık Sorulanlar”, another Turkish betting page;
- a county agricultural show whose pages showed Googlebot “PT89 x Situs Investasi”, “ZONATUAN Situs Investasi”, “MANDIRIBET”, “KATANA899” and more, Indonesian gambling pages dressed up as investment sites, with different names on different pages, on 14 URLs.
In each case the visitor’s copy was the business’s normal page. This is the most damaging kind of hack for a small business. Google indexes the gambling page under the business’s name, the business’s own pages drop out of search, and the owner sees nothing wrong when they visit their site.
False alarms. Two ordinary sites were flagged for cloaking wrongly. We took them out of the figures. Section 10 gives the details: a club’s news page whose content changes between loads, and a cycling club whose server gave Googlebot the WordPress readme file. The two false alarms from run 9 that came from pages that change on every load and from a loading screen didn’t come back.
Cloaking also had the most pages the audit couldn’t compare. 89 URLs on 8 ordinary sites gave Googlebot a firewall or bot-check page. That’s how firewalls normally treat a request that claims to be Googlebot but doesn’t come from Google, and it isn’t counted.
8.2 Doorway abuse
“Doorway abuse is when sites or pages are created to rank for specific, similar search queries. They lead users to intermediate pages that aren’t as useful as the final destination.”
What is checked. Groups of 5 or more pages that are each at least 85% the same as one page, with titles identical except for one swapped word (usually a town or a product). Also “funnel” pages: 5 or more short pages that differ by one word and all point to the same contact, booking or quote page. Branch pages of a real business are not counted when most of them show their own postcode, opening hours, map or local details, or have pages of their own below them.
What we found. 2 ordinary sites (0.4%) and 1 gambling site.
- A car key repair firm had 29 pages titled “… car keys”, one for each car make, each at least 85% the same as the BMW page.
- A web hosting firm had 6 pages titled “domain name registration …” and 6 titled “website and email hosting …”, one for each region, each 85% or more the same as the others.
- On the gambling side, a home-selling site had 10 near-identical pages titled “… – your home”, for cities and property types. Section 9 explains why that site is also in the gambling group.
Location pages are common and often useful. What makes them doorway pages in Google’s terms is that they’re near-copies with the town swapped, created to rank for “[service] in [town]” searches. A page for each branch that really is different, with its own address, team, opening hours and reviews, is not a doorway.
False alarms. None in run 11 or run 9. Run 8 found three, all branch or help pages, and the rules were fixed (section 5).
8.3 Expired domain abuse
“Expired domain abuse is where an expired domain name is purchased and repurposed primarily to manipulate search rankings by hosting content that provides little to no value to users.”
What is checked. Whether the domain was registered again after holding a site about something quite different, using the public registration date and the Wayback Machine (section 4, step 6). When the old site belonged to a school, charity, club or similar body and the new one is about casinos, loans or similar, the report adds that this matches Google’s own example.
What we found. 4 of the 430 ordinary sites where it could be checked (0.9%), and 3 of the 177 gambling sites (1.7%). The ordinary sites:
- a domain that held an overseas volunteering charity’s site until 2015, registered again in June 2024, and now a guide to AI software;
- a domain that held a copy of a well-known file-sharing site in 2022, registered again in November 2022, and now an IT and telecoms firm’s site;
- a domain that held a film and entertainment news site until 2021, registered again in December 2022, and now showing a bare page under the domain name;
- a domain that held a driving licence site until 2022, registered again in September 2024, and now offering to sell UK driving licences.
The audit doesn’t judge whether the new content is low value, which Google’s definition also needs. It only records that the subject changed completely after a new registration. Three of the four ordinary sites may well be legitimate businesses that bought a free domain name. The fourth is not: it’s also flagged for scam and fraud (section 8.17).
The gambling sites:
- a domain that held a wedding directory until 2020, registered again in May 2026, and now a fast-withdrawal casino guide;
- a domain that held a parenting site until December 2025, registered again in April 2026, and now a “casinos not on GamStop” guide;
- a domain that held a London estate’s neighbourhood blog until 2023, registered again in June 2026, and now an “ice fishing” casino game page.
The gambling cases are exactly what Google’s policy describes: a domain with years of history, links and trust from its old life, bought and turned into a casino page. Run 9 couldn’t show this, because the Wayback Machine answered for only 54 of the 199 gambling sites.
In run 9 this was the policy with the largest gap: the check couldn’t be completed on 100 ordinary sites and 145 gambling sites. In run 11 the gap fell to 33 ordinary sites and 22 gambling sites. The overseas volunteering charity’s old domain, which we knew about from run 8 but run 9 couldn’t check, is now among the four ordinary sites. One domain flagged in run 9, an old table tennis association’s address now carrying an AI tools guide, wasn’t flagged in run 11. Because 55 sites still couldn’t be checked, these figures are a minimum.
8.4 Hacked content
“Hacked content is any content placed on a site without permission, due to vulnerabilities in a site’s security.”
What is checked. Spam phrases about pills, casinos, payday loans, replica goods and adult content, in 11 languages, that are off the site’s own subject. Also pages mostly in an unexpected script, hidden iframes from suspicious hosts, scripts from bare network addresses or spam-named hosts, auto-generated keyword pages, spam shown only to Googlebot, and, new since run 9, a page sent to Googlebot in a different language from the one visitors get (section 6.1).
What we found. 3 ordinary sites (0.6%): the clothing shop, the estate agent and the county show from section 8.1, all three of the hacked sites the audit found. On the clothing shop and the county show, the check recorded “spam shown only to Googlebot, not to visitors, a common sign of a hacked site”. On the estate agent, it recorded on all 43 pages that “Googlebot is sent a page in Turkish that visitors don’t see (visitors get a page in English)”.
In run 9 the estate agent was missed here: its Googlebot pages carry the betting brand “BayWin”, which isn’t one of the gambling words the audit lists, so it was caught only under cloaking. We reported that as a miss. The language rule added since (section 6.1) catches it whatever brand the hackers use. Hacked content now reads every hacked site the audit found.
What isn’t counted. A single mention of a spam phrase, which is usually an ordinary sentence (a support charity writing about pornography, a hosting firm listing the .porn domain ending). Spam words that are the site’s own subject: a pharmacy mentioning sildenafil, a bookmaker mentioning free spins. Pages in Japanese, Chinese or Korean on sites that publish in those languages. Hidden tracking, consent and widget iframes.
False alarms. 32 gambling sites were flagged under hacked content, nearly all because they carried casino articles on blogs about other subjects. Those articles were placed by the sites’ own owners, so they aren’t hacks. We took all 32 out (section 10). Every one of those sites still has other signs, so the gambling total isn’t affected.
8.5 Hidden text and link abuse
“Hidden text or link abuse is the practice of placing content on a page in a way solely to manipulate search engines and not to be easily viewable by human visitors.”
What is checked. Links and text hidden from visitors with a spam phrase or commonly sold link text, by inline styles, by stylesheets (as the browser shows the page), by being pushed off-screen, cut off outside a box, given a tiny font, coloured like the background, covered by an image, or placed inside <noscript> or HTML comments. Menus, tabs, sliders, tickers, cookie notices and screen-reader text are left out.
What we found. No ordinary sites. 78 gambling sites (39.2%). On 77 of them, the hidden text was casino link text such as “non gamstop casinos”, “non uk casino” or “casino not on gamstop”, cut off outside the box it sits in, so the browser draws nothing. The 78th hid casino links in its page. Across the 78 sites the audit counted 4,832 hidden links and phrases. Of the 1,097 lines of evidence we kept, 1,072 were phrases cut off outside their box and 25 were hidden links. One home-selling site carried 732 hidden links and phrases.
The fact that no ordinary site showed hidden spam matters. Earlier versions of the rules flagged menus, cookie notices, sliders and fade-in animations as hidden content (section 5). Leaving those out while still catching every gambling site that hides its link text is what the rules are for.
8.6 Keyword stuffing
“Keyword stuffing refers to the practice of filling a web page with keywords or numbers in an attempt to manipulate rankings in Google Search results.”
What is checked. Google’s three examples: long lists of phone numbers, blocks of text listing towns and regions, and the same phrase repeated unnaturally. Also titles and image alt text that repeat one word. Navigation, menus, link text, product cards and repeated labels are removed before checking.
What we found. 5 ordinary sites (1.1%) and 2 gambling sites (1.0%).
