Google spam policies for business websites

Google lists the practices it treats as search spam, and sites that use them can rank lower or drop out of results. This guide goes through each policy, the exceptions Google names, the ones business websites most often run into, and what happens after a violation.

This guide is built from Google Search Central: Spam policies for Google web search (last updated 28 August 2026), Updating our site reputation abuse policy (19 November 2024), Google Search spam updates and your site, Qualify your outbound links to Google, Prevent user-generated spam on your site and platform and Report spam, phishing, or malware. Checked on 10 November 2026. Where we add our own view, we say so.

What a manual action looks like in Search Console, and how to fix one and write the reconsideration request, is in our manual actions guide. What Google means by people-first content is in our helpful content guide. This page is about the rules themselves: what each spam policy covers, what Google says is allowed, and what happens to a site that breaks them.

In this guide

What Google counts as spam
Every spam policy in one table
The policies business sites run into
Site reputation abuse in detail
Paid links that are allowed
How violations are handled
A quick check of your own site
FAQ

What Google counts as spam

Google defines spam as "techniques used to deceive users or manipulate our Search systems into featuring content prominently", which includes "attempting to manipulate generative AI responses in Google Search". To be eligible for web search results, content must not break Google Search's overall policies or the spam policies. Google says these apply "to all web search results, including those from Google's own properties".

Detection runs "through automated systems and, as needed, human review that can result in a manual action". The outcome is the same either way: "Sites that violate our policies may rank lower in results or not appear in results at all." The list is not closed. Google says it "may act against any type of spam practices we detect", not only those it names.

Every spam policy in one table

These are the policies on Google's page, in its order, with the cases Google itself says are not a violation.

Policy	What Google means	What Google says is fine
Cloaking	Showing search engines different content from users, to manipulate rankings and mislead users.	A paywall, if Google can see the full content like any person with access and you follow its Flexible Sampling guidance.
Doorway abuse	Sites or pages made to rank for similar queries that lead users to less useful intermediate pages, such as many region or city pages that funnel to one page.	No exceptions listed.
Expired domain abuse	Buying an expired domain and reusing it mainly to rank low-value content, such as casino content on a former school site.	No exceptions listed.
Hacked content	Content placed on a site without permission through security holes: injected code, pages, hidden content or redirects.	Not applicable: the owner is the victim, and Google points to its help on fixing hacked sites.
Hidden text and link abuse	Text or links hidden from people to manipulate search engines: white text on white, text behind an image, off-screen CSS, font size or opacity 0.	Accordions and tabs, sliders, tooltips, and text only for screen readers.
Keyword stuffing	Filling a page with keywords or numbers, such as lists of phone numbers or blocks of cities and regions the page wants to rank for.	No exceptions listed.
Link spam	Links made mainly to manipulate rankings: bought or swapped links, links required by contract, optimized anchors in guest posts or press releases, widget and footer links.	Paid and sponsored links marked with rel="nofollow" or rel="sponsored".
Machine-generated traffic	Sending automated queries to Google, including scraping results for rank checking, without express permission.	No exceptions listed.
Malicious practices	Malware, unwanted software, and back button hijacking.	No exceptions listed.
Misleading functionality	Sites that promise a tool or service, such as a PDF merger, but lead users to deceptive ads instead.	No exceptions listed.
Scaled content abuse	Many pages generated mainly to manipulate rankings, "no matter how it's created", including by generative AI, scraping or stitching content together.	Google's advice for such content already on your site: exclude it from Search.
Scraping	Republishing other sites' content, or slightly altered copies, without adding value.	No exceptions listed.
Site reputation abuse	Third-party content hosted mainly to borrow the host site's ranking signals.	Wire services, syndicated news, forums and comments, editorial columns, advertorials meant for readers, properly marked affiliate links and ad units.
Sneaky redirects	Redirects meant to show users and search engines different content, or unexpected content, such as sending mobile users to a spam domain.	Moving to a new address, merging pages, sending logged-in users to an internal page.
Thin affiliation	Affiliate pages with descriptions and reviews copied from the merchant and nothing added.	Affiliate pages with original reviews, testing, ratings, price information and comparisons.
User-generated spam	Spam added by users through comments, forums, sign-ups or file uploads, often without the owner knowing.	Not applicable: Google points to its tips on preventing abuse.

The policies business sites run into

Our view, from the sites we build and maintain: very few business owners set out to spam Google. The problems usually come from a tactic someone sold them, or from a site that was not looked after. These are the ones we see the most, matched to Google's wording.

City and area pages. Google's doorway examples include "multiple domain names or pages targeted at specific regions or cities that funnel users to one page", and its keyword stuffing examples include "blocks of text that list cities and regions that a web page is trying to rank for". A page per area you serve is fine when each one has something real to say; our service area pages guide covers how to write them.
Bought links. Paying for links, swapping goods or services for links, "excessive link exchanges", and "links with optimized anchor text in articles, guest posts, or press releases distributed on other sites" are all link spam in Google's list. So are "widely distributed links in the footers or templates of various sites".
Mass-produced pages. Using "generative AI tools or other similar tools to generate many pages without adding value for users" is Google's first example of scaled content abuse. The tool is not the issue; the volume without value is.
A hacked or unwatched site. Hacked content and user-generated spam happen to the owner rather than being done by them, but the pages still count. Google notes that hackers often use cloaking "to make the hack harder for the site owner to detect". Our website security guide, Security issues report guide and form spam guide cover prevention.
An expired domain bought for its history. Buying an old domain is not banned. Reusing it "primarily to manipulate search rankings by hosting content that provides little to no value to users" is.

