![AIWebPageSEO](/images/aiwebpageseo-logo-light-t.webp) ![AIWebPageSEO](/images/aiwebpageseo-logo-dark-t.webp) # Spam Policy Audit Checks any website for signs of the practices in Google’s spam policies. Every sign found, where it is, and how to fix it. Check My Site Free•No account needed•Report on this page Advanced controls Free, no account - Up to 20 URLs - 10 pages opened in Chrome - Every policy checked Free, signed in - Up to 100 URLs - 25 pages opened in Chrome - Every policy checked Advanced controls - 20, 50 or 100 URLs - One folder, your own list of URLs, or chosen policies - DataForSEO spam score for your site and every site it links to - WHOIS registration date when the public record has none Signed in, paid from your credits. Open Advanced controls [ Demo](https://aiwebpageseo.com/aipageseo-demo-pages/demo-spam-audit.html)[ Tutorial](https://aiwebpageseo.com/aipageseo-demo-pages/novice-tutorial-spam-audit.html)[ Guide](https://aiwebpageseo.com/aipageseo-demo-pages/spam-audit-guide.html)[ Fix](https://aiwebpageseo.com/aipageseo-demo-pages/spam-audit-fixes-index.html) What it checks ## Google’s spam policies, checked one by one 15 of Google’s 16 spam policies are checked automatically, plus scam and fraud and spammy structured data, on up to 20 URLs from your sitemaps, or up to 100 when you’re signed in. The one left (machine-generated traffic) and three other practices Google lists can’t be seen from a website, so the report tells you what to review by hand. - CloakingEach URL loaded as a visitor, as Googlebot and on mobile, and compared; selected pages also in a real browser. - ️Sneaky redirectsWhere visitors, Googlebot, mobile users and visitors from Google end up, including redirects made by scripts. - Hidden text and link abuseLinks and text hidden from visitors, including by stylesheets, colour and position. - Keyword stuffingRepeated phrases, lists of phone numbers and places, and repeated words in alt text and titles. - Hacked contentSpam words in 11 languages, hidden iframes, suspicious scripts and auto-generated pages. - ️Malicious practicesGoogle Web Risk on every URL and linked site, hidden code, mining, pop-under and back-button tricks. - Link spamSold, affiliate and advert links, link exchanges, sponsored posts and site-wide keyword links. - User-generated spamSpam in comments, forum signatures, member profiles and uploaded files. - Thin affiliationPages that are mostly affiliate links with little of your own text. - Scaled content abuseNear-copies, reworded copies and pages made of other sites’ snippets. - Doorway abuseNear-identical town or keyword pages, and short pages that funnel visitors on. - ️Site reputation policyCoupon, casino, loan and similar sections your site isn’t about. - ⏳Expired domain abuseWhether the domain was registered again after holding a different site. - Misleading functionalityContent lockers, fake download buttons and tool pages with nothing to use. - ScrapingPages that are mostly media embedded from other sites. - Scam and fraudPages posing as a brand’s or government’s official service. - Spammy structured dataRatings and reviews in the markup that the page doesn’t show. FAQ Does this audit say my site is spam? No. Only Google can decide that a site breaks its spam policies. The audit looks at your public pages for signs of the practices Google describes, and reports each policy as signs found, no signs found, information, or not checkable automatically. A sign is something worth looking at, not a verdict. Each one shows exactly what was found and on which page, so you can judge it yourself. Is the Spam Policy Audit free? Yes. You don’t need an account or a card. Enter a website address and the report appears on the page. It checks up to 20 URLs, or up to 100 when you’re signed in, and usually takes a few minutes. There’s a daily free allowance for each connection, and if you reach it the page tells you so. Which pages does it check? Up to 20 URLs on the same site, or up to 100 when you’re signed in: your homepage first, then the URLs in the order your sitemaps list them (found through robots.txt or at /sitemap.xml, including every sitemap in a sitemap index). If there is no sitemap, pages found by following internal links from your homepage. The report shows how many URLs were found and how many were checked. Pages and text files such as .md, .txt, .json and .xml are checked. Images, PDFs and other non-text files are listed in the report as not checked, and so is any URL that could not be loaded. Why does it load my pages as Googlebot? To look for cloaking and sneaky redirects. Every URL is loaded as a normal visitor, as Googlebot, on a mobile phone, and as a visitor arriving from Google on a computer and on a phone, and the results are compared. Selected pages are also opened in a real browser (Chrome) the same ways, so redirects and content made by scripts are seen too. The request says it is Googlebot but doesn’t come from Google. A firewall or bot blocker that treats unverified Googlebot requests differently can give the same result as cloaking; if that’s the cause, no change is needed. What can’t it check? One of Google’s spam policies can’t be seen from a website: machine-generated traffic. Nor can three of the “other practices that can lead to demotion or removal” Google also lists: legal removals, personal information removals and policy circumvention. The report lists them so you can review them by hand. Scraping, misleading functionality and scam and fraud are checked for the patterns a website shows (pages that only embed other sites’ media, content lockers and fake download buttons, pages posing as a brand’s or government’s official service). Text copied from other sites and other tricks need a manual review. Stylesheets, scripts and comments loaded by JavaScript are checked on the pages opened in a real browser; the other pages are checked from their HTML. How does it check for expired domain abuse? It looks up when the domain’s current registration started, from the public registration record (RDAP), and asks the Wayback Machine whether a site existed on the domain before that date. If it did, the old site’s main words are compared with your homepage. A domain registered again after holding a site about something else is reported as a sign. If the registry for your domain ending doesn’t publish registration dates, the report says it could not be checked. What should I do after a Google spam update? Google’s advice is that sites that see a change after a spam update should review its spam policies. This audit gives you a starting point: every sign it finds comes with what was found, where, and how to fix it. Will the audit change anything on my website? No. It only reads public pages, the same way a visitor or search engine does. Nothing is installed, it never needs your login, and nothing is written to your server. Can you fix the problems for me? Yes. Under the report, use “Request a quote for this work”. Your request automatically includes the signs found and their fixes. You can also copy an AI fix prompt to paste into an AI coding tool. How it works ## Your report, URL by URL 1. 