Negative SEO Defense

Negative SEO is when a third party deliberately points spam, scraped content, or fake review attacks at your domain to trigger algorithmic or manual penalties. Most attacks fail because Google’s link spam systems discount obvious garbage automatically. Some land — typically on sites with thin existing profiles, recent ranking instability, or industries where competitive sabotage is common (gambling, supplements, payday loans, escort, locksmiths). Defense is a workflow, not a one-time setup.

TL;DR

Most negative SEO is wasted effort. Google has discounted toxic incoming links rather than penalizing the target since the 2014 link spam update. Defensive monitoring still matters because edge cases land.
The disavow file is a precision tool, not a vacuum cleaner. Wrong-disavowing legitimate links costs more than ignoring toxic ones. Use disavow only when you have evidence of attack patterns Google might not catch.
Monitoring is the real defense. Set up Ahrefs Alerts + GSC Links report + a weekly anomaly check. Catching an attack in week 1 is a 30-minute fix; catching it after a manual action is a 6-month recovery.

The mental model

Negative SEO is vandalism. The attacker cannot directly hurt you — they can only convince a referee that you cheated. The referee (Google’s classifier) is mostly able to tell the difference between graffiti someone sprayed on your wall and graffiti you painted yourself.

The defense model has three layers, mirroring the offense:

The detection layer monitors your inbound links, branded search anomalies, scraped content republishing, and review platforms in real time so you spot an attack within days.

The discount layer is Google’s automated systems, which already devalue most spam. Your job is to confirm they did, not to add disavow entries reflexively.

The action layer is the disavow file plus active outreach to remove the worst attack-source links — used sparingly, because the disavow file has its own cost (Google’s documented preference is for genuine link removal first).

Deep dive: the 2026 reality

Common attack vectors

Attack	What it looks like	Detection
Toxic-link spam	1,000s of low-quality links with commercial anchors appearing in days	Ahrefs Backlinks new + velocity charts
Anchor text poisoning	Surge of one specific exact-match anchor text	Ahrefs Anchors > new anchors, last 30 days
Scraped content republishing	Your articles republished verbatim on spam sites	Copyscape, Google site: searches
Fake review bombing	50+ 1-star reviews appearing in 48 hours	Google Business Profile, G2, Trustpilot dashboards
Hacked-page injection	Cloaked pages or hidden links inserted into your site	GSC Manual actions, Sucuri scans
Fake DMCA takedowns	Bogus DMCA filed against you to remove ranking pages	Lumen Database, GSC Removals report
Branded SERP hijacking	Spam sites bidding on or ranking for your brand name	Branded SERP review weekly
CTR manipulation	Bot traffic clicking and bouncing on your SERP listings	GSC anomalous CTR drops with stable impressions

The monitoring stack

Minimum 2026 setup for any site over $100K/year in organic value:

monitoring:
  link_alerts:
    primary: ahrefs-alerts (new backlinks, weekly digest)
    backup: gsc-links-report (monthly review)
    velocity_threshold: > 50 new referring domains in 7 days
  brand_monitoring:
    tool: brand24 OR google-alerts
    queries:
      - '"acme"'
      - '"acme.com"'
      - 'site:acme.com inurl:/wp-admin'
      - 'site:acme.com pharmacy OR casino OR loans'
  content_scraping:
    tool: copyscape-batch-search OR plagiarism-checker-x
    frequency: weekly
  reviews:
    platforms: [google, g2, trustpilot, capterra]
    alert_on: > 3 1-star in 24 hours
  serp_monitoring:
    tool: stat-search-analytics OR semrush-position-tracking
    keywords: top-50-revenue-driving

Identifying toxic backlinks

Use multiple indicators, never one alone. A link with one of these signals might be fine. A link with five is likely an attack.

