What Is Negative SEO? (And How Much of It Actually Works)

Negative SEO is a deliberate attempt to push a competitor's site down in search results, most often by pointing thousands of spam links at it. Google says its systems ignore links like these, so link-based attacks usually do nothing. The attacks that cause real damage are hacking, content scraping and fake link-removal requests, and each has a specific defence.

The way it usually starts: you open your backlink tool on a Monday and the referring-domain count has jumped from 180 to 2,400 in a week (an invented example, but a typical shape). The new domains are pharmacy, casino and adult sites in languages you do not publish in, every anchor is the same keyword, and your rankings have not moved. That last detail is the important one, and it is the usual outcome.

What counts as negative SEO?

Negative SEO is any action taken against a site you do not own with the aim of lowering its rankings. The term covers several different tactics that have very different success rates:

Spam link blasts. Thousands of links from link farms, hacked sites or automated comment spam, usually with exact-match anchor text, to make the target look like it is buying links.
Hacking and content injection. Breaking into the site to add hidden links, spam pages or malware. Google's spam policies define hacked content as "any content placed on a site without permission, due to vulnerabilities in a site's security."
Content scraping. Copying your pages to other domains, sometimes before Google has indexed your original.
Fake removal requests. Emailing sites that link to you, pretending to be you, and asking them to take the links down.
Fake reviews and false reports. Leaving one-star reviews on your business profile, or filing bogus spam and copyright complaints against your pages.

Only the first one is what most people mean by "negative SEO", and it is the one with the worst track record.

Spam backlinks pointing to my site: can they hurt me?

Almost never, and Google has said so repeatedly. Its disavow documentation states that "Google works very hard to make sure that actions on third-party sites do not negatively affect a website," and that "in most cases, Google can assess which links to trust without additional guidance." When a site owner reported a spam-link attack on Twitter in February 2019, Google's John Mueller replied, as Search Engine Journal recorded, "I'd ignore them. Someone's wasting their time on something our systems have a lot of practice at ignoring."

The logic is simple. If anyone could tank a competitor for the price of a $20 link blast, every competitive niche would be a war zone and search results would be useless. Google's answer has been to devalue spam links rather than penalise the site receiving them. The links that do trigger action are patterns you created yourself, which is why what is a bad backlink draws the line at who built the link, not how ugly it looks.

An independent test points the same way. In August 2024, Ahrefs disavowed 129 "toxic" URLs pointing at three of its own posts and compared the 20 days before and after. Combined traffic fell 7.1%, one page rose, two fell, and the author concluded the disavow had little to no effect either way. The links being ignored before were still being ignored afterwards.

Which negative SEO attacks actually work?

The ones that change your site or your link profile directly, rather than adding noise to it.

Hacking. A hacked site can be deindexed, flagged in Search Console's Security Issues report and shown with a warning in results. This is the one form of negative SEO with a reliable payoff for the attacker, and it is a crime, not an SEO tactic. Keep software updated, use strong credentials and two-factor logins, and watch the Security Issues report.

Link removal requests. An attacker who gets your five best links removed has done more damage than one who adds five thousand bad ones. Keep a list of the links you value, check them every few months, and warn key publishers that you will only ever request changes from your own domain's email.

Scraping on weak sites. If your site is new and crawled rarely, a scraper with a faster crawl schedule can occasionally get its copy indexed first. Google's spam policies list "republishing content from other sites without adding any original content or value" as spam, and the fix is to get your own pages indexed quickly and to file a copyright removal request for the copy. Does duplicate content hurt SEO covers the mechanics.

Review attacks. Fake one-star reviews can affect a local business more than any link ever will. They are handled through the review platform's reporting tools, not through Search Console.

How do I know if I am under a negative SEO attack?