1 ### Enter your website Type the address of any public website. 2. 2 ### We read your pages Up to 20 URLs from your sitemaps (100 signed in), as a visitor, Googlebot, on mobile and from Google; selected pages in a real browser. 3. 3 ### Read the report Every policy, signs found first, with where and how to fix. 4. 4 ### Fix or get a quote Copy the AI fix prompt, or ask us to do the work. ## Check your site against Google’s spam policies Check My Site Free•No account needed•Report on this page Study ## What we found checking 668 UK websites against Google’s spam policies We ran this audit on every URL of 668 small UK websites: 469 ordinary sites picked at random from the Tranco top-sites list, and 199 gambling sites found among them. The final figures all come from one run of the finished audit, from 30 September to 1 October 2026. No site is named. 94.9%445 of 469 ordinary sites showed no signs against any of Google’s spam policies 5.1%24 ordinary sites showed signs against at least one policy; 7 of them against two or more 94.0%187 of 199 gambling sites showed signs, almost all of them unmarked casino links | Google spam policy | Ordinary sites (469) | Gambling sites (199) | All sites (668) | | --- | --- | --- | --- | | Link spam | 7 (1.5%) | 186 (93.5%) | 193 (28.9%) | | Hidden text and link abuse | 0 | 78 (39.2%) | 78 (11.7%) | | Keyword stuffing | 5 (1.1%) | 2 (1.0%) | 7 (1.0%) | | Cloaking | 4 (0.9%) | 0 | 4 (0.6%) | | Expired domain abuse | 4 of 369 checked (1.1%) | 0 of 54 checked | 4 of 423 checked (0.9%) | | Hacked content | 3 (0.6%) | 0 | 3 (0.4%) | | Thin affiliation | 3 (0.6%) | 0 | 3 (0.4%) | | Sneaky redirects | 2 (0.4%) | 1 (0.5%) | 3 (0.4%) | | Spammy structured data | 2 (0.4%) | 1 (0.5%) | 3 (0.4%) | | Doorway abuse | 2 (0.4%) | 1 (0.5%) | 3 (0.4%) | | Scam and fraud | 1 (0.2%) | 0 | 1 (0.1%) | | Malicious practices | 1 (0.2%) | 0 | 1 (0.1%) | | Scaled content abuse | 1 (0.2%) | 0 | 1 (0.1%) | | User-generated spam, site reputation abuse, scraping, misleading functionality | 0 | 0 | 0 | | At least one policy | 24 (5.1%) | 187 (94.0%) | 211 (31.6%) | ### Most small UK sites are clean 445 of 469 ordinary sites (94.9%) showed no sign against any policy. Of the 24 that did, most had one thing to fix, such as affiliate or sponsor links not marked as paid. ### Hacked sites hide spam from their owners Four ordinary sites sent Googlebot Turkish or Indonesian gambling pages that visitors never see. The owners would see a normal site. Only a check that asks as Googlebot finds it. ### Casino link blogs are new and built in bulk 172 of the 199 gambling domains were registered in July 2026. Most look like lifestyle or business blogs, and between them they link to 1,139 other websites with gambling link text such as “casino not on GamStop”. ### Old domains get a second life Four domains were registered again after holding a different site: a table tennis association, a film news site, a file-sharing site and a driving licence site. That last one now offers to sell driving licences. The full report 1. [Summary](#study-summary) 2. [Why we did this study](#study-why) 3. [The sites](#study-sites) 4. [How each site was checked](#study-method) 5. [How the study got here: nine runs](#study-history) 6. [Results](#study-results) 7. [Each policy: what Google says and what we found](#study-policies) 8. [The gambling sites](#study-gambling) 9. [False alarms and limits](#study-limits) 10. [What site owners should do](#study-owners) 11. [Questions and answers](#study-faq) 12. [The rules and thresholds](#study-rules) ### 1. Summary This is the full report of a study we ran with the Spam Policy Audit on this page. We checked every URL of 668 small UK websites against Google’s spam policies, and we report every figure, how we got it, and every rule that decides what counts as a sign. The study has two groups, and they behave so differently that we report them side by side as well as together. - **469 ordinary sites:** small .uk websites (under 100 URLs each) picked at random from the Tranco list of the world’s top million sites. 24 of them (5.1%, with a 95% confidence range of 3.5% to 7.5%) showed signs against at least one of Google’s spam policies. 7 showed signs against two or more. - **199 gambling sites:** every gambling site the random sample turned up that could still be checked. 187 of them (94.0%) showed signs, almost all of them links with commonly sold casino link text that weren’t marked as paid. - **All 668 together:** 211 sites (31.6%) showed signs against at least one policy. The most common sign among ordinary sites was link spam: 7 sites carried affiliate, sponsor or advert links without the `rel="sponsored"` or `rel="nofollow"` marking Google asks for. Next came keyword stuffing (5 sites), cloaking (4), expired domain abuse (4 of the 369 sites where it could be checked), hacked content (3) and thin affiliation (3). The most serious finding was four hacked sites: a clothing shop, a holiday attraction, an estate agent and a county agricultural show. Each one sent Googlebot a gambling page in Turkish or Indonesian, while visitors and the owners saw the normal site. Two of them also sent Googlebot, or some visitors, to other websites. The gambling sites tell a different story. Most of them aren’t casinos. They’re blogs about lifestyle, business, coins or the outdoors, nearly all registered in July 2026, whose real purpose is to carry links with text such as “casino not on GamStop” to other websites. 78 of them also hid that link text in a box too small to show it. We reviewed every sign by hand against its evidence. Three ordinary-site signs (all cloaking) were false alarms, and so were 31 “hacked content” signs on gambling sites, where the gambling articles were placed by the sites’ own owners. These are taken out of every figure above and explained in section 9. Nothing else was adjusted. Two limits matter most. Expired domain abuse could only be completed on 369 of the 469 ordinary sites and 54 of the 199 gambling sites, because the Wayback Machine often didn’t answer or its old copies couldn’t be loaded. And the audit missed one known hack under hacked content, though it caught the same site under cloaking. Both are explained in section 9. ### 2. Why we did this study Google updates the systems that find spam several times a year, and it lists these spam updates alongside its other ranking updates. Its advice to site owners is short. In its own words: “Sites that see a change after a spam update should review our spam policies to ensure they are complying with those.” That advice assumes an owner can tell whether their site has a problem. Many can’t. A hacked site may look perfect to its owner, because the spam is only shown to Googlebot. An affiliate link a web designer added years ago may be missing a single attribute. A domain may have been bought after a charity let it lapse, and nobody running the new site may know. Google’s policies describe these practices clearly, but they don’t give owners a way to check for them. We built the Spam Policy Audit to give them one. It reads a site’s public pages the way Google and visitors do, compares what each is shown, and reports the patterns Google’s policies describe. Before publishing figures about it, we wanted to answer four questions with real sites rather than test pages: 1. **How common are signs of spam on ordinary small UK websites?