Is It a Negative SEO Attack, or Is It Something You Did?

A negative SEO attack is a deliberate attempt to hurt a competitor’s rankings with spam links, fake reviews, bogus copyright notices or hacking. They do happen. But most drops blamed on an attack turn out to be something else. A core update. A site change. Or links you built yourself.

I’ve been on the cleanup side of this more times than I’d like. When someone tells me they’re under attack, I don’t start with their backlinks. I start with the date the traffic fell. More often than not, the calendar explains more than the link report does.

What Counts as a Negative SEO Attack

The term covers more than spam links, even though links get all the attention. Broadly, someone outside your business tries to make Google, or your customers, trust you less. The common versions look like this:

• ➜ Thousands of spam links pointed at your site, often with adult or gambling anchors.
• ➜ Fake one-star reviews dumped on your Google Business Profile.
• ➜ False copyright (DMCA) complaints filed to get your pages removed from search.
• ➜ Hacking your site to inject spam pages or hidden links.
• ➜ Scraping your content and republishing it elsewhere.
• ➜ Fake emails to site owners asking them to remove your good links.

Why Most Suspected Attacks Aren’t Attacks

Here’s the uncomfortable bit. When rankings fall, a wave of strange new backlinks is the easiest thing to label a negative SEO attack, because it’s visible and it’s someone else’s fault. But spam links show up on almost every site, attack or not. Seeing them in a tool proves very little.

Google has been fairly direct about this. When asked whether a wave of spam links could affect rankings during a core update, John Mueller said core updates build on longer-term data. Something really recent wouldn’t play a role. He couldn’t even think of how those links would come into it.

So what usually explains the drop? In my experience, it’s one of a handful of boring causes. None of them involve a competitor. All of them are easy to miss when you’re already convinced someone is out to get you:

• ➜ A Google core or spam update that rolled out the same week.
• ➜ A site change: a redesign, a migration, a stray noindex tag or blocked pages.
• ➜ Lost backlinks, often from sites that removed old articles.
• ➜ Seasonality, or a slow month the year before that you’ve forgotten.
• ➜ AI Overviews or other search features taking clicks from the same rankings.
• ➜ Links you or a previous agency built, now being discounted.

How to Check Before You Panic

Work through these in order. Most investigations end at step two or three, long before anyone needs to look at a disavow file. Write down the exact date your traffic started falling before you begin, because almost every check depends on it.

Step one: open Search Console. Check the Manual Actions report, then Security Issues. Clean on both? Good. That rules out the two things that need urgent action. If there’s an unnatural links manual action, that’s a different job entirely, attack or not.

Step two: compare your drop date with Google’s Search Status Dashboard, which lists confirmed ranking updates and incidents. If a core update started within a day or two of your decline, that’s your most likely explanation. Read what that update targeted before you look anywhere else.

Step three: check what changed on your own site. Look at the Page indexing report, recent deploys and any plugin or theme updates. Run a crawl for broken links and redirect chains as well. A single template change can quietly knock out hundreds of pages.

Step four: look at which pages dropped. All of them? That points to an update or a technical problem. Just a handful? Usually it’s content, shifting intent, or a competitor simply doing better. Attacks rarely single out your third-best category page.

Step five: only now, look at the links. When did the spike start? If the spam arrived after your traffic fell, it can’t have caused it. Simple as that. And links that sat there for months before anything moved are probably being ignored already.

The Attacks That Can Actually Hurt

None of this means attacks are a myth. A few really do cause damage, and they have one thing in common. They don’t rely on Google misreading your link profile. They exploit a process or a weakness that Google has to respect.

Fake DMCA Takedowns

This one is real and documented. In 2023, Google sued two men who allegedly used at least 65 accounts to send fraudulent DMCA notices against more than 117,000 competitor URLs. Google removes pages when it gets a valid-looking notice, then sorts out disputes afterwards.

It even happens to SEO publishers. In March 2026, a Search Engine Land article was removed from Google after a copyright complaint that the publication called false. It came back within days. If your URLs disappear, check Search Console and file a counter-notice.

Hacking and Injected Spam

A compromised site is the attack with the biggest impact. Hackers add spam pages, cloaked links or redirects that only Googlebot sees. Search site:yourdomain.com with words like casino or pills, and scan your own pages with a link analyzer for outbound links nobody on your team added.

Fake Review Attacks

Review bombing can hurt local businesses fast. Google has written about a sudden spike in 1-star reviews on a Missouri bar, where it temporarily disabled ratings and removed the policy-violating reviews. If it happens to you, report the reviews and contact Business Profile support quickly.

Spam Link Floods

The classic version. Also the least effective. Google’s systems are built to ignore links you didn’t ask for. If you’re still worried, read our guide to toxic backlinks first. A targeted disavow of an obvious spam batch is reasonable. A panicked one is how good links get cut.

If You Really Are Being Targeted

If it’s a genuine negative SEO attack, keep a dated log of everything: screenshots, link exports, review timestamps and copies of any DMCA notices. Fix security issues first, because a hacked site is an emergency and everything else can wait a day. Then deal with each attack through its own channel.

That means counter-notices for DMCA removals, review reports for fake reviews, and a careful look at links only if there’s a real pattern. Set up backlink monitoring with whichever tool you already use, so the next spike gets spotted in days rather than months.

If you’d rather have someone else do the digging, a proper backlink audit will separate links that need action from the noise every site collects. Either way, don’t make big changes to the site while you’re still guessing at the cause.

FAQs