Penalty Recovery

Before you do anything else: most ranking drops are not penalties. They're often competitive shifts (someone else improved), recalibrations from a core update, or technical problems you caused yourself. Treating a competitive drop as a penalty and filing a reconsideration request wastes time and looks uninformed.

Getting the diagnosis right is the entire job in the first 30 minutes.

Step 1: Rule out a manual action immediately#

Go to Search Console → Security & Manual Actions → Manual actions.

If there's a notice there, a human reviewer at Google has confirmed a violation, and the notice names the issue and the affected scope (whole site or partial). Go to the fix section below.

If the screen shows "No issues detected", you do not have a manual action. A reconsideration request will not help. Your drop has an algorithmic, technical or competitive cause.

Also check Security issues (hacked content and malware hurt rankings and trigger browser warnings) and the Page indexing report (an accidental noindex or robots.txt block can look exactly like a penalty).

Step 2: Match the date to a confirmed update#

Cross-reference your Search Console chart with the Google Search Status Dashboard, which lists every announced ranking update with start and end times. A sharp drop that lands during a confirmed rollout is very likely algorithmic.

Confirmed updates from 2025 to early October 2026:

There were no separate helpful content, reviews or link spam updates in this period: the helpful content system has been part of core ranking since March 2024. Re-check the dashboard before you act, and see Algorithm Updates for the longer history.

Google recommends waiting at least a full week after a core update completes before analysing, then comparing a week after with a week before the rollout started (Google).

A gradual drift over weeks or months without a clear date correlation is usually competitive or a result of content decay: someone else got better, or your pages got stale (Content Refresh & Decay).

Step 3: Identify what moved#

In Search Console, compare equal date ranges before and after the drop. Ask:

• Did traffic drop site-wide, or in specific sections?
• Which queries and pages lost the most clicks? Were they branded or non-branded (use the branded queries filter if your property has it)?
• Is it concentrated on one content template?
• Did it happen in Web, Image, Video or News results, or in Discover? Google suggests analysing search types separately.

A site-wide crash suggests a site-wide quality or technical issue. A section-specific drop suggests that topic cluster or template was affected. A single-page drop usually means a page-level crawl, index or competition issue.

Manual actions: types and fixes#

Each manual action notice names the specific violation. The common ones in the Manual actions report:

Site reputation policy and the EEA split#

What used to be called "site reputation abuse" is now the site reputation policy. It applies when third-party content (freelancers, white-label services, partners) is published on a host site mainly because of that host's established ranking signals. Coupon sections integrated into a publisher's own site and authored freelance content are generally fine; an unauthored, unintegrated affiliate section about an unrelated topic is the classic violation.

Google changed enforcement on 2026-08-30, following discussion with the European Commission (Google):

• Outside the European Economic Area, a manual action "will directly affect search results for the portion of the site affected. As before, the rest of the site won't be affected."
• Inside the EEA, "the impact of the manual action won't apply. The affected section of the site may be separated in our systems so that, over time, it ranks independently from the rest of the site." Google also lifted earlier EEA manual actions under this policy.
• Notices still arrive in Search Console, and eligible sites can take disputes to mediation after a reconsideration request.

It's the first Google spam policy enforced differently depending on where the searcher is, so a section can look fine from Berlin and be demoted in New York. Check rankings from more than one country.

Back button hijacking#

Google announced back button hijacking as an explicit "malicious practices" violation on 2026-04-13 and began enforcing it on 2026-06-15: "Pages that are engaging in back button hijacking may be subject to manual spam actions or automated demotions" (Google). Google notes it "may originate from the site's included libraries or advertising platform", so audit third-party scripts and ad settings (trade press reported cases involving ad vignette settings), not just your own code. Test it yourself: arrive on a page from search, press Back, and confirm you land on the results page.

Spam reports can now lead to manual actions#

Since 2026-04-14 Google's spam report documentation says it may use reports to take manual action, and that if it does, it sends what the reporter wrote to the site owner verbatim. A 2026-04-23 clarification says reports containing personally identifying information won't be processed (Google). Practically: competitors' reports carry more weight than before, so violations you thought nobody would notice are riskier.