** Not big brands, which have teams to watch for this, but the clubs, shops, local firms and hobby sites that make up most of the web. 2. **Which policies do they run into?** Whether the problems are deliberate tricks, or ordinary mistakes such as unmarked affiliate links. 3. **What does the gambling corner of the .uk web look like?** Our first runs showed that a large share of small .uk domains carry gambling content. We wanted to measure it properly instead of leaving it out. 4. **Can an automated audit tell real spam from ordinary website features?** Menus that open and close, cookie notices, shop templates, firewalls and pages built by JavaScript all look like spam to a careless check. A tool that cries wolf on half the web is no use to anyone. The fourth question shaped the whole project. Our first full run flagged 85.6% of sites, and nearly all of those signs were wrong. Over nine runs we looked at every sign the audit raised, found the ones that were ordinary features, and changed the rules until they were no longer flagged, while making sure the real problems still were. Section 5 tells that story. The figures in this report come only from the last run, made with the finished rules. One thing this study doesn’t do is decide that any site is spam. Only Google can do that. The audit reports signs: patterns that Google’s policies describe, with the evidence for each. Throughout this report, “a site with signs” means the audit found at least one such pattern on it, and a person checked that the pattern was really there. ### 3. The sites #### Where the sites came from We started from the Tranco list, a free ranking of the top one million websites that academic studies of the web use because it’s stable and hard to manipulate. We kept only domains ending in .uk (including .co.uk, .org.uk and the other UK endings), then shuffled them into a random order using a fixed seed (20260926). Anyone with the same list and seed gets the same order, so the sample can be repeated. A random sample from the Tranco list is not a sample of every UK website. Sites on the list are ones that get some traffic, and sites with no visitors at all aren’t on it. But it isn’t a list of big brands either: the .uk domains on it run from national newspapers to village clubs, and once the large sites are left out, most of what remains is small. #### Small sites only We kept only sites with fewer than 100 URLs, and checked every one of their URLs. We made that choice for three reasons: - **Every URL counts.** A hacked page, a doorway page or a stuffed page can be anywhere on a site. Checking a sample of pages from a big site would miss it, and we wanted a clean answer for each site: signs or no signs, with nothing left unchecked. - **Small sites are the ones with no one watching.** A large site usually has a developer or an agency. A small one often has an owner who set it up years ago. - **Time.** Each URL is loaded five times, and up to 25 pages are opened in a real browser. A study of large sites would have taken weeks. A site was set aside as “too big” as soon as its sitemaps listed more than 99 URLs on the same site (or more than 1,980 URLs of any kind), or as soon as following its links found a 100th URL. #### How the ordinary group was fixed The ordinary group was set in our fourth run, on 27 September 2026. That run went down the shuffled list and tried 836 domains. It skipped sites that were too big or couldn’t be loaded, and set aside every gambling site, until 487 sites had been checked in full. Those 487 sites were then carried through every later run, so each improvement to the rules was measured on the same sites. Over the following days, 15 of them dropped out: 11 had grown past 99 URLs and 4 could no longer be loaded. That left 472 going into the final run. Three more couldn’t be checked on the night: one had grown past 99 URLs, one refused every request (HTTP 403) and one timed out. **469 ordinary sites were checked in full.** #### How gambling sites were found Gambling turned out to be everywhere in the .uk part of the list. Before our fourth run we removed every domain with a gambling word in its name (casino, poker, bingo, roulette, jackpot, GamStop, blackjack, betting, lotto, sportsbook, plinko): 1,453 of them. Even so, 185 of the 836 domains that run tried (22.1%) turned out to be gambling sites. 147 of those carried gambling link networks and 38 had a gambling homepage, including 13 on ordinary names that now show gambling. A site counted as a gambling site when either of these was true: - its homepage title was about gambling (words such as bet, casino, slots, bingo, poker, free spins, GamStop or the names of big bookmakers); - its pages linked to 3 or more different websites with gambling link text (casino, GamStop, betting, bookmaker, poker, roulette or jackpot). The exact word lists are in section 12. #### Why gambling sites are in the study When we first published, we left gambling sites out. They distort every total, and a reader who wants to know about ordinary websites doesn’t want a quarter of the sample to be casino networks. We changed our minds for two reasons. First, leaving them out hides something real: a fifth of the small .uk domains we tried were gambling sites. Second, gambling sites are exactly where Google’s spam policies bite hardest, so they’re the best test of whether the audit finds what it should. A check that found nothing on a casino link network would be broken. So the final run checked a gambling group as well, in full, with the same audit: every gambling site from the earlier runs that could still be checked, 199 in all. We planned 200. One fewer was available because the earlier runs had found no more. The results are reported together, so the study covers the small .uk web as we found it, and separately, because the two groups are so different that a single figure would mislead. #### The final sample | | Ordinary | Gambling | All | | --- | --- | --- | --- | | Sites checked in full | 469 | 199 | 668 | | URLs checked | 12,250 | 6,560 | 18,810 | | URLs per site (median) | 19 | 4 | 18 | | Sites with only one URL | 115 | 7 | 122 | | URLs found through a sitemap | 278 sites | 105 sites | 383 sites | | URLs found by following links (no sitemap) | 191 sites | 94 sites | 285 sites | | Pages opened in Chrome | 6,826 | 2,621 | 9,447 | The gambling sites have a small median (4 URLs) but a higher average (33), because the link blogs split in two: 73 of them have only 2 URLs, while 69 have 20 or more articles. ### 4. How each site was checked Every site in the study was checked with the same audit that runs on this page, using the same code