Negative SEO and link attacks: how to spot one and respond
Negative SEO is an attempt to damage a competitor's rankings from outside. Spam link blasts are the best-known form and the least effective, because Google mostly ignores them. Fake link removal requests, review attacks and hacks do the real damage.
In short
- Negative SEO covers spam link blasts, fake link removal requests, false copyright notices, content scraping, fake reviews, hacking and redirects from penalised domains.
- Since Penguin 4.0 in September 2016, Google is reported to mostly ignore spam links instead of demoting the site they point at, so most link blasts achieve nothing.
- Analysts read the 2024 leaked Google documentation as describing a mechanism that measures sudden anchor spikes and discounts the anchors inside them.
- The damaging attacks are the ones that remove your good links or compromise your site, not the ones that add bad links.
- The working rule is to disavow attack links only if a manual action exists or a clear attack coincides with a ranking drop that has no other explanation.
Negative SEO is the attempt to push a competitor down in search results by acting against their site from outside. The form everyone fears, a flood of spam links, is the one that works least. The forms that do damage are quieter: someone persuading publishers to take down your good links, attacking your reviews, or breaking into your site.
This lesson is defensive. It explains what the attacks look like so you can recognise one, and what to do about it.
What counts as negative SEO
| Attack | What it looks like | Does it work? |
|---|---|---|
| Spam link blast | Thousands of new links in days, often with adult, gambling or exact-match anchors | Rarely. Google mostly ignores them |
| Fake link removal requests | Emails to your link partners, posing as you or your agency, asking them to remove links | Yes, if partners comply |
| False copyright notices | Takedown requests filed against your pages | Listed by practitioners among the attacks that do real damage |
| Content scraping | Your content copied to other domains | Mostly noise |
| Fake reviews | A wave of one-star reviews on third-party platforms | Yes, mainly to reputation |
| Hacking | Injected pages, hidden links or redirects on your own site | Yes, and it is a security incident |
| Redirecting penalised domains | A penalised domain pointed at yours with a 301 | Unclear. No reliable data |
Spam blasts are common because they are cheap. They are reported to cost between $5 and $100, though that range comes from low-confidence practitioner sources. The software behind them is the same automation described in public PBNs and automation.
What Google says
Google’s reported position since Penguin 4.0 in September 2016 is that its systems devalue spam links and do not demote the site that receives them. John Mueller has called toxic links a concept made up by SEO tools and has said that Google ignores random spam links.
On the disavow tool, Google’s guidance is reported to be to use it when you have a manual action for unnatural links, or a considerable number of artificial links that you built or paid for. Links someone else pointed at you are not in that description. Mueller said on 2 September 2026 that “Disavowing a handful of links is not going to make your site drop out of search.”
There is also indirect evidence from the documentation leaked in 2024. It contains fields that count spam-phrase anchors, record the days over which they were discovered and mark the start and end of a spike. Analysts read this as a system that spots a sudden burst of similar anchors and discounts the anchors inside it, which is exactly what a blast produces. That is an inference from field names. Google has not confirmed how the fields are used. See the leak and court documents lesson for the detail.
One caveat cuts the other way. Gary Illyes and John Mueller have both been reported as saying that when a link profile is overwhelmingly manipulative, the algorithms can distrust the site’s links more widely. A site with a long history of bought links has less margin than a clean one.
Our reading: link-based negative SEO is possible in theory and rare in practice. No public study measures how often it succeeds.
How to spot an attack
Most of what looks like an attack is not one. Every site collects scraper links, odd directories and foreign-language spam. Check for these signs before you conclude otherwise.
In your backlink data
- a sharp rise in new referring domains over days, not months
- anchors you would never choose: adult terms, gambling terms, or your main keyword repeated hundreds of times
- links from forum profiles, comment sections and guestbooks in unrelated languages
- good links disappearing in a cluster
In your inbox and your partners’ inboxes
- a publisher asking why you requested a link removal you never sent
- notice of a copyright complaint against one of your pages
On your own site
- pages or outbound links you did not create
- links hidden from visitors but present in the source code
- a security warning in Search Console
On review platforms
- a burst of negative reviews from accounts with no history
Then ask the question that matters: did rankings move at the same time? If they did not, you are looking at noise. If they did, line the dates up against the timeline of spam updates before blaming the links, because a drop on a core update date usually has another cause.
How to respond
- Document first. Export the new links with dates, anchors and referring domains. Save copies of any fake emails. You may need the record for a reconsideration request or a legal complaint.
- Check Search Console. Look at the Manual Actions report and the Security Issues report. If both are clean, nothing has been applied to your site.
- Leave spam links alone if rankings are stable. This is the hard step, because doing nothing feels wrong. Disavowing by reflex risks removing links that help.
- Disavow when the case is clear. If a manual action arrives, or a well-defined attack lines up with a drop that has no other explanation, disavow the attacking domains at domain level. The procedure is in Google link penalties and recovery.
- Warn your link partners. If fake removal requests are going out, tell your publishers that genuine requests come only from one named address, and ask them to check with you before removing anything.
- Restore lost links. Contact publishers who removed links in error. The link reclamation process applies.
- Treat a hack as a security incident. Clean the site, change credentials, update the software, and keep checking the Security Issues report.
- Report fake reviews through the platform’s own process, and dispute false copyright notices with the service that received them.
Prevention
None of these figures is measured. They are standard practice.
- Set alerts for new referring domains and new anchors, and review them weekly. The backlink tools comparison lists tools that send these alerts, and how to track backlinks explains the routine.
- Brief link partners once, in advance, on which address real requests come from.
- Keep your site software current and limit who has admin access.
- Monitor your own outbound links, so injected links are found quickly.
- Keep your own link building clean enough that an attack has nothing to add to.
The legal side
Unauthorised access to a computer system is a criminal offence in practically every jurisdiction. Sending requests in someone else’s name, filing false copyright notices and posting fake reviews can fall under fraud, defamation or consumer protection law, depending on the country. If an attack is costing you money and you have evidence of who is behind it, speak to a lawyer. This page is not legal advice.
Where to go next
A backlink audit gives you the baseline that makes an attack visible. The link velocity lesson explains what Google is thought to measure in a spike, and the glossary defines the terms used here.
Common questions
What is negative SEO?
It is any attempt to lower another site's search rankings from outside. The usual methods are pointing spam links at the site, tricking publishers into removing its good links, posting fake reviews, filing false copyright notices and hacking.
Can a competitor hurt my rankings with bad backlinks?
It is possible in theory and rare in practice. Google's systems mostly ignore spam links, and Google's John Mueller has called toxic links a concept made up by tools. Most apparent attacks are ordinary scraper noise.
How do I know if I am under a negative SEO attack?
Look for a sudden burst of new referring domains with adult, gambling or exact-match anchors, good links disappearing without reason, a wave of one-star reviews, or outbound links on your site that you did not add. Then check whether rankings moved at the same time.
Should I disavow links from a negative SEO attack?
Not by default. Document the links and watch your rankings. Disavow at domain level if you receive a manual action, or if a clear attack lines up with a drop that has no other explanation.
Is negative SEO illegal?
Several forms are. Hacking is a criminal offence in practically every country, and fraud and defamation laws can apply to fake removal requests, false copyright notices and fake reviews. Take legal advice for your own jurisdiction.