- A plant and transport hire firm had blocks of 25 to 28 place names on its service pages, such as “Hilton, Mickleover, Littleover, Sinfin, Etwall, Alvaston …”.
- The driving licence site repeated “driving lessons [town]” 26 to 28 times a page.
- An essay-writing service repeated “nursing personal statement” 22 times on one page.
- A business credit report site repeated “trade credit insurance” 22 times on one page.
- A film scenery maker’s page title repeated “hire” 6 times: “Scenery Hire – Film Prop Hire – Rock Hire – Statue Hire – Column Hire – Scenery Hire”.
- On the gambling side, an Indonesian-language slots blog repeated “bermain slot online” 20 times on a page, and a casino news blog repeated “live dealer games” 23 times.
What isn’t counted. Lists where at least half the names are countries (where a service is available), where at least 30% are people’s names (who’s named), or where 90% are in A–Z order (a directory). A phrase repeated in captions or credits doesn’t count unless it’s the page’s own keyword, in its address or title. A newspaper’s own town name in its titles doesn’t count. Long, descriptive image captions don’t count.
False alarm. One ordinary site, a football rumours site, was flagged for a block of 71 names. They were players’ surnames, which is what a football site lists. The rule that leaves out lists of people looks for common first names, and a squad list has none. We took it out (section 10). The audit has since been changed so that posts by a site’s visitors aren’t read as its own text (section 6.10).
The place-name lists are the most common kind on small business sites. They’re usually written to tell visitors “we cover your area”, but a block of 25 town names is exactly Google’s second example. A map, or a short sentence naming the main areas, does the same job without the risk.
8.7 Link spam
“Link spam is the practice of creating links to or from a site primarily for the purpose of manipulating search rankings.”
Google’s link guidance adds: “Mark links that are advertisements or paid placements (commonly called paid links) with the sponsored value.”
What is checked. Links to other websites, without rel="sponsored" or rel="nofollow", that have commonly sold link text, that go to affiliate networks (3 or more), or that sit in advert or sponsor boxes. Also link exchange pages, required links back, sponsored posts with followed links, the same keyword link on every page, and links to many free-hosting sites.
What we found. 5 ordinary sites (1.1%) and 186 gambling sites (93.5%).
On ordinary sites, every case was a missing marking rather than a sold link:
- a motor rally club’s homepage carried its sponsors’ advert links (172 lines of evidence across its pages);
- the county show’s homepage carried its sponsors’ advert links too (30 lines), from local vets, ferries, butchers and engineers;
- a Polish community classifieds site carried advert links to partner sites (9 lines);
- a fashion news site linked to shops through the Awin network with “Buy now” buttons, 42 times;
- a product review site linked to Amazon, 77 times.
Two sites flagged in run 9, a scuba diving club and a cycling deals site, weren’t flagged for link spam in run 11; the cycling deals site is still flagged for thin affiliation.
What isn’t counted. One or two unmarked affiliate links on a site are listed with advice but aren’t a sign: a single book or archive link isn’t a pattern. Links to government, NHS, university, police and school sites aren’t counted. Single everyday words such as “loan” or “casino” aren’t sold link text, so a council’s home improvement loan or a film called Casino Royale doesn’t count. Donation buttons such as “Buy me a coffee” aren’t sold links.
None of these sites is doing anything Google would object to, apart from not marking the links. Google’s policy is clear that paid links, sponsorship and affiliate links included, should carry rel="sponsored". Adding it is a five-minute job, and it removes the sign.
The gambling sites are a different matter. Their links have text such as “casinos not on gamstop” (405 times in the evidence), “non gamstop casinos” (373) and “online casinos” (172), and they point to other websites. That’s the pattern Google describes as buying and selling links to pass ranking. It isn’t the subject that makes these links a sign: a gambling site may link to casinos. It’s that the links carry commonly sold link text, point to unrelated websites, and aren’t marked as paid. Section 9 looks at it in detail.
8.8 Machine-generated traffic
“Machine-generated traffic (also called automated traffic) refers to the practice of sending automated queries to Google.”
This is about what a site’s owner does to Google, not about the site. It can’t be seen from a website, so the audit lists it for review by hand and the study has no figure for it.
8.9 Malicious practices
“Malicious practices create a mismatch between user expectations and the actual outcome, leading to a negative and deceptive user experience, or compromised user security or privacy.”
What is checked. Google Web Risk (the homepage, in the study); hidden code that decodes to a redirect, an iframe or a script from another site; crypto-mining code; pop-under advert networks; back-button hijacking; and, in a browser, windows that a page opens by itself while loading.
What we found. 1 ordinary site (0.2%). A classic literature site opened a new window by itself whenever one of its pages loaded, taking the visitor to a chapter of a web novel on a fiction site. It happened on all 38 of its pages. Opening windows without a click is the kind of unexpected behaviour Google describes. It may be a misconfigured advert or a deliberate traffic deal, but either way the visitor didn’t ask for it.
No site was on Web Risk’s list, and no site carried mining code, pop-under networks or back-button hijacking.
8.10 Misleading functionality
“Misleading functionality refers to the practice of intentionally creating sites that trick users into thinking they would be able to access some content or services but in reality can’t.”
What is checked. Content lockers and offer walls (“complete a survey to unlock”), fake download buttons that lead to adverts, and pages that offer a free tool but have nothing to use.
What we found. No signs on any site. In run 8, a racing guide titled “Free Tools” was flagged as a tool page with no tool, and the rule was fixed so that guides and lists of tools aren’t counted. Since run 9, a tool page that links to the working tool from its main content isn’t counted either (section 6.4).
8.11 Scaled content abuse
“Scaled content abuse is when many pages are generated for the primary purpose of manipulating search rankings and not helping users.”
What is checked. Groups of 10 or more content pages, at least a quarter of the site, that are each 90% or more the same as one page and differ only by one word in the title. Also “snippet” pages built from other sites’ excerpts. Shop, account, listing and form pages are left out, because they share a template by design.
What we found. No signs on any site. In run 9 one site was flagged: the car key firm from section 8.2, where 27 of its 50 content pages were 92% to 97% the same as its BMW page. By run 11 the firm had 74 URLs and 69 content pages. Its car-make pages were still near-copies, and are still flagged under doorway abuse, but no longer in the form this policy needs (section 13.12). The report lists its three groups of near-copies for review.
Early runs flagged 41% of sites under this policy, nearly all shop templates and news layouts. Since then only near-copies with a swapped title word count, which is the pattern Google describes.
8.12 Scraping
“Scraping refers to the practice of taking content from other sites, often through automated means, and hosting it with the purpose of manipulating search rankings.”
What is checked. Sites where 5 or more pages (a quarter or more) are little more than embedded videos or posts from other sites. Text copied from other sites isn’t checked, because that needs a web search for every paragraph.
What we found. No signs on any site.
8.13 Site reputation abuse
“The site reputation policy applies where third-party content is published on a host site mainly because of that host’s already-established ranking signals, which it has earned primarily from its first-party content.”
What is checked. A section of 3 or more pages about coupons, casinos, betting, payday loans, CBD or essays, on a site whose homepage never mentions that subject.
What we found. No signs on any site. The gambling blogs do the opposite of what this policy describes: rather than renting space on a respected site, they build new sites whose whole purpose is the links.
8.14 Sneaky redirects
“Sneaky redirecting is the practice of doing this maliciously in order to either show users and search engines different content or show users unexpected content that doesn’t fulfill their original needs.”
What is checked. Whether Googlebot, phones or visitors arriving from Google end up on a different website from an ordinary visitor; meta refresh tags that send visitors to another site; and, in a browser, script redirects that send any view away. A redirect that sends every visitor to the same place isn’t counted.
What we found. 1 ordinary site (0.2%) and 1 gambling site.
- The county show had meta refresh tags on 4 old event pages sending visitors to a link-shortening service. In a browser, the same pages’ code sent phones arriving from Google to cryptocurrency news sites, about Bitcoin reserves and adoption.
- A “casinos not on GamStop” site sent Googlebot to a different organisation’s site with a “what’s on” page and an amphitheatre page, while visitors got the casino list. In effect it shows Google a respectable venue’s site and shows people a casino guide.
8.15 Thin affiliation
“Thin affiliation is the practice of publishing content with product affiliate links where the product descriptions and reviews are copied directly from the original merchant without any original content or added value.”
What is checked. Pages with 5 or more affiliate links and fewer than 100 words of the page’s own text per link. The audit can’t tell whether the text was copied from the merchant, so it measures how little of its own text the page has, and the report says so.