file. The only differences are the ones a study needs: every URL was checked instead of the first 20 or 100, up to 25 pages per site were opened in a real browser, and Google Web Risk was asked about the homepage only. The study made no calls to paid data services. #### Step 1: the homepage The audit starts by loading the homepage twice at the same time: once as a visitor on a computer, and once as a visitor arriving from Google (with Google as the referring page). At the same time it asks Google Web Risk, Google’s own list of unsafe sites, whether the homepage is listed. If the homepage can’t be loaded, or returns an error, the site is recorded as “could not load” and isn’t counted. #### Step 2: finding every URL The audit reads every `Sitemap:` line in the site’s `robots.txt`, or tries `/sitemap.xml` if there are none. It follows a sitemap index to every sitemap it lists. A sitemap only counts if it loads and really is a sitemap. If there’s no sitemap, or the sitemaps list nothing, the audit follows every link on every page it loads, staying on the same site. 278 ordinary sites had a working sitemap, and 191 were checked by following links. Duplicate addresses are removed (ignoring `www.`, a trailing slash, letter case and anything after `#`). Files that aren’t text, such as images, PDFs, videos and Office documents, are listed but not downloaded. Pages and text files such as `.txt`, `.md`, `.json` and `.xml` are checked. #### Step 3: five loads of every URL Every text URL is loaded five times, one after another: 1. as a visitor on a computer (a current desktop Chrome identity); 2. as Googlebot (Googlebot’s own identity string); 3. as a visitor on a mobile phone (an Android Chrome identity); 4. as a visitor on a computer arriving from Google; 5. as a visitor on a phone arriving from Google. Comparing the five copies is how cloaking and sneaky redirects are found: a hacked site often shows spam only to Googlebot, or sends only visitors from Google somewhere else, because that’s what earns money while keeping the owner unaware. Each request asks for English, follows up to 5 redirects (checking each step is a public address), and gives a page 9 seconds to load. A page is read up to 2 MB. A page that answers “too many requests” or “temporarily unavailable” gets one more try after 3 seconds. Up to 5 URLs of a site are checked at once. One point matters for every cloaking result. The audit’s Googlebot requests use Googlebot’s name but don’t come from Google’s network. A site that checks where requests really come from, as Google advises, will treat them as an ordinary visitor or block them as an impostor. So a firewall can make a page look different to the audit’s “Googlebot” without any cloaking. The audit recognises firewall, bot-check, maintenance and error pages and never compares them. In the final run, 138 URLs on ordinary sites returned such pages and weren’t compared. #### Step 4: a real browser Many tricks only show up when a page’s JavaScript runs: redirects made by scripts, links hidden by stylesheets, text pushed outside a box, pop-up windows. So the audit also opens pages in Chrome, three times each: - as a visitor on a computer (a 1366 × 900 screen); - as Googlebot; - as a mobile visitor arriving from Google (a 390 × 844 touch screen). Chrome can’t run on every URL of a large site, so the audit chooses. The homepage always goes first. Then come pages whose HTML already looks suspicious: redirect code, hidden or packed code, code that checks who’s visiting, rare scripts from other sites, hidden iframes, pop-up or back-button code, or very little text with scripts. Then one page from each section of the site not yet covered. The rest of the allowance is filled with other pages in order. In the study the allowance was 25 pages and 240 seconds per site, the same as a signed-in audit on this page. Chrome opened 9,447 pages across 667 sites. On 381 sites, every HTML page was opened in Chrome. Pages load four at a time with a 15-second limit, plus up to 5 more seconds while short timers or network activity are still running, so delayed redirects are seen. The browser runs behind a safety proxy that refuses private and internal network addresses and any port other than 80 and 443. Downloads are refused, pop-up windows are closed and recorded, and Chrome’s own sandbox stays on. #### Step 5: the checks With every copy loaded, the audit applies its rules for each policy. It checks 15 of Google’s 16 spam policies, plus scam and fraud and spammy structured data, which Google also describes. Machine-generated traffic can’t be seen from a website, and neither can three of the “other practices” Google lists (legal removals, personal information removals and policy circumvention). The report lists those for review by hand. Each policy ends up as one of four results: **signs found**, **no signs**, **information** (something worth knowing that isn’t a sign) or **not checked**. Every sign comes with its evidence: the URL, what was found, and which copy it was found in. Section 12 sets out every rule. #### Step 6: registration and the Wayback Machine To check for expired domain abuse, the audit reads the date the domain’s current registration started, from the public registration record (RDAP). It then asks the Wayback Machine, the Internet Archive’s record of old web pages, for copies of the homepage saved more than 30 days before that date. If there’s an older copy, the audit skips parked, for-sale and placeholder pages, loads the last real one, and compares its main words with today’s homepage. A domain registered again after holding a site about something quite different is a sign. If both the old and new titles carry the domain’s name, it’s treated as the same owner rebuilding their site. The Wayback Machine is often slow and sometimes refuses busy callers, so the audit allows it 45 seconds and 3 tries. At the end of the study run, every site where it still hadn’t answered was tried again, one at a time, for up to 60 minutes. Section 9 explains how many sites that left unchecked. #### How the run was organised - **Three sites at a time.** Each site ran in its own process with a memory limit of 768 MB and a time limit of 20 minutes. If a site went over either, only that site would stop and be recorded as an error. In the final run no site hit either limit. - **Every result saved as it finished.** Each site’s result was written to the results file the moment it finished, so a stopped run could carry on without repeating work. - **A 10-site trial first.** The first 10 ordinary sites were run as a trial and checked before the rest started. They’re part of the results. - **Timing.** The run started at 22:16 on 30 September 2026 and finished at 05:23 on 1 October (UK time). The ordinary sites took a median of 79 seconds each, and the slowest 546 seconds. The gambling sites took a median of 82 seconds. - **Polite crawling.** Each site saw at most 5 requests at once from the audit, plus up to 4 pages in Chrome. Nothing was submitted, no forms were filled in, and no one signed in. #### Why these settings - **Under 100 URLs.