7 ways to avoid a Google penalty
**Originally written by Kathryn Marr of Blue Ivory Creative in 2021. Updated by David Bailey, 20th October 2026.**
Is your website falling foul of a Google penalty?
I get asked fairly often how to avoid a Google penalty, and there is always buzz about the "latest and greatest" ways Google will analyse your website.
It can all seem pretty overwhelming at times.
In reality, a few main things stand out when optimising your site. Google publishes them as its spam policies, and it enforces them in two ways, through automated systems and, where needed, through human reviewers who can issue a manual action against your site. Below are the most common causes of a Google penalty and how to avoid them.
1. Website security
Keep in mind that Google's goal is to give users the best available content for their search. All of its spam policies are designed with that goal in mind.
Website security is one of the big ones. Google doesn't want to send searchers to hacked websites, so if it thinks your site is hacked, it may label it "This site may be hacked" in search results or drop affected pages altogether.
How do you keep your site secure? Here are some of my top tips.
Use a strong username and password. Avoid usernames like "admin" or your website name, and make sure your password is a random mix of lowercase and capital letters, numbers and symbols. Turn on two-factor authentication wherever your platform offers it.
Keep your software up to date. Outdated software, themes and plugins make it easy for hackers to get in, so update whenever a new version is available.
Lock down your site. If someone tries to break in, make sure they get locked out, for example, after three incorrect password attempts.
Install a firewall. A firewall works like a gateway, tightening access to your website and protecting it. On WordPress, a security plugin can handle this. Hosted platforms such as Squarespace and Shopify manage most of this security for you.
What if you've been hacked? Hire someone to remove the malware and lock the site down, then check the Security issues report in Google Search Console and request a review once the site is clean. Services such as Sucuri can clean up a hacked site and monitor it to prevent future attacks.
2. Scaled content abuse
Keyword stuffing and hidden text were early SEO shortcuts, and some sites still use them.
Their modern equivalent is scaled content abuse. Introduced in 2024, this policy targets the production of large numbers of pages mainly to manipulate rankings rather than help people. It doesn't matter how the pages are made. AI, people or scraping all count. Google's examples include using generative AI to churn out many pages that add no value and stitching together content from other sites.
I have nothing against AI content, provided a person adds real input and experience.
Scaled content is a different matter, and much of the SEO community frowns on it as I do. You're far better off publishing three or four solid articles a month written from experience than 20 or more thin ones produced with AI. That approach also matches what Google looks for under E-E-A-T, and our approach to human and AI content production shows where AI helps and where it stops.
3. Unnatural links and manual actions
Links pointing to your site can earn you a penalty as surely as anything on it.
Google's link spam policy covers buying links, link schemes and optimised links dropped into forum comments, guest posts or press releases on other sites.
I've cleaned up the consequences myself. A client had built backlinks on a mums' forum, on pages trying to sell payday loans to new mothers, and received a manual action from Google. I used Ahrefs to find the links, then spent 13 weeks contacting site owners and removing more than a hundred backlinks by hand. For the links I couldn't get removed, I used Google's disavow tool, and only then requested a review.
That order matters.
Google's guidance on unnatural links asks you to make a good-faith effort to remove bad links first and to disavow only the ones you can't remove. It warns that disavowing everything without trying to remove links might lead it to reject your request. You'll find any manual action in the Manual actions report in Search Console, and reviews take from several days to several weeks, longer for link problems.
The safest link strategy is to earn coverage through digital PR and genuinely useful content, as our guides to content distribution and choosing a good SEO expert explain.
4. Doorway pages
These pages exist only to rank for keywords on Google.
Landing pages for specific purposes or topics are a great idea, as long as they give your visitors relevant content. Doorway pages are another common way websites get penalised by Google.
For example, avoid creating landing pages for a variety of locations (transportation in Denver, transportation in New York, transportation in Orlando) that are essentially the same content with only the location name changed.
Instead, give each page unique content, such as location-specific information or calls to action tailored to that offer. We followed exactly this rule when we retired our own city landing pages for places where we had no office.
5# Affiliate programmes
Affiliate links and programmes are a great way to earn a little extra money through your website. Make sure you use them correctly, though. Google's policy on thin affiliate content targets pages that copy product descriptions and reviews straight from the merchant with no original content or added value.
Here are a few things to keep in mind.
Make sure your site doesn't exist solely to sell affiliate products. Add your own content, such as a blog that provides useful information related to your products or services.
Don't copy content from the original website and paste it onto yours. Write your own, and add something the merchant's page lacks, such as your own experience of the product.
Add rel="sponsored" to your affiliate links. This tells Google the link is a paid or commercial one and that you're not trying to manipulate rankings. Google still accepts rel="nofollow" for this, however "sponsored" is the attribute it recommends for affiliate links.
Use affiliate links sparingly. Don't add them dozens of times to a single page. Use them where they make sense and serve a purpose.
The best test is to ask yourself why someone would visit your website rather than the original site. Give your visitors extra, unique value.
6. Outbound spam links
Linking to other websites with relevant content is a great way to add value for your visitors.
However, make sure the sites you link to are high quality. Avoid linking to spammy websites that offer little value, or sites filled with ads or malware.
Linking to a poor site once won't get you penalised. The risk today comes from three places.
Selling links. Google's link spam policy covers selling links as well as buying them. If someone pays for a link on your site, through a sponsored post or a paid guest article, mark it with rel="sponsored". Unmarked paid links can earn your site a manual action of its own.