Site reputation abuse in detail

The policy applies "where third-party content is published on a host site mainly because of that host's already-established ranking signals". Third-party content is content from anyone separate from the host: users, freelancers, white-label services, people the site does not employ. Having it "isn't inconsistent with the site reputation policy" on its own. Google's examples of abuse are an educational site hosting sponsored payday loan reviews that the same third party sends to other sites, and a medical site hosting a "best casinos" page that is not integrated with the site.

In its November 2024 update Google said its review of cases "has shown that no amount of first-party involvement alters the fundamental third-party nature of the content", and that it does not "simply take a site's claims about how the content was produced at face value".

When a human review happens, Google looks at how far the host controls the content. The factors it lists are:

presentation: whether design, formatting, typography and UX match the host domain;
quality: whether the page has problems the main domain does not;
authorship: whether someone is named as owning or responsible for the content;
duplication: whether the same or near-identical content appears on other sites.

Google says "not one of these factors is either necessary or sufficient on its own". Its worked examples point the same way: an integrated, clearly disclosed coupons section is unlikely to see action; an unauthored affiliate article copied from a marketplace and unreachable from the site's menus is likely to.

The result depends on where the searcher is. Outside the European Economic Area, the pages may get a manual action. Within the EEA, they "may be categorized as separate from the main domain but won't be subject to the impact of manual action", so they rank on their own merits. Our manual actions guide covers the notification and reconsideration side.

Our view for a business site: if you publish partner or sponsored content, put a name on it, keep it in your own design and on your subject, link it from your own pages, and do not accept text that is also being placed on other sites.

Paid links that are allowed

Google says "buying and selling links is a normal part of the economy of the web for advertising and sponsorship purposes", and that having such links is not a violation "as long as they are qualified" with rel="nofollow" or rel="sponsored". Its outbound links page says to mark "advertisements or paid placements" with sponsored, that nofollow is "still an acceptable way to flag them, though sponsored is preferred", and to mark links in comments and forum posts with ugc. Google's page on user-generated spam also suggests nofollow or ugc on "all links in untrusted content".

For links within your own site, the internal linking guide applies, not these attributes. Which outbound links need each value, including affiliate links and guest posts, is in our nofollow, sponsored and ugc guide.

How violations are handled

Automated systems. Google's spam updates page names SpamBrain as its "AI-based spam-prevention system" and says notable improvements are announced as spam updates. A site hit by one should review the policies; changes "may help a site improve if our automated systems learn over a period of months that the site complies". For link spam updates the page is blunter: once the systems remove the effect of spammy links, "any ranking benefit the links may have previously generated for your site is lost" and "cannot be regained". Spam updates often run close to core updates, so check which one a drop lines up with; our core updates guide shows how.

Manual actions. Human review can lead to a manual action shown in Search Console, with a reconsideration request once you have fixed it. That process is in our manual actions guide.

Other demotions. Google's page lists practices outside the main policies that can still lower a site:

a significant volume of valid copyright removal requests, and similar signals for defamation, counterfeit goods and court-ordered removals;
exploitative personal information removal practices, doxxing and non-consensual explicit imagery;
policy circumvention, such as moving content to new subdomains, subdirectories or sites "with the intention of continuing to violate our policies", which can lead to broader action and loss of features such as Top Stories and Discover;
scam and fraud, such as impersonating a business or posing as its official customer support.

Reporting spam. Anyone can report a site through Google's spam report form. Google says it "may use your report to take manual action", and that it must send the submission text to the site owner if a manual action is issued, so it will not process a report that contains personal information.

A quick check of your own site

Our checklist, not Google's, for a business owner or a new agency taking over a site:

Open Search Console's Manual actions and Security issues reports. Both should say no issues detected.
Ask any SEO supplier, in writing, whether they have bought links, placed guest posts or press releases with keyword anchors, or added footer links for you.
Look at your area or service pages side by side. If they differ only by the town name, merge or rewrite them.
Check that sponsored or partner pages are labelled, written for your readers and not copied from elsewhere.
Search Google for site:yourdomain.com and look for pages you did not create, a common sign of a hack.
Make sure comment and form fields are moderated or protected, and links in them carry ugc or nofollow.

FAQ

Is AI-generated content against Google's spam policies?

Not by itself. Scaled content abuse covers many pages made mainly to manipulate rankings, "no matter how it's created". Google's first example is using generative AI tools to generate many pages without adding value for users.

What is site reputation abuse?

Third-party content published on a site mainly to benefit from that site's ranking signals, such as an unrelated sponsored casino or payday loan page on a trusted site. Third-party content alone is not a violation; Google looks at presentation, quality, authorship and whether the same content is on other sites.

Are location pages doorway pages?

They can be. Google's doorway examples include pages targeted at specific regions or cities that funnel users to one page, and "substantially similar pages". Area pages with real, local information for each place are a different thing from copies that only swap the town name.

Can I still sell or buy sponsored links?

Yes, if the links are qualified. Google says paid links are not a violation when they carry rel="sponsored" or rel="nofollow". Sponsored is preferred. Paid links that pass ranking credit are link spam.

Will fixing a spam problem bring rankings back?

For automated actions, Google says changes may help "over a period of months" once its systems learn the site complies. For link spam, any benefit the spammy links once gave is lost and cannot be regained. A manual action also needs a reconsideration request once the problem is fixed.

Need a site built or looked after without shortcuts like these? See our website development and website maintenance services, all our services, or the rest of our guides.