Google's Spam Policies Explained: What Gets a Site Demoted and How to Recover

Google's spam policies are the rules that decide which tactics can get a website pushed down or removed from Google Search. Google says sites that break them "may rank lower in results or not appear in results at all", and it finds violations with automated systems and with manual review by Google staff, which can lead to a manual action. For a business owner, the practical point is simple: any SEO work done for you has to stay inside these rules, because your site carries the risk, not the agency.

This guide explains what the policies cover, the three newer rules Google added in 2024, the tactics that most often get businesses into trouble, and what recovery actually looks like.

What are Google's spam policies?

Google publishes its spam policies for web search as part of Google Search Essentials. They describe practices Google treats as attempts to deceive users or manipulate its rankings. The current list includes:

1. Cloaking, which shows Google different content from what people see.
2. Doorway abuse, such as many near-identical pages built to rank for slight variations of a search.
3. Expired domain abuse.
4. Hacked content, hidden text and hidden links.
5. Keyword stuffing.
6. Link spam.
7. Machine-generated traffic, malicious practices and misleading functionality.
8. Scaled content abuse.
9. Scraping, meaning republishing other sites' content without adding value.
10. The site reputation policy.
11. Sneaky redirects, thin affiliation and user-generated spam.

The page also covers legal removals, scams and fraud, and policy circumvention. Our Academy lesson on Search Essentials and spam policies walks through the basics if you're new to them.

What changed in 2024?

In March 2024, Google announced three new spam policies alongside that month's core update. They target tactics that had grown common in the SEO industry.

Scaled content abuse

This is publishing many pages mainly to manipulate rankings rather than to help people. Google's policy applies "no matter how it's created", and its announcement said it covers content produced at scale "whether automation or humans are involved." In other words, a writing team churning out hundreds of thin location pages is treated the same way as a content-generation tool doing it. Our helpful content self-assessment is a useful test of whether a page earns its place.

Expired domain abuse

This is buying an expired domain and reusing it to host low-value content that trades on the old site's reputation. Google's example is casino content on a domain that used to belong to an elementary school. Google also says "it's fine to use an old domain name for a new, original site", so buying a domain isn't the problem. Using its history to rank unrelated content is.

Site reputation abuse

This is publishing third-party pages on an established site to take advantage of that site's ranking signals. The policy took effect on 5 May 2024. In November 2024, Google clarified the policy to say it applies "regardless of whether there is first-party involvement or oversight of the content." Google also stresses that third-party content alone isn't a violation. Freelance articles, properly marked affiliate links and guest content can all be fine. The problem is using a host site's reputation to rank content that couldn't rank on its own. Google's policy page now calls this the site reputation policy, and notes that in the European Economic Area such pages are categorised separately rather than given a manual action.

Which spam tactics do businesses most often get caught by?

Most site owners never set out to spam Google. Trouble usually comes from tactics bought as part of a cheap package. Watch for these:

1. Paid links that pass ranking credit. Google's link spam policy covers buying or selling links for ranking purposes, excessive link exchanges, automated link building, low-quality directory links and requiring a link in a contract or terms of service. Paid placements are fine when they're qualified with rel="sponsored" or "nofollow", which tells Google not to count them. Our glossary entry on the nofollow attribute explains the options.
2. Mass-produced location or service pages. Hundreds of pages that only swap a suburb name can fall under doorway abuse or scaled content abuse.
3. Copied content. Republishing other sites' articles with little added is scraping. Our guide to whether duplicate content hurts SEO explains where the line sits, and a free plagiarism checker can show whether supplied copy already exists elsewhere.
4. Hosting someone else's content for a fee. Coupon, review or casino sections run by a third party on your domain can trigger the site reputation policy.
5. Sneaky redirects and hidden text. These are classic black hat SEO tactics, and they still appear in some agency work.

Google also notes that third-party "authority" or "reputation" scores don't correspond to its own ranking signals. Tools like our page authority checker are handy for comparing sites, but an agency promising to "raise your authority score" with bought links is chasing the wrong target.

How does Google enforce its spam policies?

There are two routes.

Automated systems. Google's main spam-prevention system is called SpamBrain, and it runs all the time. Google also releases spam updates when it notably improves these systems. You won't get a notice when automated systems demote a site. Our explainer on Google core updates covers how to tell a spam update from a core update when your traffic changes.

Manual actions. Google's own staff can apply a manual action to some pages or a whole site. You'll see it in the Manual actions report in Google Search Console, which is one reason every business should own its own Search Console account. Google also warns that trying to get around a policy, for example by moving the content to a new subdomain or subdirectory, can lead to broader action against the site.

How do you recover from a spam problem?

Recovery depends on which route caught you.

If you have a manual action

Google's Manual actions report help page sets out the process:

1. Read the notice to see which policy was breached and which pages are affected.
2. Fix every affected page. Google says that if you fix only some of them, you won't get a partial return.
3. Make sure Google can reach the fixed pages, so they aren't blocked by a login or robots.txt.
4. Submit a reconsideration request that explains the problem, what you changed and the result.
5. Wait. Google says reviews can take several days or weeks, and link-related requests can take longer.

If you bought the site and the problem came from a previous owner, say so in the request.

For unnatural links, Google recommends removing as many bad links as you can first. Only then should you use the disavow links tool for links you can't get removed. Google calls disavow an advanced feature that can harm your site if it's used incorrectly. It's not a routine monthly task.

For site reputation problems, the options include removing the content, adding a noindex rule to it, rewriting it as genuine first-party content, or moving it to a new domain. If you move it, don't redirect the old URLs, and use nofollow on any links to the new site. You still need to reply to the manual action and explain what you did.

If automated systems demoted you

Fix the problem and keep the site compliant. Google says improvements can be recognised "over a period of months" as its systems learn the site now follows the policies. There's one hard limit: after a link spam update, any benefit the spammy links once gave you "cannot be regained." Removing the links won't bring that boost back. Only better content and genuinely earned links will.

How can you check an agency won't put you at risk?

Ask before you sign, not after a traffic drop. A technical SEO audit should check the Manual actions and Security issues reports, and a reputable agency will explain exactly where its links come from. Our guide to fake SEO guarantees and the Academy lesson on proposal red flags cover the warning signs in a pitch. Our article on what an SEO contract should include explains how to write compliance with Google's policies into the agreement.

Spam policy checklist

Use this to review your own site or an agency's plan:

• Search Console is set up in your name, and the Manual actions report is clear.
• No links are bought, swapped in bulk or required by contract, unless they're marked sponsored or nofollow.
• Location and service pages each offer something unique, not just a swapped place name.
• Content isn't copied or lightly reworded from other sites.
• Any third-party content on your domain fits your site and isn't there to borrow its rankings.
• Any expired domain you've bought hosts new, original content related to its purpose.
• There are no hidden text, hidden links, cloaking or sneaky redirects.
• The agency can name its link sources and explain its content process.

Bottom line

Google's spam policies aren't obscure technical rules. They describe the shortcuts that can wipe out years of search visibility, and since 2024 they also cover mass-produced content, recycled expired domains and rented-out site sections. Keep your own Search Console access, ask any agency how it builds links and content, and walk away from anyone selling quick wins through paid links. If you want help that stays inside the rules, talk to ethical link building specialists, start with an independent SEO audit, or get matched with agencies that suit your business. You can also compare SEO agencies in Australia by services and reviews.