The disavow file#

When a manual action is for unnatural links to your site and you can't get them removed at the source, you can ask Google to ignore them:

# Link network domains
domain:linkfarm-network.com
domain:pbn-links.example.net
 
# Specific URLs
https://spammy-site.com/page-with-link-to-you

Upload it in the separate Disavow links tool (it isn't linked from the Links report). Plain UTF-8 or 7-bit ASCII text, one entry per line, and each upload replaces the previous file (help).

Writing a reconsideration request that works#

Reconsideration requests are only for manual actions. Don't file one for an algorithmic drop.

Before you write anything:

1. Fix every instance of the issue cited, not a sample
2. Document your fixes specifically (which URLs, what changed, screenshots where helpful)
3. Understand why it happened, so you can explain what prevents recurrence

Submit it from the manual action notice (Request review). Write it like a professional explaining a resolved issue to a regulator, not like someone protesting their innocence:

• Acknowledge the issue clearly (don't argue with the diagnosis)
• List exactly what you fixed, with specifics and examples
• Explain what caused the issue and what's now in place to prevent it
• Mention the disavow file if you uploaded one, and the outreach you did first

Google says most reconsideration reviews "can take several days or weeks", and link-related requests may take longer. Requests that argue "we didn't violate the guidelines" rarely succeed; requests that say "here is specifically what was wrong and here is exactly what we did about it" give the reviewer what they need. For site reputation actions, EEA sites get a committed shorter turnaround and the option of mediation.

Algorithmic recovery: the harder road#

Drops from core updates or spam updates have no form to submit. Recovery happens through actual improvement.

The path:

1. Diagnose honestly: which content didn't deserve to rank? Use Google's self-assessment questions on helpful, reliable, people-first content and ask someone unaffiliated with the site to review it too.
2. Fix the underlying issues: improve or consolidate weak pages, remove pages made for search engines first, clean up link schemes. Google calls deleting content "a last resort" for content that can't be salvaged. See Content Pruning and AI-Assisted Content Without Penalties.
3. Avoid quick fixes: Google warns against "quick fix" changes like removing a page element because you heard it was bad for SEO.
4. Give it time, but don't just wait for the next named update. Google says some changes take effect in days, but "it could take several months for our systems to learn and confirm that the site as a whole is now producing helpful, reliable, people-first content". Since December 2025 its core updates doc also says you "don't necessarily have to wait for a major core update", because Google makes "smaller core updates" that "are not announced because they aren't widely noticeable" (Google). Recovery can show up gradually between announced updates, at the next core update, or not at all if the gap to competitors remains.

For spam updates, recovery follows removing the violation; systems need time to re-crawl and reprocess the site. In September 2026 John Mueller said low-value programmatic pages can leave Google's systems having "lost faith in your site providing good value to users based on the old pages", and rebuilding that trust is slow.

The most common mistake: publishing new content on top of the same weak foundation. Google's guidance is about your site as a whole, so fix the average first.

AI answers are covered too#

Since 2026-05-15 Google's spam definition explicitly includes "attempting to manipulate generative AI responses in Google Search". Tactics aimed at AI Overviews and AI Mode (manufactured mentions, pages for every fan-out query, hidden instructions to LLMs) can trigger the same spam actions as classic ranking manipulation. See GEO for what's legitimate.

Negative SEO: when someone targets you#

Negative SEO is a competitor or bad actor deliberately building toxic backlinks to your site, scraping your content, or filing false reports.

Signs you might be targeted:

• A sudden spike of low-quality referring domains in Ahrefs or Semrush
• New links from irrelevant, foreign-language, or adult or gambling sites at volume
• Suspicious anchor text patterns (pharmacy spam is classic)

Response:

1. Monitor links (Ahrefs, Semrush, Search Console's Links report) so you notice early
2. Document the pattern (dates, domains, volume)
3. Don't panic-disavow. Google is generally good at ignoring obvious spam links; consider disavowing only if the pattern is large, clearly manipulative and you see a manual action or a matching drop
4. If a manual action does arrive, reference your documentation in the reconsideration request

The more effective negative SEO these days is content scraping. Publish on your own site first, keep internal links and sitemaps current so Google discovers new pages quickly, use clear dates and bylines, and build enough authority that Google's confidence in your origination is high.

Related: Link Building & E-E-A-T for building a link profile that holds up under scrutiny, and Algorithm Updates for what each major update has historically targeted.

Next module: AEO, answer engine optimization.