Indicator	Threshold
Domain Rating	< 5
Trust Flow	< 5 with Citation Flow > 20
Anchor text	exact-match commercial mismatch with your topic
TLD pattern	bulk on `.cn`, `.ru`, `.tk`, `.ml` when not your market
Page topic	unrelated to your industry
Link context	sitewide link in footer or sidebar
Content quality	gibberish, scraped, or auto-generated
Outbound links per page	> 100 to unrelated commercial sites
Hosting	known PBN provider
Velocity	hundreds of new domains in days

Toxic link audit query in Ahrefs:

Backlinks > Filters:
  - Link type: dofollow
  - Domain Rating: 0-10
  - Anchor: contains [your top commercial keyword]
  - First seen: last 90 days

If that filter returns more than 100 results that you did not earn, you have an attack signal.

Disavow file syntax

Google’s disavow tool accepts a plain-text file with one entry per line. Comments start with #. Domain entries use domain: prefix.

# Disavow file for acme.com
# Last updated 2026-04-15
# Total: 42 domains, 3 specific URLs

# Pharmacy spam network detected 2026-03-22
domain:cheappills-spam.tk
domain:viagra-discount.ml
domain:meds-online-rx.cn

# Casino spam attack 2026-04-01
domain:casino-bonus-code.xyz
domain:slots-free-play.top

# One-off toxic placement, not a network
http://example.com/spam-page

Submission: Search Console > Disavow links tool (search.google.com/search-console/disavow-links-data) > select property > upload file. Replaces the previous file. There is no append.

File size limit: 100,000 lines, 2 MB.

Critical pitfalls:

Disavowing a clean domain by mistake is reversible (re-upload without it) but can take 60-90 days to recover equity.
Once you upload a file, Google does not confirm it processed each line. Verify by checking link counts in Ahrefs vs GSC over 90 days.
Disavow is not removal. Google still sees the link; it just stops counting it as a vote. The link stays in third-party tools.

When to disavow vs. when to ignore

Situation	Action
50 new low-DR links from one network in a week	Disavow domain entries
200 links from forum signatures over 6 months	Likely auto-discounted, ignore
5,000 spam links, no manual action, traffic stable	Ignore, document the audit
500 spam links plus traffic drop matching the spike	Disavow, monitor 60 days
Manual action: “unnatural links to your site”	Disavow + reconsideration request
Manual action: site cannot prove unnaturalness	Outreach for removal first, disavow second

The bias is toward not disavowing. John Mueller has said publicly several times that most disavow files are unnecessary. Disavow when you have evidence of attack and matching traffic impact.

Recovery from a manual action

If GSC shows a manual action:

Document everything. Screenshot the manual action page and full message text.
Audit links thoroughly. Pull from Ahrefs, Semrush, Majestic, GSC, and Google’s external links export. Deduplicate. Tag each as “natural / questionable / toxic”.
Attempt removal first. Email site owners requesting removal. Document each request — Google wants to see you tried.
Disavow what cannot be removed. Upload disavow file with the rationale documented in comments.
File reconsideration request. GSC > Manual actions > Request review. Be specific about what you found, what you removed, and what you disavowed.

Subject: Reconsideration request — acme.com — unnatural links to site

Hello Search Quality team,

We received a manual action on 2026-03-15 for "Unnatural links to
your site." We took the following actions:

1. Audited 4,127 referring domains across Ahrefs, GSC, and Majestic.
2. Identified 213 domains as part of two link-spam networks
   (pharmacy + casino), traced via shared IP class and identical
   placement templates.
3. Contacted 213 domain owners requesting removal. Documentation
   in attached spreadsheet (timestamps + responses).
4. 47 domains complied with removal requests.
5. Uploaded a disavow file covering the remaining 166 domains
   (file submitted 2026-04-02, attached for reference).
6. Reviewed historical campaigns; no internal link-buying activity
   was found. The network appears to be third-party (negative SEO).

We have implemented monitoring to detect future link spam attacks
within 7 days. Documentation: [link to internal monitoring policy].

Please reconsider the action. Thank you.

Maria Chen
Head of SEO, Acme

Reconsideration outcomes typically take 2-4 weeks. First responses are often “more work needed” — that is normal. Iterate.

