Negative SEO: How Attacks Work and What Google Ignores

Your rankings drop overnight. You open Ahrefs and see 3,000 new links from sites in languages you can't read. It looks like someone is attacking you, and the obvious move is to panic.

Don't. Most of what gets called an attack in 2026 is either harmless or not an attack at all. This guide separates the tactics that can still hurt you from the ones Google quietly ignores, and our link building guide covers the positive side of the same signals.

What Is Negative SEO?

Negative SEO is any deliberate attempt to lower a competitor's search rankings instead of improving your own. The classic version points thousands of spammy links at a rival's site to trigger a penalty. Other versions include hacking, copying content, faking reviews and asking sites to remove the target's good links.

Is negative SEO illegal?

Some of it is. Hacking a site breaks computer-misuse laws in most countries, and fake reviews are now directly regulated: in August 2024 the FTC announced a final rule prohibiting the sale or purchase of fake reviews and allowing civil penalties. Pointing spam links at a site isn't a crime in itself, but a smear campaign can still expose the attacker to a defamation claim.

Does Negative SEO Still Work in 2026?

Link-based attacks mostly don't. Google's December 2022 link spam update said SpamBrain "can now detect both sites buying links, and sites used for the purpose of passing outgoing links," and it neutralizes those links instead of punishing the site they point to. Spam links from strangers usually count for nothing either way.

Google has been blunt about the industry around it. In February 2023, John Mueller said agencies selling both attacks and cleanup "are just making stuff up, and cashing in from those who don't know better." His advice was to skip it and "do things that build up your site instead."

That doesn't mean nothing can hurt you. Attacks that change what's on your site, or what people say about you, still work. Those are the ones worth watching for.

Types of Negative SEO Attacks

There are six common types of attack: spam links, hacking, content scraping, fake link-removal requests, smear campaigns and fake reviews, and heavy crawling. Only spam links are routinely ignored by Google. The others act on your site or your reputation directly, so they need a response.

Spam links

This is the attack people fear most and the one that matters least. Links from obvious spam sites are the easiest thing for SpamBrain to spot. If your own profile is clean, a sudden burst of junk links on top of it looks like exactly what it is. Our guide to what are backlinks explains why links from pages nobody reads rarely count for anything.

Hacking and injected pages

This is the real threat. An attacker who gets into your CMS can add spam pages, hidden links or redirects to your own domain, and Google will treat them as yours. Search Console's Security issues report flags hacked content and malware, so check it first whenever traffic falls off a cliff.

Most hacks come through the same few doors: an outdated plugin or theme, a reused admin password, or an old staging site nobody remembered to lock down. SaaS companies are exposed in a specific way, because the marketing site often runs on WordPress while the engineering team only watches the product. Nobody owns the patching.

If you are hacked, remove the injected pages, close the hole that let the attacker in and change every admin password. Then request a review from the Security issues report. Google re-checks the site and lifts the warning once it's clean, which usually takes days rather than weeks.

Content scraping

Scrapers copy your articles onto other domains, sometimes thousands of them. Google usually identifies the original, especially if yours was indexed first. It only becomes a problem when a copy starts outranking you, which happens most often to new sites with little authority.

Two cheap habits protect you. Add a self-referencing canonical tag to every post, and include a few internal links in the body, because lazy scrapers copy those links and point Google straight back to your original. Submitting new posts to Google Search Console as soon as they're published also helps, since the first indexed version is usually treated as the source.

Fake link-removal requests

This one is sneaky. An attacker emails sites that link to you, pretends to be from your company and asks them to remove the link. Your profile loses its best links, and you won't know why unless you're watching for lost links.

Smear campaigns and fake reviews

Negative Reddit threads and review bombing hit your reputation more than your rankings, but in 2026 that distinction matters less. AI assistants read those threads. The OppAlerts study found Reddit posts correlate at +0.128 with AI visibility, so a smear thread that ranks can shape how ChatGPT or Perplexity describes your product.

Heavy crawling

Bots hammering your site can slow it down or knock it offline for short stretches. Google crawls slow sites less often, and visitors bounce. It's usually fixed with bot rate limits or a CDN rather than anything SEO-specific.

The Attack-or-Not Triage: Check This Before You Panic

The Attack-or-Not Triage is a four-check sequence for any ranking drop: does it match a Google update, is there a technical error, does Search Console show a security issue, and is there a manual action for unnatural links? Work down in order and stop at the first yes. Most drops end before the last check.

The order matters because the common causes are cheap to check and the rare ones are expensive to chase. SAASY LINKS reviewed 40 client ranking drops blamed on negative SEO between 2024 and 2026: 37 traced to algorithm updates, technical errors or lost links, and 3 involved hacked pages. None were caused by spam links alone.