What we found. 3 ordinary sites (0.6%):
- a cycling deals site with 24 affiliate links and 25 words of its own per link on one page, and 15 links with 78 words each on its homepage;
- a product review site with 8 to 10 affiliate links and 21 to 28 words per link on its 8 product pages;
- a small site’s shop page with 15 affiliate links and 31 words per link.
Thin pages aren’t automatically spam. A shop page with a short note for each product can be useful. But a page that’s mostly links with a line each is what Google’s policy targets, and adding real experience of the products is the fix.
8.16 User-generated spam
“User-generated spam is spammy content added to a site by users through a channel intended for user content.”
What is checked. Spam links without rel="ugc", nofollow or sponsored in comments, forum posts, signatures, member profiles and comment widgets, and uploaded files with spam.
What we found. No signs on any site. Very few small sites in the sample have open comments or forums.
8.17 Scam and fraud
“Scam and fraud come in many forms, including but not limited to impersonating an official business or service through imposter sites, intentionally displaying false information about a business or service, or otherwise attracting users to a site on false pretenses.”
What is checked. Titles claiming to be a brand’s official support, phone number or website on a site that isn’t that brand’s; titles claiming to be the official site of a government service on a site that isn’t .gov.uk; and offers to sell official documents such as driving licences, passports, ID cards, visas and certificates.
What we found. 1 ordinary site (0.2%). Its homepage was titled “Buy UK Drivers License Online”, and 40 lines of evidence across its pages offered to sell UK driving licences, which can’t legally be bought. It was also flagged for keyword stuffing and expired domain abuse. It’s the clearest case of a site built to deceive in the whole study.
8.18 Spammy structured data
Google’s structured data guidelines say markup must describe what’s on the page, and Google can take manual action when it doesn’t. The audit checks two common cases: a review rating in the markup when the page shows no ratings or reviews, and, since run 9, the same rating copied onto 5 or more pages about different things (section 6.3).
What we found. 2 ordinary sites (0.4%) and 1 gambling site.
- A loan comparison site’s markup claimed ratings such as 4.60 from 157 reviews and 4.20 from 381 reviews on its loan pages, but the pages show no ratings. The same 4.60 from 157 reviews appeared on 8 pages about different loans.
- A web designer’s markup claimed a rating of 5 from 28 reviews on 33 pages, none showing reviews.
- The “casinos not on GamStop” site from section 8.14 claimed a rating of 5 from 30 reviews on 3 of its pages, including its responsible gambling page.
Ratings in markup are what put stars under a result in Google, which is why they’re tempting to fake. If the reviews are real, showing them on the page fixes the sign. If they aren’t, the markup should go.
8.19 The practices that can’t be seen from a website
Google lists other practices that can lead to demotion or removal: legal removals (many valid copyright notices), personal information removals, and policy circumvention (moving to new domains to dodge action). These depend on Google’s own records, not on anything on a site, so the audit lists them for review by hand and the study has no figures for them. Since run 11, the live audit reports policy circumvention as information, from what its cloaking, hidden text, sneaky redirect and expired domain checks find (see 6.9). It isn’t counted, so the study’s figures are the same either way.
9. The gambling sites
The gambling group is where Google’s spam policies are tested hardest, so it deserves its own section. Most of these sites aren’t casinos at all.
Two kinds of gambling site
The 199 sites came into the group in two ways:
- 55 had a gambling homepage: casino guides, “not on GamStop” lists, slot game demos and casino landing pages. Most say what they are.
- 144 carried gambling link networks: their pages linked to 3 or more different websites with gambling link text. More than half of them have only 2 URLs (80 of the 144), while 63 have 20 or more articles. Most of them don’t look like gambling sites at all.
The 144 link-network sites mostly present themselves as blogs about wildlife, offices, coins, investing, city living, events, gaming gear, web design and the outdoors, with titles such as “Your Guide to Smart Investing and Finance Tips” or “Inspiring Wildlife and Nature Blog”. Their articles cover those subjects too. The gambling is in the links.
Built in bulk, and recently
The registration records make the pattern plain. Every gambling domain in the study was registered in 2024 or later, and 172 of the 199 (86.4%) in a single month, July 2026. They share a style: one- or two-word brand names built from words like urban, London, Brit, modern, smart, prime, luck, ace, arena and coin, a named author on almost every site, and almost never a privacy page, and never a postcode or company number. 186 of them block AI crawlers in robots.txt, and none loads any analytics.
Sites built this way, in a batch, with invented subjects as cover, are the kind of thing Google’s scaled content and link spam policies were written for. Our audit doesn’t compare one site with another, so it can’t flag a network across domains (section 10). What it can see is what each site does on its own pages.
The links
186 of the 199 gambling sites (93.5%) carried links with commonly sold casino link text, not marked sponsored or nofollow. The audit counted 120,476 such links across those sites, a median of about 84 per site, while 12 sites carried more than 1,000 each and the largest 12,862. The most common link texts were:
- casinos not on gamstop;
- non gamstop casinos;
- casino not on gamstop;
- non gamstop casino;
- online casinos;
- non uk casinos;
- non uk casino;
- sites not on gamstop.
GamStop is the UK’s free self-exclusion scheme for people who want to stop gambling. Casinos licensed in Great Britain must take part in it. A casino “not on GamStop” is one that isn’t licensed here and that people who’ve excluded themselves can still use. These links exist to rank such casinos in UK search results.
Between them, the gambling sites linked with gambling text to 1,145 different websites. 542 of those were linked from 2 or more of the sites, and 221 from 5 or more. The most-linked website was linked from 65 of the 199.
The targets are worth a second look. Many of them have names that sound like ordinary organisations: venues, clubs, societies, cafés, awards, a historic society. A link with the text “casinos not on GamStop” pointing to a name like that only makes sense if that domain now carries casino content too. We didn’t check the 1,145 targets, so we can’t say how many are expired domains of real organisations now used for gambling. But run 11 found the same thing among the gambling sites themselves: three of them are old domains of a wedding directory, a parenting site and a London estate’s blog, now carrying casino pages. The pattern matches Google’s own example of expired domain abuse closely, and the link targets would be the natural next study.
Hidden link text
78 of the gambling sites (39.2%) also hid their casino link text. The phrases sit in a box that cuts them off, so the browser shows nothing, while the text is still in the page for search engines to read. The audit counted 4,832 hidden links and phrases across those 78 sites. This is Google’s hidden text policy in its plainest form: content placed “in a way solely to manipulate search engines and not to be easily viewable by human visitors”.
The other signs
- Sneaky redirects and spammy structured data: one “casinos not on GamStop” site sent Googlebot to a different organisation’s site with “what’s on” and amphitheatre pages, and showed visitors its casino list. Its markup also claimed a rating of 5 from 30 reviews on 3 of its pages.
- Doorway abuse: a site with a home-selling name and 10 near-identical city and property-type pages also carried 732 hidden casino links and phrases on its homepage, 136 lines of unmarked casino links, pages in Chinese, and pages about pornography, Viagra and online pharmacies. Whether that’s a hacked business site or a bought domain, its pages are a spam catalogue.
- Expired domain abuse: three sites on old domains of other organisations, now carrying casino pages (section 8.3).
- Keyword stuffing: two casino blogs repeated their key phrase 20 or more times on a page.
The 9 gambling sites with no signs
Nine gambling sites showed no sign against any policy. All nine had a gambling homepage: “ice fishing” and slot game demos, casino landing pages, a list of European casinos and a “non GamStop” list, each of one to four URLs. A gambling site isn’t against Google’s spam policies just for being about gambling. It needs to break one, and these didn’t: no unmarked sold links, no hidden text, no cloaking. Two sit on names that suggest a building firm and a Welsh organisation, and both were registered in September 2026, which suggests the domains were bought after their old owners let them go. The audit couldn’t confirm it for either: the Wayback Machine didn’t answer for one, and its old copies of the other couldn’t be loaded.
What the gambling sites didn’t show
No gambling site was flagged for cloaking, malicious behaviour, scam claims or thin affiliation, and none was on Google Web Risk’s list. These sites aren’t trying to trick visitors. They’re trying to pass ranking to casinos through links, and that’s where the signs are.
10. False alarms and limits
We read every sign the final run raised against its evidence. This section sets out what we took out of the figures and why, what the audit missed, and what the study can’t tell you.