** Large enough to include real small businesses with blogs and service pages, small enough that every URL could be loaded five times and a quarter or more of each site opened in a browser. - **25 browser pages.** The same as a signed-in audit, so the study measures what a customer gets. On 381 of the 668 sites that covered every HTML page. - **Three sites at a time.** Fast enough to finish in one night, slow enough that no site saw more than a handful of requests at once, and that the server running the study wasn’t overloaded. - **Web Risk on the homepage only.** The page checks every URL and linked domain. Across 18,810 URLs and the domains they link to, that would have meant tens of thousands of lookups, so the study asked about each homepage. None was listed. - **No paid data.** The study used only what any visitor or search engine can see, so anyone can repeat it. #### What was recorded For each site, the results file holds: the number of URLs found and checked, how they were found, how many failed or returned bot checks, how many pages Chrome opened, the Web Risk answer, and every policy’s result with its evidence (up to 25 lines each, plus the full count). It also holds some details that aren’t part of the audit but describe the sites, such as the platform, security headers, tracking and consent, and email security records. Section 6 reports those. No page content was kept, only these results. No site is named in this report. ### 5. How the study got here: nine runs An audit like this is only as good as its rules, and you can’t write good rules from Google’s descriptions alone. “Hiding text” describes a spammer’s trick, but it also describes every drop-down menu on the web. So we ran the audit on real sites, read every sign it raised, and asked of each one: is this the practice Google describes, or an ordinary feature that looks like it? Where it was an ordinary feature, we changed the rule, added a test site that copies the innocent pattern, and checked that the real problems were still found. This section lists every run, so readers can see how far the figures moved and why. | Run | Date | Sites | Ordinary sites with signs | What it led to | | --- | --- | --- | --- | --- | | 1 | 26–27 Sep | 250 | 85.6% | Most signs wrong; rules rewritten | | 2 | 27 Sep | 250 (different sites) | 81.6% | Firewall pages recognised | | 3 | 27 Sep | 500 | 25.4% | Templates, menus and social links left out | | 4 | 27 Sep | 487 | 12.0%, then 4.1% | The ordinary group fixed; first figures published | | 5 | 28 Sep | 4 | (stopped) | Gambling group added to the study | | 6 | 28–29 Sep | 687 | about 5% | Chrome added to the audit | | 7 | 30 Sep | 674 | about 25% | 19 rule changes | | 8 | 30 Sep | 472 | 7.2% | 9 more rule changes | | 9 | 30 Sep – 1 Oct | 668 | 5.1% | The figures in this report | #### Runs 1 to 4: from 85.6% to 4.1% The first full run, on 250 sites, flagged 85.6% of them. Reading the evidence showed why. Shop templates, where every product page shares most of its text, were flagged as mass-produced content. Cookie notices and pop-ups that start hidden were flagged as hidden text. Links to Facebook and Instagram were flagged as unmarked links. Firewalls that block anything calling itself Googlebot were flagged as cloaking. Gambling sites that mention gambling were flagged as hacked. The second run, on 250 different sites, added recognition of firewall and bot-check pages and still flagged 81.6%. The third, on 500 sites with version 12 of the rules, flagged 25.4%. By then the rules left out shop and account pages, listing pages, menus, tabs and accordions, social links and a site’s own subject. The fourth run fixed the ordinary group: 487 sites checked in full with version 13 of the rules, 12.0% with signs. Version 14 tightened the rules again, and was applied to the evidence that run had saved, giving 20 sites with signs (4.1%). Those were the figures we first published on 28 September. We said at the time that they came from rules applied to saved evidence rather than a new crawl. This report replaces them. #### Runs 5 and 6: gambling sites added, and the move to a browser Run 5 was stopped after 4 sites when we decided to add the gambling group. Run 6 checked the 487 ordinary sites again, plus 200 gambling sites, with the HTML-only audit. About 5% of ordinary sites showed signs. Run 6 also showed the limits of reading HTML alone. The audit couldn’t see redirects made by scripts, links hidden by stylesheets, or anything on pages built by JavaScript. In the fourth run, 41 of the 122 sites with a single URL had turned out to be built with Next.js, a JavaScript framework. So over 29 September we added Chrome in three stages: first to open pages and record what it saw, then to compare the browser’s views for cloaking, redirects, hidden text and malicious behaviour, and finally to fill in checks that don’t need a browser, such as structured data and scam claims. A first run of the finished audit on 84 real sites showed ten rules were too loose. For example, long descriptive image captions were flagged as stuffed alt text, hidden tracking iframes as hacks, and fade-in animations as hidden links. Each was changed. #### Run 7: the browser finds more, and more false alarms Run 7 was the first full study with the finished audit and Chrome, on 674 sites. Ordinary sites with signs jumped from about 5% to about 25%. That was expected: the browser sees far more than HTML. But reading every sign showed that most of the new ones were wrong. Some examples: - a body class called “category-advertising” turned every link on a page into an “advert link”; - a restaurant’s “book now for” was read as an auto-generated keyword page; - a band’s newsletter page sent every visitor to its record label’s sign-up form, which was flagged as a sneaky redirect, though everyone went to the same place; - a privacy page saying “complete a survey” was flagged as a content locker; - phone layouts and app sign-in screens were flagged as mobile cloaking; - a news slider headline that mentioned a pill was flagged as hidden spam; - donation links such as “Buy me a coffee” were flagged as sold links. We made 19 rule changes, each with a test site copying the innocent pattern. By run 7 the audit had found four hacked sites, which we confirmed ourselves by requesting their pages as Googlebot and as a visitor. Each change was checked against them: all four had to stay flagged. #### Run 8: the last false alarms Run 8 checked the ordinary sites again with the 19 changes. 