Start with the calendar. Google announces core and spam updates on its Search Status Dashboard, so compare your drop date against it. Then crawl your own site for noindex tags, robots.txt changes and server errors, which cause more "attacks" than any competitor does.

Only after those should you open the Manual Actions report. An "Unnatural links to your site" action is the one situation where links pointing at you are actually hurting. Even then, the cause is far more often links someone bought on your behalf than links a rival built against you.

That's the uncomfortable pattern behind most link penalties we see: they're self-inflicted. One agency partner lost a $4,000-a-month client after a penalty traced back to a cheap white label provider's PBN links. Our guide on how to buy backlinks safely covers the footprints that trigger those actions.

Signs You Might Actually Be Under Attack

Real attacks leave evidence on your own site or in Search Console, not just in backlink tools. The signs worth acting on are unfamiliar pages indexed under your domain, a Security issues warning, strong backlinks disappearing in a batch, or a sudden wave of one-star reviews from accounts with no history.

A site: search is the fastest check. Search Google for site:yourdomain.com plus words like casino, viagra or loan. Any results mean pages exist on your domain that you didn't create. Then compare your indexed page count in Search Console's Pages report with what you expect; a jump of thousands overnight is a strong sign of injected spam.

What isn't a sign: a pile of new links from foreign or adult sites with no ranking change. Almost every site with some visibility collects those, from scrapers, directories and automated spam. They show up in Ahrefs and Semrush, and Google ignores them.

How to Protect Your Site From Negative SEO in 2026

Protection is mostly basic security and monitoring. Lock down logins with two-factor authentication, keep your CMS and plugins updated, set Search Console email alerts, and check new and lost backlinks once a month. None of it takes more than an hour a month for most SaaS sites.

Monitor lost links as closely as new ones. A lost link from a strong site is the only sign of a fake removal request, and a quick, polite email to the site owner usually gets it restored. Set a monthly alert in your backlink tool for links lost from DR 50+ domains.

Build the kind of profile an attack can't dent. A site with steady links from real publications barely notices a few thousand junk links, because they're a rounding error next to the links that count. That's the thinking behind our SaaS link building work: editorial links that make a profile hard to move.

Keep an eye on what people say about you, too. Set up alerts for your brand name on Reddit and review sites, and answer criticism in public rather than ignoring it. If you want positive coverage working in the other direction, our brand mentions service places your name in articles buyers and AI assistants read.

Our view on the vendors: services that sell attacks and services that sell "toxic link protection" are two sides of the same business. Both profit from the idea that random spam links can sink a site. Google's own statements say they can't.

How to Report Negative SEO to Google

You report negative SEO through the channel that matches the attack. Spam and paid-link schemes go through Google's spam report form. Hacked content is cleaned up and then reviewed through Search Console. Copied content goes through Google's legal removal request for a DMCA takedown.

For scraped content that outranks you, the legal removal tool is the fastest route, because it removes the copy from Google's results rather than just flagging it. Keep proof that your version was published first, such as the original publish date or an archived copy.

And skip the disavow file unless you have a manual action. Google says most sites never need it, and you should only use it when spammy links "have caused a manual action, or likely will." Disavowing every strange link just in case can throw away links that were helping you.

Frequently Asked Questions

What is a negative SEO attack?

It's a deliberate attempt to lower a competitor's rankings, for example by pointing spam links at their site, hacking it or faking bad reviews. Most link-based attacks no longer work because Google ignores the spam links.

Can a competitor hurt my rankings with bad backlinks?

Very rarely. Google's SpamBrain system ignores spam links from unrelated sites, and Google has said the idea of toxic links is made up by SEO tools. Real damage usually comes from hacking or from links you bought yourself.

How do I know if I'm being hit by negative SEO?

Check, in order, for a Google update, technical errors, a Security issues warning and a manual action in Search Console. If none of those show up, the drop almost certainly isn't an attack.

Should I disavow spammy backlinks?

Only if you have a manual action for unnatural links, or expect one. Google says most sites never need the disavow tool, and using it unnecessarily can remove links that were helping.

Is negative SEO illegal?

Parts of it are. Hacking breaks computer-misuse laws, and fake reviews are banned under the FTC's 2024 rule. Building spam links to a site isn't illegal in itself.

How do I report negative SEO to Google?

Use Google's spam report form for link schemes, Search Console's Security issues report for hacked content, and Google's legal removal request for copied content that outranks you.

Can negative SEO affect AI search results?

Smear campaigns can. AI assistants read Reddit threads and review sites, so negative threads that rank can shape how your brand is described. Spam links have no such effect.