What Is a Negative SEO Attack?
Somebody deliberately trying to damage your site's search performance. It is a reasonable thing to worry about and it is asked constantly. The answer is considerably more reassuring than most articles on the subject suggest. It is also much rarer than the industry selling protection from it would like you to believe.
Taking The Worry Seriously
If your rankings have fallen and you cannot explain why, the thought that somebody did this to you is a rational one. It deserves a proper answer rather than a pat on the head.
Why the fear makes sense. The alternative is worse.
An unexplained fall means something you do not understand is affecting your business. An attacker is at least a cause with a shape to it. That is a reasonable way for a mind to work under pressure. It is also why this question gets asked so often.
Why being told not to worry does not help. It answers nothing.
Most articles on this either stoke the fear or wave it away. Neither tells you what would actually have to be true for this to be happening to you, which is the only thing that resolves it.
What this page does instead. Three things, in order.
What an attack would involve, why it is rare and what your fall is far more likely to be. Then the narrow circumstances where it is real, because pretending those do not exist would be as useless as pretending they are everywhere.
What it will not do. Confirm something unsupported.
If the evidence points somewhere else, this page says so. That is more use to you than agreement.
What It Would Actually Involve
Three broad categories. Each is described here by what it would do rather than by how it would be done. That omission is deliberate on this page more than any other in the cluster.
Why no method appears here. It would be used on somebody else.
Everywhere else in this cluster, withholding method protects a reader from harming their own site. Here it would protect somebody else's site from the reader. That is a stronger reason rather than a weaker one.
Manufacturing links to a site. The version people mean.
Arranging for large numbers of low quality references to point at a target, on the theory that the target will be judged by the company it appears to keep. This is the category the next block addresses directly.
Copying its content. The version that genuinely happens.
Republishing somebody's material elsewhere, sometimes at volume. Common, usually harmless to the original and covered properly in block six.
Interfering with it technically. The rarest and most serious.
Anything that changes what a site tells search engines, else makes it unavailable. This is not really a search problem. It is a security problem with a search consequence. It is dealt with as such.
Why It Is Rarer Than You Think
Search engines have had decades of commercial incentive to make rankings resistant to what third parties do to a site. A search engine whose results could be rearranged by anybody with a budget would be worth nothing, so this is self-interest rather than kindness.
What changed the picture most. Ignoring rather than punishing.
Since the Penguin 4.0 update in 2016, Google's approach to low quality links shifted from demoting sites that had them towards disregarding the links themselves. That is the single most useful fact here, because a link that is disregarded cannot be used as a weapon.
What Google actually publishes. With one important nuance.
Google's help documentation addresses whether competitors can harm a site's ranking. It answers that Google works hard to prevent other webmasters from being able to harm your ranking or have your site removed from the index.
The nuance worth knowing. The wording was softened.
An earlier version of that answer said there is almost nothing a competitor can do. It now describes effort rather than near-certainty. We point that out because a page quoting the current wording as though it were absolute would be overstating it. The change is also the reason block seven exists.
What that adds up to. Resistant rather than immune.
Which is a considerably better position than the anxiety suggests. It is also an accurate one.
Who Sells You The Fear
Link monitoring services, toxicity reports and protection packages are a substantial commercial category. Their existence depends on businesses believing this threat is common, which is worth noticing before buying one.
What this block is not saying. Nobody is being accused of anything.
Most of these products are sold by people who believe in them. Monitoring what points at your site is a perfectly reasonable thing to do. The criticism here is of an incentive structure rather than of anybody's character or conduct.
Why the structure matters anyway. Incentives shape emphasis.
A category that profits from a fear will tend to describe that fear as widespread, urgent and increasing. No bad faith is required for that to happen. It happens because the people who worry most are the people who buy.
What the reports actually contain. Third-party estimates.
Toxicity scores are a vendor's own judgement about a link. They are not a measure produced by any search engine, nor does any search engine publish one. A score is somebody's opinion expressed as a number, which is a great deal more persuasive than an opinion expressed as a sentence.
The question to ask before buying. One sentence.
What specifically is this protecting me against, then what would you do if it happened. A clear answer is a good sign. A general answer about safety is the finding. The fuller position is on what is link farming in SEO.