False alarms taken out
The run raised signs on 25 ordinary sites and 190 gambling sites. After review, 22 ordinary sites and 190 gambling sites remain. We took out 35 signs:
- A football rumours site (keyword stuffing). Its homepage lists 71 players by surname. The place-list rule leaves out lists where 30% or more of the names contain a common first name, because those are lists of people. A squad list gives surnames only, so it slipped through. It’s a list of who’s in the team, not a list of keywords. The audit has since been changed so this no longer happens (section 6.10).
- A club’s news page (cloaking). On one URL, its news page, Googlebot’s copy was 15% the same as the visitor’s. There was no spam in Googlebot’s copy, and nothing else on the site differed. A news page whose stories change between loads can do this. The audit’s rule for pages that change on every load didn’t clear it this time. It isn’t cloaking.
- A cycling club (cloaking). As in run 9, Googlebot and phones arriving from Google were given the WordPress “ReadMe” page instead of the club’s homepage. That’s a misconfigured server or security plugin, and it’s bad for the club (Google can’t see its homepage), but there’s no spam in it and nothing to mislead anyone. It isn’t cloaking in Google’s sense.
- 32 gambling sites (hacked content). The hacked-content check flags spam phrases that are off a site’s own subject. These blogs present themselves as being about coins, wildlife, offices or events, and also carry casino articles, so the check read the casino articles as injected. They were placed by the sites’ owners. That makes them link spam (which all 32 are flagged for), not hacks. One of the 32, the home-selling site in section 9, may really have been hacked, but we can’t tell, so it isn’t counted as hacked either. One more was a casino landing page flagged for the words “Online Casino”, which is its own subject, so the subject rule should have left it out.
Run 9’s two other cloaking false alarms, an IT firm whose pages change on every load and a hosting firm whose visitor copy was a loading screen, didn’t come back in run 11.
Each false alarm points to a rule that can be improved, with a test site copying the innocent pattern. We didn’t change any rule and re-run to make these signs go away, because the published figures have to come from one run.
What the audit missed
We know of no miss in run 11. The miss we reported in run 9, the hacked estate agent caught under cloaking but not under hacked content, is fixed (section 6.1): it’s now flagged under both, on 43 pages.
We can only report misses we know about. We didn’t review the 441 ordinary sites with no signs by hand, so there may be others. The rules were tuned to avoid false alarms, and a stricter tool would find more, along with many more false alarms.
Expired domains that couldn’t be checked
The Wayback Machine limits how often it answers one caller. Run 11 ran in the daytime, and it answered far more often than in run 9, which ran overnight. During the run it didn’t answer for 103 sites. At the end, the study tried those again one at a time for the full 60 minutes it allows. That covered 86 of them and got answers for 48, one of which (the parenting site’s old domain, now a casino guide) became a sign.
In the end, expired domain abuse couldn’t be checked on 33 ordinary sites (10 where the Wayback Machine didn’t answer, and 23 where its old copies couldn’t be loaded) and 22 gambling sites (19 and 3). In run 9 it was 100 and 145. The figures of 4 ordinary and 3 gambling sites are therefore a minimum, but a much firmer one than before.
What the study can’t tell you
- Large sites. Every site had fewer than 100 URLs. Large sites may look quite different.
- One day. Each site was checked once, on one day. Hacks come and go, and so do sites. A site that was hacked in run 9 was clean in run 11, and a site that was clean may be hacked tomorrow.
- Backlinks. The audit only reads a site’s own pages. Links pointing to a site from elsewhere, which Google’s link spam policy also covers, aren’t checked.
- Networks across domains. Doorway, scaled content and link network checks work within one site. The study recorded shared tracking IDs and link targets, but the audit doesn’t flag networks.
- Firewall-dependent cloaking. The audit’s Googlebot doesn’t come from Google’s network. A site that only cloaks for real Google addresses won’t be seen. A firewall that blocks the audit’s Googlebot is recognised and not counted.
- Copied text. Scraping and thin affiliation can’t check whether text was copied from elsewhere.
- Pages not opened in a browser. Up to 25 pages per site were opened in Chrome, unless the site turned out to be built by JavaScript. On sites with more HTML pages, the rest were checked from their HTML only. On 417 of the 662 sites, every HTML page was opened.
- The rules were tuned on these sites. Most of the false alarms we fixed were found in earlier runs on the same ordinary sites. That’s how the rules got good, but it also means the rules fit this sample better than they might fit another. Three of the seven changes since run 9 (sections 6.2, 6.5 and 6.6) came from sites outside the study, which is some protection against that.
- The gambling group isn’t random. It’s every gambling site our random sample turned up that could still be checked. Its figures describe those sites, not all gambling sites.
11. What site owners should do
If your site is small and ordinary, the study’s main message is reassuring: 95.2% of sites like yours showed no signs at all. But the sites that did show signs mostly had no idea, and every one of the common problems is quick to fix once you know. Here’s what we’d do, policy by policy, in order of how often we saw it.
Mark paid, sponsor and affiliate links
The most common sign on ordinary sites. If you link to a sponsor, an advertiser, or a shop through an affiliate link (Amazon, Awin and similar), add rel="sponsored" to the link. rel="nofollow" is also accepted. Clubs and events with sponsor logos on every page are the commonest case. It costs nothing, it doesn’t stop the link working, and it’s exactly what Google asks for.
Check what Googlebot sees
Hacked sites hide their spam from you. The quickest check is Google Search Console’s URL Inspection tool, which shows the page as Google fetched it. Or search Google for site:yourdomain.com and look for titles you don’t recognise, especially in other languages. Our audit does the same comparison on every URL. If you find a hack:
- update your platform, theme and plugins, and remove any you don’t use;
- change every password: hosting, database, admin users and FTP;
- look for files and users you didn’t add, and for code in your theme that checks for “Googlebot”;
- once it’s clean, use Search Console to ask Google to look again.
If your web host or developer looks after the site, send them the evidence. The audit report shows the exact title Googlebot was given on each page.
Rewrite town lists and repeated phrases
Replace blocks of place names with a map or a sentence naming your main areas. Read your key pages aloud: if a phrase comes round so often it sounds odd, cut it back. Page titles should name the page once, not list every variation.
Make location pages genuinely local, or merge them
If you have a page for each town or each product where only the name changes, either make each one genuinely different (local address, team, photos, reviews, prices) or merge them into one good page. Google’s doorway policy is about near-copies made to rank, not about having branches.
Only mark up reviews you show
If your structured data includes a review rating, the reviews should be on the page. Plugins sometimes add a rating to every page by default. Check your markup with Google’s Rich Results Test and remove ratings that aren’t shown.
Give affiliate pages something of your own
A page that’s mostly product links with a line each is thin. Add what you know: why you chose each product, what you found using it, who it suits.
If you bought your domain second-hand
Check the Wayback Machine for your domain’s history. If it once belonged to a club, a charity or a business, that’s fine, but don’t trade on its old reputation: don’t keep old pages or old backlinks pointing at content that has nothing to do with them. If your domain has a past you don’t like, links from that past may also be worth disavowing.
If your site is built entirely by JavaScript
Make sure search engines can find your pages without running your scripts. Publish a sitemap and list it in robots.txt, and use ordinary links in your page’s HTML where you can. A site whose links only exist inside scripts or web components is harder for any crawler to read, Google’s included.
Pages that open windows by themselves
If your pages open a new window or tab without a click, find out why. It’s usually an advert script or a plugin. Visitors don’t expect it, and Google lists it as a malicious practice.
After a spam update
If your traffic changes after a Google spam update, follow Google’s advice and review the spam policies. Our audit is a starting point: every sign it finds comes with the URL, the evidence and how to fix it. Remember that for link spam, Google says “making changes might not generate an improvement” and “any potential ranking benefits generated by those links cannot be regained”. The fix is still worth making, so the problem doesn’t grow.
Beyond the spam policies
The study also found things that aren’t spam but are worth fixing on a small site: set a DMARC policy so no one can send email as you, remove old Universal Analytics code, add a consent banner before tracking runs, and add the basic security headers. Each takes minutes with most hosts.
12. Questions and answers
Does a sign mean a site is spam?
No. A sign is a pattern Google’s spam policies describe, found on the site with evidence. Only Google decides whether a site breaks its policies, and it looks at intent, scale and much more than any outside check can see. Many signs on ordinary sites in this study were simple oversights, such as unmarked sponsor links.
Why are gambling sites in the study?
Because they’re a large part of the small web (22.1% of the domains our fourth run tried), and because they’re the best test of whether the audit finds what it should. We report them separately as well as in the totals, because their figures are so different from ordinary sites.