Check whether anything has actually changed, not whether the backlink report looks frightening. Work through these in order:

Search Console, Security Issues. Anything listed here is real and urgent.
Search Console, Manual Actions. If this report is empty, you do not have a link penalty. What is a manual action in Search Console shows what an entry looks like.
Rankings and clicks over the same dates. A spike in spam links with flat rankings is noise. A ranking drop that lines up with a core update, a redesign or a competitor's new page has a different cause.
Your best links. Open the pages that send you the most referral traffic and confirm the links are still there and still followed.
A search for your own content. Search a distinctive sentence from a key page in quotes and see whether other domains are outranking you with it.

Most "attacks" fail every one of these checks. The spam links are real, the damage is not.

What to do about a negative SEO attack

Do nothing to the links by default, and act only on what the checks above turned up.

If Security Issues flagged something: clean the site, patch the hole, then request a review in Search Console. This is the only urgent case.

If good links were removed: contact the publishers, explain that the request did not come from you, and ask for the links to be restored. Most will.

If content was scraped: request indexing of your original and file a removal request for the copy under copyright law.

If it is only spam links and the Manual Actions report is empty: leave them. Google's disavow page says to use the tool only when you have "a considerable number of spammy, artificial, or low-quality links" and those links "have caused a manual action, or likely will cause a manual action." Both conditions, not one. The file is capped at 100,000 lines and 2 MB, and Google says it "can take a few weeks" to process, so a mistaken disavow is slow to undo and can remove links you needed. How to disavow bad backlinks covers the format if you do meet both conditions.

If you do have a manual action for unnatural links: then disavow the attack domains, document the dates and the pattern, and say in your reconsideration request that the links were not built by you. How to recover from a Google penalty walks through the request.

How to protect your site from negative SEO

The best protection is a link profile strong enough that spam is a rounding error. A site with 300 relevant, editorial referring domains barely registers 3,000 junk links; a site with 12 real links looks different after the same blast, even if Google still ignores it. Build real links steadily, keep an export of your backlink profile every quarter so you can see what changed, and spend your audit time on the links you want rather than the ones you do not. How to audit your backlink profile sets out a routine that takes an hour a quarter.

One honest route to those real links is trading them with other site owners in your niche. That is what Backlinkster does: one in-content link for one in-content link, the link must sit in a real article on the member's own domain, and each swap is verified by API. Links like that are the opposite of a spam blast, and they are what makes a profile resilient.

Frequently asked questions

What is negative SEO? Negative SEO is a deliberate attempt to lower another site's search rankings. The usual method is pointing large volumes of spam links at the target. Other forms include hacking the site, scraping its content, sending fake link-removal requests to its publishers, and posting fake reviews.

Can someone hurt my SEO with bad backlinks? Rarely. Google says it works to ensure "actions on third-party sites do not negatively affect a website" and that its systems can assess which links to trust without guidance. In 2019 John Mueller told a site owner reporting a spam-link attack to ignore it. Links built by you are a different matter.

How do I know if I am under a negative SEO attack? Check Search Console's Security Issues and Manual Actions reports, compare rankings against the dates the links appeared, confirm your best links are still live, and search a sentence from your content to see whether a copy outranks you. A spike in spam links with no change in rankings is noise, not damage.

Should I disavow spam backlinks I did not build? Not unless you have a manual action for unnatural links or a profile likely to cause one. Google's disavow page lists both conditions, caps the file at 100,000 lines and 2 MB, and says processing takes a few weeks. For links Google is already ignoring, disavowing gains nothing and risks removing real links by mistake.

Is negative SEO illegal? Pointing spam links at a site is not a crime in most places, though it violates Google's policies. Hacking a site, injecting content, impersonating the owner to get links removed, and filing false legal complaints can all break real laws. Report those to the relevant platform or authority rather than treating them as an SEO problem.

The bottom line

Negative SEO exists, but the version most people fear, a flood of spam links, is also the version Google has spent the longest learning to ignore. Check Security Issues and Manual Actions, confirm your best links are intact, and leave the junk alone unless you meet Google's two conditions for a disavow. The attacks worth defending against are hacking, link removal and scraping, and the defences are ordinary site hygiene plus a link profile real enough that noise does not matter.