Visualizing it

flowchart TD
  A[Monitoring stack runs continuously] --> B{Anomaly detected?}
  B -->|No| A
  B -->|Yes| C[Triage signal type]
  C --> D[Toxic links spike]
  C --> E[Fake reviews]
  C --> F[Scraped content]
  C --> G[SERP CTR anomaly]
  D --> H{Traffic impact?}
  H -->|Stable| I[Document and ignore - auto-discount]
  H -->|Drop matching spike| J[Audit + outreach for removal]
  J --> K[Disavow remaining toxic domains]
  K --> L[Monitor 60 days]
  L --> M{Recovered?}
  M -->|Yes| A
  M -->|No| N[Reconsideration request if manual action]
  N --> O[Recovery 6-12 months]

Bad vs. expert

The bad approach

A site owner sees rankings drop 30%. They panic, run SEMrush Backlink Audit, and accept every flagged link as “toxic”. The audit produces a 1,847-domain disavow file in 20 minutes. They paste it into Google Disavow Tool and click submit:

domain:wikipedia.org
domain:reddit.com
domain:medium.com
domain:linkedin.com
[... 1,843 more entries, including legitimate referring domains ...]

Six months later traffic is down another 40%. The owner cannot understand why. The reason: SEMrush flagged any DR < 20 link, including dozens of niche industry blogs that were genuine editorial wins. Google honored the disavow file and stopped counting their equity.

This fails because automated “toxicity scores” treat any low-DR link as suspect, but most low-DR links are real. Disavowing legitimate links removes equity without removing penalty risk — strictly downside.

The expert approach

Same scenario. The team starts with diagnosis, not action:

Step 1: Pull GSC Performance > 12-month trend
Step 2: Identify exact week traffic dropped
Step 3: Cross-reference with: GSC Links report, Ahrefs new backlinks,
        algorithm update calendar (search-engine-roundtable.com),
        site changes log
Step 4: Determine: link attack, algorithm hit, on-page change, or
        coincidence

Diagnosis: traffic dropped the week of the Helpful Content update, not the week of any link spike. Existing referring domains are unchanged. The problem is content quality, not links. They skip the disavow entirely and rebuild their thin programmatic pages (Module 18). Three months later, traffic recovers to 95% of pre-drop.

Counter-scenario where disavow is correct: traffic drops match a 2,000-domain link spike, anchor text is dominated by cheap viagra, source IPs cluster on three providers. Audit confirms attack, outreach removes 80, disavow handles 1,920. Recovery in 90 days.

This works because the diagnosis identifies the actual cause before action is taken. Disavow is used surgically, not as a panic response.

Do this today

Open Google Search Console > Security & Manual Actions > Manual actions. If clean, screenshot the page with date — that is your baseline.
Open GSC > Links > Top linking sites. Export the full list. Compare against Ahrefs > Site Explorer > Referring domains export. Discrepancies are normal but should be small.
Set up Ahrefs Alerts > New backlinks for your domain. Configure weekly digest at minimum, daily if your site is in a competitive vertical.
Set up Brand24 or Google Alerts for your brand name and product names. Toxic mentions (forum posts impersonating your support, fake reviews) often surface here first.
Run Ahrefs Backlinks profile > filter Domain Rating 0-10 + last 90 days. Anything over 50 new domains in this filter without matching legit campaign activity is an investigation target.
Check your Anchors report in Ahrefs > new anchors last 30 days. Surges of exact-match commercial anchors you did not build are an attack signal.
Run Copyscape Batch Search or site: queries on your top 20 articles. Scraped republication on spam domains is a vector for negative SEO; file DMCA takedowns where appropriate.
Review Google Business Profile and key review platforms (Trustpilot, G2, Capterra) for review velocity anomalies. Flag platforms where 5+ 1-star reviews appeared within 48 hours.
Build a disavow workflow document: who triages alerts, what evidence threshold triggers a disavow update, who approves the upload. Without a documented process, panic disavows happen.
Schedule a quarterly link audit on your calendar. Even when nothing is wrong, baselines drift; finding an attack at 3 months is far cheaper than at 12 months.