Why did the figures change so much between runs?
Early versions of the rules flagged ordinary features such as menus, cookie notices, shop templates and firewalls. Each run, we read every sign, fixed the rules that caught innocent patterns, and checked that real problems were still found. The figures in this report come from one run of the finished rules. Section 5 lists every run.
Why weren’t the false alarms fixed and the run repeated?
Because a study has to report what its method found, not what it found after being adjusted to the answer. The 35 false alarms are listed in section 10 and taken out of the figures, and nothing else was adjusted.
How sure are the figures?
For ordinary sites, 22 of 463 had signs. Given the sample size, the true share among similar sites is very likely between 3.2% and 7.1%. Every proper measurement we’ve made has come out at about 1 in 20. Expired domain abuse is a minimum, because 33 ordinary sites couldn’t be checked for it.
Why does a hacked site look normal to its owner?
Because the hack is built to hide. The injected code checks who is asking. Googlebot gets the gambling page, which is what earns the hacker money, and everyone else, including the owner, gets the normal site. Some hacks also send only visitors arriving from Google, or only phones, somewhere else. The owner, typing their own address, never sees it. That’s why the audit loads every URL as Googlebot, as a phone and as a visitor from Google.
Is a gambling site against Google’s policies?
Not for being about gambling. Nine gambling sites in the study showed no signs at all. The gambling sites with signs were flagged for what they did: unmarked links with sold link text, hidden link text, a redirect that showed Googlebot a different site, fake review ratings, repeated phrases and old domains of other organisations turned into casino pages.
What’s the single most useful thing a small site can do?
Mark sponsor, advert and affiliate links with rel="sponsored". It was the most common sign on ordinary sites, it takes minutes, and it’s exactly what Google asks for. The second is to check, once in a while, what Googlebot sees on your site.
Can I check my own site the same way?
Yes. The audit on this page uses the same code as the study. Signed out, it checks up to 20 URLs and opens 10 pages in a browser. Signed in, it checks up to 100 URLs and opens 25 pages, the same as the study.
Why not name the sites?
The study is about patterns, not about shaming small businesses, most of which have simple fixes or have been hacked themselves. The hacked sites in particular are victims.
Does the audit check backlinks?
No. It reads the site’s own pages. Links pointing to a site from elsewhere need a backlink database. Signed-in users get a spam score from our data supplier for the site and the sites it links to, as information, but the study didn’t use it.
Terms used in this report
- Sign
- A pattern described in Google’s spam policies, found on a site with evidence and checked by a person. Not a verdict: only Google decides whether a site breaks its policies.
- Googlebot
- Google’s web crawler, the program that fetches pages for Google Search. The audit asks for pages using Googlebot’s name to see what Google is shown.
- Ordinary site
- A site in the random sample that isn’t a gambling site by the study’s rules (section 13.18).
- Evidence line
- One finding recorded by the audit, usually one URL or one link, with what was found there.
rel="sponsored"andrel="nofollow"- Markings on a link that tell search engines not to pass ranking through it. Google asks for
sponsoredon paid, sponsor and affiliate links. - Tranco list
- A public ranking of the top one million websites, built from several traffic sources, widely used in research.
- RDAP
- The public registration record for a domain, which gives the date the current registration started.
- Wayback Machine
- The Internet Archive’s collection of old copies of web pages, used to see what a domain held before its current registration.
- Google Web Risk
- Google’s service for checking an address against its lists of unsafe sites (malware, phishing and unwanted software).
- GamStop
- The UK’s free self-exclusion scheme for online gambling. Casinos licensed in Great Britain must take part. “Not on GamStop” sites are casinos outside it.
- Confidence range
- The range the true share among similar sites very likely falls in, given the size of the sample (a Wilson 95% interval).
- Near-copy
- Two pages that share 90% or more of their three-word phrases, measured with a compact fingerprint of each page.
13. The rules and thresholds
This section sets out every rule the audit used in run 11: what it reads, what counts as a sign, the exact thresholds, what is deliberately not counted, and the word lists. Rules added or changed since run 9 are marked “new since run 9” and explained in section 6.
Two terms are used throughout. Words means words of 3 or more letters (accented letters included). Similarity between two texts means the share of three-word phrases they have in common, unless a rule says otherwise.
13.1 Reading a site
- Homepage. Loaded as a visitor on a computer and as a visitor arriving from Google, at the same time as the Google Web Risk lookup. If it fails or returns HTTP 400 or above, the audit stops.
- Finding URLs. Every
Sitemap:line inrobots.txt, or/sitemap.xml; sitemap indexes followed to every sitemap. A sitemap must return HTTP 200 and contain<urlset>or<sitemapindex>. With no sitemap, links on each loaded page are followed on the same site. Subdomains of the site listed in its sitemaps are checked with it. - Homepages built by JavaScript (new since run 9). With no sitemap, when the homepage HTML has fewer than 150 words and fewer than 3 links to the site or its subdomains, and the browser is available, the homepage is opened once in Chrome as a computer visitor before the other URLs are loaded. Every link on the built page, including links inside web components (up to 2,000, collected within 3 seconds), is added to the list under the same rules as any other link. The report says how many more URLs were found this way.
- Duplicates. Addresses that match after ignoring
www., a trailing slash, letter case and the#part are checked once. A URL that redirects to a page already checked isn’t checked again. - Text only. Images, PDFs, archives, video, audio, fonts, programs and Office documents are listed, not downloaded. A response is a web page if its type is HTML, and a text file if its type is plain text, JSON, XML, Markdown or JavaScript, or, with no type, if the address ends
.md,.txt,.jsonor.xml. - Five loads per URL: visitor on a computer, Googlebot, mobile visitor, computer visitor from Google, mobile visitor from Google. The homepage reuses its first visitor-from-Google load.
- Identities. Visitor: a Chrome 120 on Windows identity. Googlebot:
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html). Mobile: a Chrome 120 on Android (Pixel 8) identity. Every request sendsAccept-Language: en-GB,en;q=0.9. - Limits per request: 9 seconds for a page, 20 for a sitemap, 15 for the registration record, 45 for the Wayback Machine. Up to 5 redirect steps, each checked as a public address. Pages and text files are read up to 2 MB, sitemaps up to 50 MB.
- Retries. A page load that gets HTTP 503 is tried once more after 3 seconds. HTTP 429 (new since run 9): after the first one, the rest of the site is loaded one request at a time, 1 second apart (doubling after each further 429, to at most 2 seconds); each refused page waits for the site’s Retry-After time (at least 1 second, at most 60) or, without one, 5, 10, 20 and 40 seconds, and is tried up to 4 times; once the waiting adds up to 600 seconds for the site, no more waits are made.
robots.txtand sitemaps aren’t retried. - Pace. Up to 5 URLs at once.
- How many URLs. The page checks the first 20 (signed out) or 100 (signed in), homepage first. The study checked every URL and left out sites with more than 99 same-site text URLs, or more than 1,980 URLs of any kind in their sitemaps. A safety limit of 1,000 sitemap files or 200,000 sitemap URLs applies everywhere.
13.2 The browser
- Which pages. The homepage first. Then pages whose HTML shows suspicious signs, strongest first, with these strengths: a sign already found on the page (5); code that checks who is visiting, such as
navigator.userAgent,document.referrer,navigator.webdriveror the words googlebot, bingbot, crawler, spider or headlesschrome (5); redirect code or a meta refresh (4); hidden or packed code such aseval(,atob(,unescape(or long runs of character codes or\xescapes (4); a script file with a strong sign (4); a hidden or tiny iframe from another site (4); pop-up, back-button or leave-page code (3); a script from another site used on 20% or fewer of the site’s pages, on sites of 5+ pages (3); an iframe from another site (2); under 150 visible words with a script (2); copies that couldn’t be compared (2); comments loaded by a script (2); styles that hide content (1). Then one page from each section not yet covered, then the rest in order. - Allowance. 10 pages and 120 seconds signed out; 25 pages and 240 seconds signed in and in the study.
- Sites built by JavaScript (new since run 9). A page counts as built by JavaScript when the browser shows 150 or more words and at least twice the words of its HTML (or twice 30 words, whichever is more). If that’s true of at least half of the pages opened first (of all of them, when fewer than 3 were opened), every other HTML page is opened too, within 20 minutes. On any page built by JavaScript, the text checks (keyword stuffing, hacked content and the others that read a page’s words) use the browser’s copy of the page.