34 of 472 (7.2%) showed signs. Reading every one found 9 more patterns that weren’t spam: - two sites whose computer copy came back empty while phones got the full page, which looked like “0% the same” mobile cloaking; - a restaurant’s branch pages, which listed the head office postcode first on every page, so the branch-page exception missed them; - a second restaurant whose branch pages each listed every branch’s postcode; - a chat site’s help articles, which all pointed to its contact page and looked like doorway funnels; - a betting site’s own promotions in a zero-size tab, flagged as hidden spam on a site whose subject is betting; - a second betting site whose homepage HTML was empty, so its subject couldn’t be read; - a racing guide titled “Free Tools”, flagged as a tool page with no tool; - pages whose videos or products change on every load, flagged as cloaking. The ninth pattern was a question rather than a fix. Sponsor and advert links without `rel="sponsored"` were still flagged, and we kept them as signs: Google’s policy asks for paid links, sponsorship included, to be marked. We fixed the other eight, added a test site for each, and checked them against the real pages on the live server. All eight sites were clean when checked again. One of them, an IT firm whose pages change on every load, was flagged again in run 9 on two pages the fix didn’t cover. Section 9 explains it. #### Run 9: one run for the figures By then the ordinary sites’ figures had been measured with two versions of the rules on different days. For a study we were going to publish, that wasn’t good enough. So we ran everything once more: all 472 ordinary sites and all 199 gambling sites, on the final rules, in one run. Every figure in this report comes from that run’s results file. We reviewed every sign it raised against its evidence and report the result, false alarms included, in section 9. We didn’t change any rule after seeing the results. #### Keeping the rules honest Every rule is written down in a rules record, and a check compares that record with the code before any change goes live. It currently covers 361 named patterns, constants and thresholds. If any of them changes, the check fails until the record is updated. Every fix also comes with a test site. The test suite now has over 100 sites. Some copy spam patterns, which must be flagged. Others copy innocent patterns from real sites, such as branch pages, help centres, rotating products, ticker slides, cookie notices and empty computer copies, which must not be flagged. The suite runs with and without a browser before every change. ### 6. Results #### Sites with signs | Group | Sites | With signs | Share | 95% confidence range | | --- | --- | --- | --- | --- | | Ordinary sites | 469 | 24 | 5.1% | 3.5% to 7.5% | | Gambling sites | 199 | 187 | 94.0% | 89.8% to 96.5% | | All sites | 668 | 211 | 31.6% | 28.2% to 35.2% | The confidence range is how far the true share among all similar sites could reasonably be from what we measured, given the sample size (a Wilson 95% interval). For ordinary sites, the share of small .uk sites with signs is very likely between 3.5% and 7.5%. The “all sites” figure depends on how many gambling sites are in the sample, and we chose that number. It describes this sample, not the .uk web. For the web as a whole, the ordinary-site figure is the one to use, along with the finding from our fourth run that 22.1% of the small .uk domains we tried were gambling sites. #### How many policies per site | Policies with signs | Ordinary sites | Gambling sites | All sites | | --- | --- | --- | --- | | None | 445 (94.9%) | 12 (6.0%) | 457 (68.4%) | | One | 17 (3.6%) | 107 (53.8%) | 124 (18.6%) | | Two | 4 (0.9%) | 78 (39.2%) | 82 (12.3%) | | Three | 2 (0.4%) | 2 (1.0%) | 4 (0.6%) | | Four | 1 (0.2%) | 0 | 1 (0.1%) | Most ordinary sites with signs had one problem. The seven with two or more were three of the four hacked sites (between them: cloaking, hacked content, sneaky redirects and link spam), a site selling driving licences (keyword stuffing, expired domain and scam), a car key firm (scaled content and doorway pages) and two affiliate sites (link spam and thin affiliation). Among gambling sites, the usual pair was link spam with hidden text: casino link text both linked and hidden on the page. #### Policies with no signs Four policies had no signs on any site: user-generated spam, site reputation abuse, scraping and misleading functionality. That doesn’t mean these practices don’t exist. It means the sites we checked didn’t show the patterns the audit looks for. Small sites rarely have open comment sections or forums, rarely host other companies’ coupon or casino sections, and rarely offer tools. Section 7 explains each. #### Google Web Risk Not one of the 668 homepages was on Google Web Risk’s list of unsafe sites, including the four hacked sites. Web Risk lists sites that spread malware or phishing. Sites that only show spam to Googlebot are usually not on it, which is one reason those hacks go unnoticed. #### Expired domain abuse: what was checked | Result | Ordinary sites | Gambling sites | | --- | --- | --- | | No copy on the Wayback Machine from before the current registration | 336 | 54 | | Public-body domain (allocated by its registry) | 15 | 0 | | Only parked or placeholder pages before | 7 | 0 | | Same owner rebuilt the site | 3 | 0 | | Same subject before and after | 3 | 0 | | Registered 10 or more years ago | 1 | 0 | | **Signs found** | **4** | 0 | | Not checked: the Wayback Machine didn’t answer | 82 | 142 | | Not checked: old copies couldn’t be loaded | 18 | 3 | The registration records also show how differently the two groups were built. More than half the ordinary sites whose registration date could be read were registered before 2010, and the median falls between 2008 and 2009. Every one of the 199 gambling domains was registered in 2024 or later, and 172 of them in July 2026. #### Every ordinary site with signs The 24 ordinary sites with signs, described by what they are rather than named. “Evidence” is the number of lines of evidence the audit recorded for each policy, usually one per URL or per link. | Site | URLs checked | Policies with signs (evidence) | | --- | --- | --- | | County agricultural show (hacked) | 39 | Cloaking (20), sneaky redirects (8), hacked content (8), link spam (30) | | Holiday attraction (hacked) | 47 | Cloaking (47), sneaky redirects (72), hacked content (46) | | Site selling driving licences | 41 | Keyword stuffing (2), expired domain (3), scam and fraud (40) | | Motorbike and fashion clothing shop (hacked) | 10 | Cloaking (8), hacked content (1) | | Car key repair firm | 54 | Scaled content (6), doorway (2) | | Product review site | 9 | Link spam (77), thin affiliation (8) | | Cycling deals site | 7 | Link spam (3), thin affiliation (2) | | Estate agent (hacked) | 44 | Cloaking (41) | | Motor rally club | 27 | Link spam (158) | | Fashion news site | 54 | Link spam (120) | | Scuba diving club | 36 | Link spam (50) | | Polish community classifieds | 64 | Link spam (9) | | Plant and transport hire firm | 40 | Keyword stuffing (4) | | Essay-writing service | 43 | Keyword stuffing (1) | | Business credit report site | 61 | Keyword stuffing (1) | | Film scenery maker | 26 | Keyword stuffing (1) | | Web hosting firm | 89 | Doorway (2) | | Loan comparison site | 83 | Spammy structured data (2) | | Web and PDF form designer | 63 | Spammy structured data (32) | | Classic literature site | 38 | Malicious practices (25) | | Small site with a shop page | 23 | Thin affiliation (1) | | AI tools guide (old table tennis association domain) | 82 | Expired domain (3) | | IT and telecoms firm (old file-sharing domain) | 1 | Expired domain (3) | | Bare page (old film news domain) | 12 | Expired domain (3) | All four hacked sites run WordPress, as do 120 of the 469 ordinary sites. WordPress isn’t less safe than other platforms, but it’s the most common target, and out-of-date plugins and themes are the usual way in. #### Which ordinary sites had signs The numbers are small, so these splits show tendencies, not firm rates. Still, three stand out. - **Bigger sites showed signs more often.