It Is Usually Something Else
A site whose rankings fell has almost always met one of four ordinary explanations. Attributing it to an attack is comforting, because it makes the cause external and nobody's fault. It is usually wrong.
An update. The commonest by a distance.
Assessment changed and the site was reassessed. Nothing was done to you and nothing was done wrong. Our material on algorithm updates covers how to establish whether the timing lines up.
A competitor improving. The one nobody checks.
Somebody else got better and moved above you. The numbers look identical to your site getting worse, which is why this needs ruling out rather than assuming.
A technical fault. Frequently invisible from the inside.
Something broke and nobody noticed, because the site still looks fine to anybody who visits it.
A change you made. The most overlooked of the four.
A rebuild, a migration, a plugin, a template change, content removed by somebody being tidy. These are commonly invisible to the person asking the question, because somebody else made them.
Where to start instead. The definite check.
Establish first whether anything was actually reported, which takes about a minute, in how to check for a Google penalty. Whether the drop is even real is covered in our measuring performance material.
Content Theft Is The Common Version
Having your content copied is genuinely frequent. It is the version of this subject most businesses will actually encounter. It is far less damaging than it feels.
Why it rarely harms the original. Being first counts.
Search engines are generally able to work out which version came first, particularly where the original site is established and has been referenced elsewhere. A copy on an unknown site is not usually a competitor for your position.
Why it still feels serious. It is your work.
Finding your own writing on somebody else's site is genuinely annoying regardless of the search consequence. That reaction is legitimate. The two things are worth separating so that the response is proportionate.
What is reasonable to do. In order of effort.
Ask them to remove it, which frequently works. Where it does not, both copyright complaint routes and search engine removal processes exist. Either is a formal request rather than a technical fix.
When it is worth escalating. Rarely.
If a copy is outranking you for your own material, that is worth pursuing. If it is sitting unnoticed on a site nobody visits, the time is better spent elsewhere.
When It Is Real
Deliberate interference does happen. It is narrow, it has a recognisable shape and pretending otherwise would make everything above less credible.
It tends to be targeted. Rather than random.
Where it occurs it is usually aimed at a specific business by somebody with a specific reason, in a market where a single position is worth a great deal. It is not something that arrives by chance.
The categories where it is reported most. High value, few positions.
Sectors where one ranking is worth an enormous amount and where the participants already compete aggressively. Most ordinary businesses are not in one.
The technical version is a security matter. Not a search one.
If somebody has interfered with your site directly, that is an intrusion and it is handled as an intrusion, by whoever maintains your hosting and your site. Search performance is a symptom in that situation rather than the problem.
What the response is either way. Identical to everything else.
Establish what actually changed before acting. That is the same discipline as for any unexplained fall. It does not become different because an attacker is suspected.
What To Do And What Not To Do
Two short lists. The second matters more, because the common reactions to this fear cause more damage than the thing being feared.
Do watch what points at your site. Periodically.
Knowing roughly what your link profile looks like is reasonable, cheap and occasionally useful. Watching it daily is not.
Do check the definite things first. Before theorising.
Whether anything was reported, whether the timing matches an update, whether anything on the site changed.
Do treat interference as a security issue. If there is any sign of it.
Do not disavow in a panic. The single most common mistake here.
Google's own guidance when the disavow tool launched in October 2012 was that where a site has not been notified of a manual action for unnatural links, the tool is generally not something to worry about. Used defensively it can remove links that were helping you. The fuller position is on what is link farming in SEO.
Do not buy protection before establishing a cause. Nor rebuild everything.
Both are expensive responses to a diagnosis nobody has made yet. The full series is on the dangerous SEO practices guide.
Find out what
actually
happened.
A review that establishes what changed and when, before anybody spends money on a theory. We will tell you plainly if we find nothing wrong with your site, because that is the usual answer and it is worth more to you than agreement.
What a risk review covers:
A risk review is a one-off piece of work rather than a monthly service, so it is scoped against the size of the site and how much history it carries.
Every guide.
One practice.
Black hat, grey hat, link risk, thin content, the spam policies, negative SEO, manual actions, algorithmic penalties, how to check for one and how to recover from one.