- Links on the built page (new since run 9). Each browser view also records every link on the built page, including links inside open web components, up to 2,000 within 3 seconds. Links inside closed web components can’t be read.
- Three views: a computer visitor (1366 × 900), Googlebot, and a mobile visitor from Google (390 × 844, touch). Four pages at a time. 15 seconds to load, then up to 5 more while timers of up to 6 seconds are pending or the network is busy.
- Script files. Each script file is read once, the rarest first, up to 40 files, 1 MB and 8 seconds each, on every audit. A file has a strong sign for: packed code;
String.fromCharCode(with 50+ numbers;atob(of 200+ characters; 100+\xescapes in a row; a redirect to an address written in the file; or visitor-checking code together with redirect code. - Safety. All browser traffic goes through a proxy that refuses private, loopback, link-local, shared, documentation, multicast and reserved addresses, IPv6,
localhost,.localand.internalnames, names that don’t resolve and any port but 80 and 443. Downloads are denied. Pop-ups are closed and recorded.
13.3 Cloaking
- Spam only for Googlebot. Googlebot’s title or first 5,000 characters contain a word from list A (below); the visitor copy contains none anywhere; the visitor copy is a real page; Googlebot’s copy isn’t an error page; and either the titles differ or Googlebot’s copy has 3 or more different list A words. Also recorded under hacked content.
- Most of the page differs. Under 50% similar with different titles, or under 30% similar whatever the titles. For text files, under 30%.
- Mobile copies. Each mobile copy is compared with the computer copy: a sign for list A spam on mobile only (with different titles or 3 or more different list A words), or for different titles and under 30% similar. The second rule skips pages with a password field, mobile copies with no title and computer copies with no title. Empty copies on either side (under 5 words) aren’t compared at all.
- Phrases only for Googlebot. A three-word phrase 5 or more times in Googlebot’s copy and never in the visitor’s, with at least one uncommon word, no month name, at least two of its words (3+ letters) in the page’s address or title, none of the words permission(s), login, logged, register, sign, cookie(s), javascript or enable, and no web-address part (www, http, com, pdf, html, php, jpg, png). Only when the copies aren’t already a sign and Googlebot’s copy has 30+ words.
- In a browser. The rendered visitor and Googlebot copies are compared, and only spam sent to Googlebot counts. If the HTML copies differed but the rendered ones don’t give a sign, the HTML finding is removed as a page built by JavaScript. The mobile-from-Google view counts only for spam.
- AMP. For up to 5 pages with an AMP version, a sign when the AMP text is under 30% similar and the title differs.
Never counted: firewall, bot-check, maintenance, rate-limit and error pages (list F); one copy empty and the other not; pages built by JavaScript (visitor copy under 150 words and Googlebot’s 4 or more times longer); paywalls (structured data says isAccessibleForFree is false and 70%+ of the visitor’s five-word phrases are in Googlebot’s copy); search, member-list and session pages; XML files; and pages that change on every load (same title for Googlebot, little shared text, and a second visitor copy that differs from the first by as much as Googlebot’s, within 20 points).
13.4 Sneaky redirects
- A sign when the Googlebot, mobile, visitor-from-Google or mobile-from-Google load of a URL ends on a different website from the visitor load. A different website is a host that isn’t the same as, or a subdomain of, the other.
- A
<meta http-equiv="refresh">that sends visitors to another website. - In a browser, a view that ends on another website. Its destination is the final address, or the last address it tried if that failed to load.
- Not counted: every visitor type sent to the same other site by the server. In a browser, every view sent to the same outside host isn’t a sign either, unless that host is a bare network address or has a word from list B.
13.5 Hidden text and link abuse
- Inline styles in the HTML. A link to another website inside an element hidden by its inline style counts when its text has a list C phrase (in any listed language) or list D link text, or when it’s hidden strongly (font size 0, opacity 0, or pushed 100 px or more off-screen) and its address or text has a list B word or “pill(s)”. Not run on the browser’s copy of the page.
- A link on a single character (a hyphen, full stop and so on) to another website whose address has a list B word. Links with an image, icon,
aria-labelortitledon’t count. - Links in
<noscript>or HTML comments to another website whose text has a list C phrase or list D text. Up to 50<noscript>blocks and 200 comments per page. - Hidden links in a browser. The browser’s own test finds links hidden by opacity 0, scaling to 0, clipping, a box 1 px or smaller, lying outside an
overflow:hiddenbox,display:none,visibility:hidden, a font under 1.5 px, lying off the page, transparent text, text the same colour as the background (contrast under 1.15) or being covered by an image. A hidden link counts when its text has a list C phrase or list D text, or when its host has a list B word and it’s hidden strongly in a way other than cut off or off-screen. - Hidden text in a browser. Text of 12+ characters hidden in a deceptive way counts when it has list D text, a list C phrase in another language, or two different list C phrases, and the words aren’t the site’s own subject.
- Text added by CSS (
::before,::after) with 8+ letters and a spam word or list D text, when hidden or off the homepage’s subject. Image and icon addresses aren’t text.
Not counted: elements whose id, class or role contains cookie, consent, gdpr, modal, popup, dialog, menu, dropdown, drawer, offcanvas, tab, accordion or collapse; hidden panels with a form field or button; menus, tabs, accordions, slideshows, tooltips, dialogs, nav, details and elements with aria-expanded or aria-controls; screen-reader text; links to the site itself; social and video sites (list H) unless spam; links that show a visible image or icon over 4 px; and anything that moves more than 2 px in 2 seconds or sits in an animated box (tickers and slideshows that visitors see).
The site’s own subject. A spam word is the site’s subject if it, or a word from its subject family (list E), appears as a whole word in the homepage text, or the family’s own words match the phrase. If the homepage HTML has fewer than 50 words, the subject is read from the homepage as the browser shows it, with its hidden text left out.
13.6 Keyword stuffing
Before checking, the audit removes scripts, styles, headers, navigation, footers, sidebars, code, tables, link text, buttons, form labels and options, anything aria-hidden, list items of 12 words or fewer, labelled fields repeated 5+ times, any short text repeated 5+ times, any class used 5+ times with 80 words or fewer each, and web addresses and file names.
- Phone numbers: 20 or more different numbers (9 to 15 digits) with fewer than 25 words of prose per number.
- Place lists: a run of 25 or more capitalised names separated by commas, bars or bullets, unless at least half are countries, at least 30% contain a common first name, or 90% are in A–Z order.
- Repeated phrases: a three-word phrase of three different words, repeated 20 or more times and making up 3% or more of the page’s three-word phrases; not all common words; no month name; not only the site’s brand; and every uncommon word in it also in the page’s address or title. Pages with 60+ words of prose only.
- Titles: one word of 4+ letters, not a common word and not part of the site’s own address, 5 or more times.
- Image alt text: one word of 4+ letters, not a common word, 5 or more times in one alt text, and a third or more of its counted words. Up to 3 per page.
Not checked: XML, key and certificate files, JSON, CSV, calendar and contact files, robots.txt, ads.txt, app-ads.txt, security.txt and humans.txt. Meta keywords and descriptions aren’t checked: Google ignores meta keywords.
13.7 Hacked content
- Spam phrases: a list C phrase twice on a page, or once in its title, off the site’s own subject (13.5). Link text doesn’t count. On pages other than the homepage, a phrase in the homepage’s title, first heading or text isn’t counted. Pages about spam (new since run 9) aren’t counted under this rule: a page that uses the word “spam” 3 or more times and names spam phrases from 3 or more of these subjects: pills or pharma; casinos, slot machines, betting, poker or gambling; payday or loans; essays; replica goods; porn or xxx; escorts.
- Unexpected script: more than 20% of a page’s text (pages over 200 characters) in Japanese, Chinese or Korean script, unless the homepage title is in one of those scripts, the page is marked as one of those languages, or its address has a language marker such as
/ja/. - Spam only for Googlebot: the cloaking rule 13.3.1.
- A page in another language for Googlebot (new since run 9). When Googlebot’s copy has a different title and is under 30% similar to the visitor’s, the language of each copy (title and text, the first 20,000 characters) is worked out. A copy is in Chinese/Japanese/Korean, Cyrillic, Thai, Arabic, Hebrew or Greek script when more than 30% of its letters are in that script. Otherwise the common words of 11 languages are counted (English, Turkish, Indonesian, German, French, Spanish, Italian, Dutch, Portuguese, Vietnamese, Polish); the top language must make up 6% or more of the words and at least 1.5 times the runner-up. A copy needs 200+ letters and 40+ words. Different languages: a sign.