Links your visitors add. Blog comments, forums and guest submissions attract spammers dropping links. Google's policy on user-generated spam covers this, so moderate what people post, mark their links with rel="ugc" and switch off comments you can't police.
Links that go bad. Domains expire and get bought up, sometimes by spammers who fill them with casino, payday loan or malware content. A link that was fine five years ago can now point somewhere you'd never recommend. Run a broken-and-outbound link check every few months, which Ahrefs' Site Audit makes easy.
That last point matters most for older blogs like ours, where hundreds of articles link out to sites that may have changed hands since we wrote them.
7. Duplicate content
Technically, duplicate content is not a Google penalty.
I've included it here because it can still hurt your rankings.
Google knows searchers don't want the same content shown repeatedly, so it consolidates duplicate pages and shows only one. Google may pick a page you don't want.
Make sure you set up appropriate redirects (301 redirects for http vs https and www vs non-www) and use canonical tags to tell Google which version you want shown.
This matters most during a redesign, and our guide to website migration SEO risk shows what happens when redirects go wrong.
Newer policies to know (update, 20th October 2026)
Google has added and widened several spam policies since this article was first written. These are the ones I'd watch most closely now.
Trying to manipulate AI search
Since May 2026, Google's spam policies explicitly cover AI Overviews and AI Mode.
Google now defines spam to include attempts to manipulate generative AI responses in Google Search. In other words, the tricks some people sell for getting brands into AI answers can now earn a penalty just like old-fashioned SEO spam.
Reported in-scope tactics include biased "best of" listicles that rank the author's own brand first, paid or coordinated brand mentions placed to influence AI citations, and mass-produced pages and doorway pages built as entry points into AI answers. Old tricks are also coming back in a new form. Some sites now hide text aimed at AI systems instead of people, which Google's hidden text policy already covers.
Google's own guide to optimising for generative AI search warned that searching the web for inauthentic mentions isn't as helpful as it might seem. My advice is the same as for SEO. Earn citations with genuinely useful, experience-based content, and measure them honestly, as our guides to answer engine optimisation for content teams and AI citation tracking explain.
Site reputation abuse and expired domains
Both arrived in 2024. Site reputation abuse involves third-party content published on a trusted site mainly to borrow its ranking signals, such as unrelated sponsored reviews hosted on an educational website. Expired domain abuse covers buying an old domain and filling it with low-value content to benefit from its past reputation.
Both rely on borrowed trust, and Google now treats both as spam.
| Problem | What it looks like | How to avoid or fix it |
|---|---|---|
| Hacked content | Injected pages, links or redirects you didn't add | Strong logins, updates and a firewall, then a review through the Security issues report |
| Scaled content abuse | Many thin pages, often AI-generated | Fewer, better articles with real experience |
| Link spam | Bought links, forum spam and link schemes | Remove bad links, disavow the rest, then request a review |
| Doorway pages | Near-identical pages for each location or keyword | Give every page unique, useful content, or merge them |
| Thin affiliation | Copied merchant descriptions with affiliate links | Add original content and use rel="sponsored" |
| Outbound spam links | Selling unmarked links, spam comments or links to sites that have gone bad | rel="sponsored" and rel="ugc", moderation and regular link audits |
| Duplicate content | The same content on several URLs | 301 redirects and canonical tags |
| AI search manipulation | Self-promoting listicles, bought mentions or hidden text aimed at AI | Earn citations with useful content and genuine coverage |
| Site reputation and expired domain abuse | Borrowing another site's or an old domain's trust | Build your own authority over time |
Final thoughts
It is a good idea to keep in mind which actions could lead to a Google penalty when building and maintaining your website.
However, if you keep the user experience front and centre and avoid trying to "trick" Google into ranking your website higher, you'll be fine.
And if your rankings suddenly drop, don't assume the worst straight away.
Check the Manual actions report in Search Console first, because rank trackers can now report drops that never happened. If you need help with a penalty or a clean-up, our SEO team can help. We also build sites that start clean with our web design team, create content worth linking to through our content writing service, and keep traffic flowing with paid search and social media while organic rankings recover. Our guide to crafting a strong SEO strategy shows how it all fits together.
-
Check the Manual actions report and the Security issues report in Google Search Console, where Google also messages you about any problem it finds. If both are clear, you don’t have a manual penalty. A drop could still come from Google’s automated systems, such as a core or spam update, which never send a notice, or from a technical issue, stronger competitors or bad rank tracking data.
-
It depends on the problem and how thoroughly you fix it. Google says most reviews take several days or weeks, and link problems take longer. Removing more than a hundred bad links for one client took me 13 weeks before we could request a review.
-
Not because AI wrote it. Google targets content made at scale to manipulate rankings, however it's produced. AI content with real human input, accurate facts and first-hand experience is fine.
-
Only after trying to remove them. Google asks for a good-faith effort to get bad links taken down first, and suggests using the disavow tool for the links you can't remove, especially when you're dealing with a manual action.
About the authors
David Bailey is the CEO and founder of Blu Mint, an SEO, AI search and content marketing agency based in Tallinn, Estonia, working with scale-up and enterprise clients across the US and Europe. He has worked in SEO for more than 12 years, from technical audits and penalty recovery to content programmes for software companies. He updated this article in October 2026 to reflect Google's current spam policies and his experience recovering a client from a manual action.
Kathryn Marr wrote the original version of this article as a guest contributor. She is co-founder and Chief Creative Officer of Blue Ivory Creative, based in Nashville, Tennessee.