** 1 of the 115 single-URL sites (0.9%) had signs, against 2 of 64 sites with 2 to 9 URLs (3.1%), 13 of 203 with 10 to 49 (6.4%), and 8 of 87 with 50 to 99 (9.2%). More pages mean more places for a problem, and more pages built from templates, plugins and affiliate feeds. - **WordPress sites showed signs more often.** 13 of 120 WordPress sites (10.8%) had signs, against 11 of the other 349 (3.2%). All four hacked sites run WordPress. Part of this is size: the WordPress sites had a median of 35 URLs, against 14 for the rest. Plugins can also add links, ratings and markup that an owner never looks at. - **Age made little difference.** Sites registered before 2005 showed signs at 4.2%, 2005 to 2014 at 4.9%, 2015 to 2022 at 7.6%, and 2023 or later at 4.9%. Old sites aren’t safer, and new ones aren’t worse. Sites with a sitemap (5.8%) and without one (4.2%) were similar, as were .co.uk sites (5.6%) and .org.uk sites (1 of 28). #### How these figures compare with what we published before On 28 September we published that 20 of 487 small UK sites (4.1%) showed signs. This report gives 24 of 469 (5.1%). The two figures aren’t far apart, but they measure different things, and the newer one is the one to use: - **The audit can now see far more.** The earlier figure came from reading HTML only. The audit now opens pages in Chrome, loads every URL five ways instead of three, and checks scam claims, structured data, misleading functionality and scraping, which it didn’t then. That finds real problems the earlier audit couldn’t, such as the literature site’s self-opening windows, the fake review ratings and the driving licence scam. - **The earlier figure came from rules applied to saved evidence.** We said so at the time. This one comes from a fresh run of the finished audit. - **The hacked sites.** The earlier figure found two hacked sites. This run found four. Sites get hacked and cleaned all the time, and the audit now checks phones and visitors from Google as well as Googlebot. - **The sample is the same sites.** 469 of this run’s ordinary sites are from the same 487, minus those that grew too big or stopped loading. #### Other things we noticed These aren’t part of Google’s spam policies, but the study recorded them for every site, and they say a lot about how small UK sites are run. They cover the 469 ordinary sites only. - **Platform:** 120 sites (25.6%) run WordPress, 48 (10.2%) are built with Next.js, and smaller numbers use Drupal, Shopify, Magento, HubSpot and Joomla. On 258 sites (55.0%) the platform couldn’t be identified from the page. - **HTTPS:** 468 of 469 sites use it. - **Security headers:** 240 sites (51.2%) send none of HSTS, Content Security Policy or X-Frame-Options on the homepage. 181 (38.6%) send HSTS and 118 (25.2%) a Content Security Policy. - **Tracking before consent:** 284 sites load a tracker, such as Google Analytics or the Meta Pixel, on the homepage. 170 of them (59.9%) do it with no cookie banner, consent tool or Google consent mode that we could detect. 64 set Google consent mode, and 50 show a banner or consent tool (we didn’t test whether it works). - **Old analytics code:** 134 sites carry only Google’s old Universal Analytics code, which stopped collecting data in 2023 and 2024, and no Google Analytics 4. 93 sites use Google Analytics 4. - **Email security:** 329 sites (70.1%) have no DMARC record or a DMARC policy of “none”, so anyone can send email that looks like it comes from their domain. 97 have a policy of “quarantine” and 43 “reject”. - **AI crawlers:** 73 sites (15.6%) block at least one AI crawler in `robots.txt`. 27 (5.8%) have an `llms.txt` file. - **Robots:** 373 sites have a `robots.txt`. 9 block Googlebot in it. - **Structured data and descriptions:** 227 sites (48.4%) use structured data. 206 (43.9%) have a meta description on every page checked. - **Who runs the site:** 340 sites have a contact page, 310 a privacy page and 262 an about page. 223 show a UK postcode and 84 a company registration number. - **Marking links:** 104 sites use `rel="nofollow"` on at least one outbound link. Only 3 use `rel="sponsored"`, the marking Google prefers for paid links. - **Broken links:** 51 sites have at least one internal link to a page that returns “not found”. - **Networks:** 68 sites (14.5%) belong to two networks that share a tracking ID. The larger is 38 local job sites sharing one Google Analytics and Tag Manager account. The other is 30 local newspaper sites sharing one analytics account. Sharing an owner isn’t a spam policy problem, but it shows how many small sites are run in groups. The gambling sites were strikingly uniform. None loaded a tracker. All 199 had DMARC set to none or missing. 186 blocked AI crawlers. 194 named an author, but only 6 had a privacy page and none showed a postcode or company number. ### 7. Each policy: what Google says and what we found This section takes each policy in the order Google lists them. For each one: Google’s own words, what the audit checks, what the study found, and any false alarms we saw. Examples are real, from the final run, with the sites’ names left out. #### 7.1 Cloaking > “Cloaking refers to the practice of presenting different content to users and search engines with the intent to manipulate search rankings and mislead users.” **What is checked.** The copies served to a visitor, to Googlebot and to phones are compared on every URL, from the HTML and in a browser. A sign is either spam sent only to Googlebot (or only to phones), with a different title or 3 or more different spam words, or a page that is mostly different (under 50% the same with a different title, or under 30% the same whatever the title). Firewalls, bot checks, maintenance pages, empty copies, pages built by JavaScript, paywalls, search pages and pages that change on every load are never counted. **What we found.** 4 ordinary sites (0.9%) and no gambling sites. All four were hacked. Googlebot was shown gambling pages that visitors never see: - a motorbike and fashion clothing shop whose homepage, as Googlebot sees it, is titled “Goldenbahis .com Orjinal Adres – Goldenbahis 896 Login …”, a Turkish betting site, on 7 URLs; - a holiday attraction whose 47 URLs all showed Googlebot “BENTO4D # Pengelola Resmi Situs Toto Togel Online …”, an Indonesian lottery-betting page; - an estate agent whose 41 URLs showed Googlebot “BayWin Nedir? Güncel Erişim ve Sık Sorulanlar”, another Turkish betting page; - a county agricultural show whose pages showed Googlebot “PT89 x Situs Investasi” and “ZONATUAN Situs Investasi”, Indonesian gambling pages dressed up as investment sites, on 14 URLs. In each case the visitor’s copy was the business’s normal page. This is the most damaging kind of hack for a small business. Google indexes the gambling page under the business’s name, the business’s own pages drop out of search, and the owner sees nothing wrong when they visit their site. **False alarms.