- Hidden iframes (0–2 px,
display:none,visibility:hiddenorhidden) from a bare network address or a host with a list B word, in the HTML or added by scripts. - Scripts and stylesheets from a bare network address or a host with a list B word.
- Auto-generated keyword pages: 3 or more pages whose most repeated three-word phrase appears 10+ times, makes up 5%+ of the page, has at most one word on the homepage, and contains a list B word, a phrase in another language or a cheap-goods word (cheap, cheapest, replica(s), outlet, discount, buy, wholesale, fake, sale(s)). Listing pages, and phrases in the page’s own address, don’t count.
13.8 Malicious practices
- Google Web Risk: a listing is always a sign. The page checks every URL, each outside domain linked (up to the URL limit) and up to 10 program downloads. The study checked homepages only.
- Hidden code in a page or a script file (a script that calls
evalonatob,unescapeordecodeURIComponent, usesdocument.write(unescape(, or builds a string from 50+ character codes) is decoded, never run. A sign if it sends visitors to another website, adds an iframe from another website or loads a script from another website. - Crypto-mining code or scripts, and pop-under advert networks.
- Back-button hijacking: one inline script that calls
history.pushState3+ times or in a loop, handlespopstate, and sends the visitor somewhere. In a browser, 3+ history entries added while loading, with a Back-button handler. - Windows opened by themselves while a page loads, in a browser.
- Links straight to program files (
.exe,.apk,.msi,.dmg,.scr,.bat,.cmd,.vbs,.jar) are listed for information, not as signs.
13.9 Link spam
Only links to other websites without rel="sponsored" or rel="nofollow" are considered.
- Sold link text: any link with list D text.
- Affiliate links: 3 or more links to the networks in list G. One or two are listed with advice, not counted.
- Advert links: a link inside an element (the link or one of its 6 nearest parents, not
body,htmlormain) whose class or id is exactly an advert name: ad, ads, advert(s), advertisement(s), sponsor(s), sponsored, sponsor-logos, ad-slot, ad-unit, banner-ad and similar. Not public-body sites, app stores, the site’s sister domain, or links about placing an advert with the site. - Link exchange pages: address or heading about swapping links, text asking for links back, and links to 15+ other sites. Required links back: terms saying a link back must be included.
- Sponsored posts: title, heading or first 600 characters marked as sponsored (including “in paid partnership with”, but not “in partnership with” or “brought to you by”). Each followed link in the main content, except social and public-body sites.
- Site-wide keyword links: the same followed link on at least half the HTML pages (3+), with 3+ words including a strongly commercial word (cheap, best, top, affordable, buy, near me, deal, discount, casino, loan, betting), and no word of 4+ letters that’s part of the linked site’s own name. Not social, public-body, sister-domain or donation links (ko-fi.com, buymeacoffee.com, patreon.com, paypal.me, gofundme.com, justgiving.com).
- Free-host networks: followed links to 10+ different sites on free hosting.
Links to government, NHS, university, police, school and parliament sites (list I) aren’t counted unless they’re affiliate links. Single everyday words such as “loan” or “casino” aren’t sold link text.
13.10 User-generated spam
A link in a comment, forum post, signature, member profile (/member(s)/, /profile(s)/, /user(s)/, /author/ and similar) or comment widget (up to 3 per page in a browser) that has a list B word, list D text or goes to an affiliate network, without ugc, nofollow or sponsored. Also files in an uploads folder with hacked-content evidence. Not counted: links in avatars, author names, reply and share buttons, and links to common platforms (Gravatar, WordPress, Facebook, X, LinkedIn, Instagram, YouTube, Pinterest, Google, WhatsApp).
13.11 Thin affiliation
Pages with 5 or more affiliate links (list G, plus addresses with /go/, /recommends/ or /refer/) and fewer than 100 words of main text per affiliate link.
13.12 Scaled content abuse
- Fingerprints. Each page with 50+ words of main text gets a 64-value MinHash fingerprint of its three-word phrases. Matches are found by banding (16 bands of 4); a band value shared by more than 2,000 pages isn’t used. 90%+ in common is a near-copy. Groups are built around one page and every member is compared directly with it.
- Content pages are web pages with 80+ words of main text. Not listing pages (category, tag, author, archive, numbered, sorted or filtered pages, addresses ending in a year, pages whose text is half links or more), query-string copies of pages already checked, or shop, account and form pages (list J).
- A sign: a group of 10+ content pages that aren’t exact copies, at least a quarter of the site’s content pages, made from one title pattern with one word swapped (the rest of the title 3+ characters, the swapped word 3+ letters with no digits, the pattern on at least 5 pages or half the group, whichever is more).
- Snippet pages: 3+ pages, each with 5+ “read more”, “source” or “via” links to other sites and under 80 words of main content per link.
Not counted: exact copies at several URLs (listed as duplicates), short pages alone, and product sizes and similar sets.
13.13 Doorway abuse
- Near-identical pages: 5+ content pages, each 85%+ the same as one page, with titles identical except one word, at least 5 different titles, the rest of the title 3+ characters, and the swapped word 3+ letters with no digits.
- Funnel pages: 5+ pages under 150 words (not the homepage or listings), titles differing by one word of 3+ letters that isn’t a number, and 80%+ of them linking from their main content to the same page on the site, which is an action page (contact, book, quote, estimate, order, enquire, call, apply, buy, checkout, get started or free trial). Not when every page is under a help, support, FAQ, knowledge-base or documentation folder.
- Branch pages aren’t counted when 80% of the group: show a UK postcode, with 80% showing a different first postcode; or each show a postcode no other page in the group shows; or carry their own branch details (LocalBusiness markup with a town or phone number, opening hours, or a map); or link to pages of their own below them.
Swapped numbers and sizes (times tables, print sizes, years) aren’t counted.
13.14 Site reputation abuse
A top-level folder of 3+ URLs named for a list K topic, or a section (first folder, 3+ pages) whose page titles name a money topic, when the homepage never mentions that topic. Single pages, and topics the homepage mentions, don’t count.
13.15 Expired domain abuse
- The registrable domain is worked out from the Public Suffix List.
- Public-body domains (list I) are “no signs”: a registry allocates them.
- The current registration date comes from RDAP. Signed in only, a missing date is taken from the WHOIS record through our data supplier. With no date, the result is “not checked”.
- The Wayback Machine is asked for homepage copies saved more than 30 days before that date, at most one a day, the last 8 kept: 45 seconds, 3 tries, a genuine “not found” not retried. No answer: “not checked”. No earlier copy: “no signs”.
- Up to 3 of the latest earlier copies are tried, newest first. Placeholders are skipped: list L pages, pages under 30 words, pages titled only with the domain name, and untitled pages under 150 words. Only placeholders: “no signs”. None loaded: “not checked”.
- The domain’s name (3+ characters) in both the old and current titles: “no signs” (the same owner).
- The 40 most frequent meaningful words (over 3 letters, common words left out) of the old copy and today’s homepage are compared. A sign when both have 10+ words and they share under 15%.
- A registration that started 10 or more years ago is “no signs”, with a note.
- When the old site’s title or text names a school, academy, college, university, council, charity, church, parish, association, society, club, museum, library, hospital, surgery, the NHS, a government body, a trust, a foundation or the scouts or guides, and the new homepage is about casinos, slots, betting, bookmakers, GamStop, poker, loans, payday, essays, CBD, vapes, replicas, crypto, forex, escorts, dating, pills, coupons, vouchers, affiliate deals or “best … reviews”, the report adds that this matches Google’s own example.
In the study, sites where the Wayback Machine didn’t answer were tried again at the end, one at a time, for up to 60 minutes.
13.16 Scraping, misleading functionality, scam and fraud, structured data
- Scraping: 5+ pages (a quarter or more of the HTML pages, not the homepage), each under 50 words of main content with 1 or more embedded videos or posts from other sites.
- Content lockers: “complete an offer or survey”, “verify you’re human” next to an offer, “unlock this content”, free currency or follower generators, or known locker scripts; “complete a survey” only within 60 characters of unlock, access, continue, download, “get your/the/free/instant” or “to view/see/read/watch/reveal”.
- Fake download buttons: a link whose whole text is a download phrase, going to an advert or click tracker on another site.
- Tool pages with nothing to use: a title or first heading offering a free or online tool, not a guide or list (titles with tools, guide, how to, tutorial or explained), with no form, input, editable area, canvas, iframe, object or embed and no scripts, or no usable control in a browser. Not counted (new since run 9): a page whose main content (not its menu, header or footer) links to another page on the same site with try, use, run, open, start, launch, check, test, scan or analyse in the link text.
- Scam and fraud: the title or first heading claims to be official support, a helpline, a phone number or the website of a well-known brand the site’s host name doesn’t contain; or calls itself the official site of a government service on a site that isn’t
.gov.ukor.gov; or the address, title, heading or first 5,000 characters offer to buy a driving licence, passport, ID card, residence permit, visa, diploma or certificate (not “passport holders”, “ID card printers” and similar products). - Spammy structured data: JSON-LD with an
aggregateRatingwhose review or rating count is 1 or more, on a page whose visible text shows no ratings or reviews. - The same rating on many pages (new since run 9): the same rating value and review count in the JSON-LD of 5 or more pages about 3 or more different things. Only ratings on a single item count: Product, ProductModel, IndividualProduct, SoftwareApplication, WebApplication, MobileApplication, VideoGame, Game, Book, Course, Recipe, Movie, TVSeries, Event, Vehicle, Car, Motorcycle, MusicAlbum, MusicRecording and HowTo. The “things” are the items’ names, with colour, size and pack words left out, so variants of one product count once. A business’s own rating on every page isn’t counted.
13.17 Scores and results
The report scores 17 checks: 15 of Google’s 16 spam policies (all but machine-generated traffic), scam and fraud, and spammy structured data. Expired domain abuse counts only when it could be checked. Machine-generated traffic, legal removals, personal information removals and policy circumvention are listed as not checkable from a website (since run 11 the live report shows them differently, see 6.9; what is counted hasn’t changed). Signed in, a spam score from our data supplier is shown as information and never counted. The study used no data from that supplier.
Not an accurate reading. When more than 10% of the URLs tried (checked plus failed) failed in a way that may hide content (timeouts, network errors, HTTP 403, 429 or 5xx, and any other failure), the report shows no score and says the reading isn’t accurate, with the count. New since run 9: URLs that returned HTTP 404 or 410, and URLs that send every visitor to another website, are still listed but don’t count towards the 10%.
13.18 The study’s gambling rules
These belong to the study, not the audit.
- Gambling names (removed from the ordinary list before the run): casino, poker, bingo, roulette, jackpot, gamstop, blackjack, betting, lotto, sportsbook, plinko.
- Gambling homepage title (whole words): bet, bets, betting, bookmaker(s), casino(s), slot(s), jackpot(s), bingo, poker, gambling, lottery, lotto, wager, free spins, gamstop, roulette, blackjack, sportsbook, plinko, chicken road, aviator game, crash game, no deposit bonus, a number followed by “fs”, ice fishing, play and win, win big, betway, bet365, betfred, ladbrokes, paddy power, sky bet, unibet, betfair.
- Gambling link networks: link text with casino, gamstop, gamestop, betting, bookmaker, poker, roulette or jackpot, pointing to 3 or more different websites.
13.19 Reproducing this run
- Audit:
lib/spam-policy-audit.js, md57cd0fca728e563f19c6f224b32286a2a. - Browser:
lib/page-renderer.js, md54b8aad898c9037ff3a8408c5a8d4f15a. - Study script:
tools/spam-study.js, md5cab7968c6ca0fecf4f66b2ea98dd25c9, run with--target 472 --gambling 200, the .uk part of the Tranco list in the order fixed by seed 20260926, and the ordinary and gambling sites carried over from runs 7 and 8. - Results:
results11.jsonl, 671 lines (662 sites checked, 9 not), md53d67dfd6ad4e93f2606d22023e09229d. - Run 9, for comparison: audit md5
ad087a9e…. Every difference between the two audit files is described in section 6.
13.20 Word lists
- A. Spam shown only to Googlebot
- casino, slot gacor, gacor, togel, judi, bahis, betting, jackpot, poker, roulette, viagra, cialis, porn, xxx, kasih menang, deneme bonusu.
- B. Spam words in addresses and host names
- casino, gamstop, gamestop, betting, bestbetting, slot(s), poker, roulette, jackpot, viagra, cialis, levitra, pharma, payday, loan(s), porn, xxx, escort, essay, replica, forex, crypto, backlink(s).
- C. Spam phrases (hacked content and hidden text)
- viagra, cialis, levitra, tadalafil, sildenafil, online casino, casino bonus, slot machine(s), payday loan(s), replica watches, bags or handbags, free porn, porn video(s), porn tube, xxx video(s), sex video(s), escort service, essay writing service, buy followers, crypto giveaway. Plus gambling and pill phrases in German, French, Spanish, Portuguese, Italian, Dutch, Polish, Indonesian, Turkish and Russian, including Turkish betting words (any word containing “bahis”, “… bet giriş”, casibom, jojobet, holiganbet, grandpashabet, meritking, matbet) and Indonesian lottery phrases (toto togel, situs toto, situs togel, bandar togel).
- D. Commonly sold link text
- online casino(s), casino site(s), new casino(s), best casino(s), UK casino(s), casino(s) not on GamStop, not on GamStop, non-GamStop, casino bonus(es), betting site(s), bookmaker(s) not on, free spins, no deposit bonus, payday loan(s), cheap viagra, buy viagra, buy cialis, essay writing service(s), buy essay(s), buy backlinks, replica watches, replica handbags.
- E. Subject families (a phrase isn’t off-subject on sites about these)
- Medicine names: pharmacy, chemists, pills, erectile problems, men’s health, medicine. Casino and slot phrases: casinos, slots, gambling, betting, bingo, poker, GamStop, jackpots, spins, roulette, blackjack, bookmakers. Payday loans: loans, lending, credit, borrowing, finance. Essay writing: essays, assignments, coursework, dissertations, homework, academic writing, thesis. Escort service: bodyguards, close protection, security, escorting. With pharmacy, gambling and lending words in the other listed languages.
- F. Pages not compared for cloaking
- Firewall or bot check: just a moment, attention required, client challenge, validation request, checking your browser, verify(ing) you are (a) human, are you a robot, captcha, ddos protection, security check, request (was) blocked, access denied, forbidden, bot verification. Not served normally: under maintenance, maintenance mode, temporarily unavailable, service unavailable, too many requests, rate limit, bad gateway, gateway time-out, internal server error, site is down, be right back, account suspended. Matched on the title, and on the text of pages under 150 words.
- G. Affiliate networks
- Amazon (with a
tag=parameter, or amzn.to), Awin (awin1.com), CJ (anrdoezrs.net, dpbolvw.net, jdoqocy.com, kqzyfj.com, tkqlhce.com), ShareASale, ClickBank, Skimlinks (go.skimresources.com), Partnerize (prf.hn), LTK (rstyle.me), Rakuten (linksynergy.com). - H. Social and video sites
- facebook.com, fb.com, instagram.com, twitter.com, x.com, youtube.com, youtu.be, vimeo.com, linkedin.com, pinterest, tiktok.com, whatsapp.com, wa.me, t.me, threads.net, bsky.app, flickr.com, spotify.com, soundcloud.com.
- I. Public-body domain endings
- .gov, .gov.uk, .nhs.uk, .ac.uk, .police.uk, .sch.uk, .mod.uk, .parliament.uk, .gov.scot, .gov.wales, .edu.
- J. Shop, account and form pages
- Address parts: product(s), shop, store, collection(s), cart, basket, checkout, my-account, account, login, log-in, signin, sign-in, register, wishlist, compare, contact, contact-us, enquir…, booking, book-now, book, quote, order, portfolio, project(s), gallery, galleries, event(s), colour/color, size, brand, attribute, memberlist, profile, member(s).
- K. Site reputation folders
- coupon(s), voucher(s), voucher-codes, promo-code(s), discount-code(s), casino(s), betting, sportsbook, slot(s), payday, payday-loans, loan(s), cbd, essay(s), essay-writing.
- L. Placeholder pages (expired domains)
- for sale, buy this domain, registered at [domain], resources and information, thousands of domains, free email and choose, domain registered, hosted by [domain], domain (name) (is) parked or available, parked free, domain or by, this domain may be or is for, make an offer, coming soon, under construction, just another WordPress site, index of /, account (has been) suspended, default web site page, welcome to nginx, it works!, domain expired, renew this or your domain, website is (currently) unavailable.