** Three ordinary sites were flagged for cloaking wrongly. We took them out of the figures. Section 9 gives the details: an IT firm whose pages change on every load, a hosting firm whose visitor copy was a loading screen, and a cycling club whose server gave Googlebot the WordPress readme file. Cloaking also had the most pages the audit couldn’t compare. 59 ordinary sites had at least one URL where Googlebot was blocked, given a firewall page, or got no response. That’s how firewalls normally treat a request that claims to be Googlebot but doesn’t come from Google, and it isn’t counted. #### 7.2 Doorway abuse > “Doorway abuse is when sites or pages are created to rank for specific, similar search queries. They lead users to intermediate pages that aren’t as useful as the final destination.” **What is checked.** Groups of 5 or more pages that are each at least 85% the same as one page, with titles identical except for one swapped word (usually a town or a product). Also “funnel” pages: 5 or more short pages that differ by one word and all point to the same contact, booking or quote page. Branch pages of a real business are not counted when most of them show their own postcode, opening hours, map or local details, or have pages of their own below them. **What we found.** 2 ordinary sites (0.4%) and 1 gambling site. - A car key repair firm had 25 pages titled “… car keys”, one for each car make, each at least 85% the same as the BMW page. - A web hosting firm had 6 pages titled “domain name registration …” and 6 titled “website and email hosting …”, one for each UK region, each 85% or more the same as the others. - On the gambling side, a home-selling site had 10 near-identical pages titled “… – your home”, six for cities and four for property types. Section 8 explains why that site is also in the gambling group. Location pages are common and often useful. What makes them doorway pages in Google’s terms is that they’re near-copies with the town swapped, created to rank for “[service] in [town]” searches. A page for each branch that really is different, with its own address, team, opening hours and reviews, is not a doorway. **False alarms.** None in the final run. Run 8 found three, all branch or help pages, and the rules were fixed (section 5). #### 7.3 Expired domain abuse > “Expired domain abuse is where an expired domain name is purchased and repurposed primarily to manipulate search rankings by hosting content that provides little to no value to users.” **What is checked.** Whether the domain was registered again after holding a site about something quite different, using the public registration date and the Wayback Machine (section 4, step 6). **What we found.** 4 of the 369 ordinary sites where it could be checked (1.1%): - a domain that held a county table tennis association until 2024, registered again in December 2025, and now an AI tools guide; - a domain that held a copy of a well-known file-sharing site in 2022, registered again in November 2022, and now an IT and telecoms firm’s site; - a domain that held a film and entertainment news site, registered again in December 2022, and now showing a bare page under the domain name; - a domain that held a driving licence site until 2022, registered again in September 2024, and now offering to sell UK driving licences. The audit doesn’t judge whether the new content is low value, which Google’s definition also needs. It only records that the subject changed completely after a new registration. Three of these four new sites may well be legitimate businesses that bought a free domain name. The fourth is not: it’s also flagged for scam and fraud (section 7.17). Expired domain abuse is the policy with the largest gap in this study. The check couldn’t be completed on 100 ordinary sites and 145 gambling sites, because the Wayback Machine didn’t answer or its old copies couldn’t be loaded. So 4 is a minimum. A domain we know from run 8 to be an expired domain, an overseas volunteering charity’s old address now carrying AI tool reviews, is among the 100 not checked this time. #### 7.4 Hacked content > “Hacked content is any content placed on a site without permission, due to vulnerabilities in a site’s security.” **What is checked.** Spam phrases about pills, casinos, payday loans, replica goods and adult content, in 11 languages, that are off the site’s own subject. Also pages mostly in an unexpected script, hidden iframes from suspicious hosts, scripts from bare network addresses or spam-named hosts, auto-generated keyword pages, and spam shown only to Googlebot. **What we found.** 3 ordinary sites (0.6%): the clothing shop, the holiday attraction and the county show from section 7.1. On each, the hacked-content check recorded “spam shown only to Googlebot, not to visitors, a common sign of a hacked site”. The fourth hacked site, the estate agent, wasn’t flagged under hacked content in this run. In run 7 it was, through hidden links to a Turkish betting site, which weren’t found this time. Its Googlebot pages carry the betting brand “BayWin”, which isn’t one of the gambling words the audit lists, so they were caught under cloaking because the whole page was different, not under hacked content as spam. The site is in the figures, with the betting title as evidence. But hacked content should read 4, not 3, and we report it as a miss (section 9). **What isn’t counted.** A single mention of a spam phrase, which is usually an ordinary sentence (a support charity writing about pornography, a hosting firm listing the .porn domain ending). Spam words that are the site’s own subject: a pharmacy mentioning sildenafil, a bookmaker mentioning free spins. Pages in Japanese, Chinese or Korean on sites that publish in those languages. Hidden tracking, consent and widget iframes. **False alarms.** 31 gambling sites were flagged under hacked content because they carried casino articles on blogs about other subjects. Those articles were placed by the sites’ own owners, so they aren’t hacks. We took all 31 out (section 9). Every one of those sites still has link spam signs. #### 7.5 Hidden text and link abuse > “Hidden text or link abuse is the practice of placing content on a page in a way solely to manipulate search engines and not to be easily viewable by human visitors.” **What is checked.** Links and text hidden from visitors with a spam phrase or commonly sold link text, by inline styles, by stylesheets (as the browser shows the page), by being pushed off-screen, cut off outside a box, given a tiny font, coloured like the background, covered by an image, or placed inside `