A negative SEO attack is any attempt by a third party to push your site down the results. For most people the phrase means one thing: a competitor buying thousands of junk links to your domain in the hope that Google penalises you for them. That fear sells a lot of link audits and disavow services.
It is also the fear least supported by what Google says. The link version of the attack is the one Google’s systems were built to absorb. The other versions get less attention and do more damage, because nothing in Google’s link handling protects you from them.
What Google says about a negative SEO attack
Google’s John Mueller was asked how to handle a suspected attack and gave a short answer, as reported by Search Engine Journal: “I’d just ignore them. Think of it this way, if your competitors are competent, they won’t build links for you. If your competitors are incompetent, the links won’t have any effect.”
The logic is worth spelling out. A competent competitor knows that pointing links at you is at least as likely to help you as hurt you, so they do not bother. An incompetent one builds the obvious spam that Google already discounts. Either way, the links you are worried about are not doing what the attacker hoped.
Google ignores obviously spammy links, so the advice is that there is “no need to disavow them”. That runs against a lot of received wisdom. Plenty of SEO guides still treat every sudden spike in low-quality referring domains as an emergency. Google’s own position is that the spike is noise.
When the disavow file still matters
None of this makes the disavow tool useless. It has a narrower job than it is usually given. Disavow is for links you are responsible for, such as links you or a previous agency bought or built through a scheme, or for links named in a manual action. Our guide to the disavow links tool covers how to build the file, and our explainer on a Google manual action covers what to do if you receive one.
The distinction matters because disavowing has a cost. Every hour spent auditing links you did not build is an hour not spent on the site. And a nervous, sweeping disavow can catch links that were doing you good. If you have not built manipulative links and you have no manual action, the honest answer is that there is very little for you to do about inbound spam.
| Situation | What the guidance says | Where to start |
|---|---|---|
| Spammy links you did not build | Google ignores obviously spammy links; “no need to disavow them” | Ignore them |
| Links you or an agency built through a scheme | Disavow is meant for links you are responsible for | Disavow file |
| A manual action for unnatural links | Disavow is one part of the response | Manual actions report |
| Scraped copies of your content | Not a link problem; disavow does not apply | Removal or DMCA request |
| Fake reviews | Not a link problem | The review platform’s reporting process |
| A hacked site | Not a link problem | Security clean-up and monitoring |
The forms of negative SEO that need a response
If links are the overrated threat, these are the underrated ones. None of them is handled by Google’s link systems, and none of them goes away if you ignore it.
Fake reviews. A run of invented one-star reviews on a business profile or a review platform does not touch your rankings through links, but it changes how searchers see you before they click. The fix sits with the platform: flag the reviews through its own process, respond calmly in public where that is allowed, and keep a record of what you reported and when.
Scraped content. Someone copies your pages wholesale and republishes them elsewhere. Google is generally good at working out which version came first, and our piece on duplicate content explains why most copying does not cost you. Where a copy does outrank you, the route is a removal request to the host or a DMCA notice, not a disavow file.
Hacking. This is the serious one. A compromised site can have spam pages injected, redirects added or content altered, and all of that is your site doing the damage, not someone else’s links. Keep software and plugins updated, use strong unique passwords with two-factor authentication, and watch Search Console for security issue warnings.
How to protect your website from negative SEO
Protection is mostly ordinary site hygiene done consistently. The aim is to notice real problems early, not to fight imaginary ones.
- Secure the site. Updates, access control and backups do more against the damaging forms of negative SEO than any link tool.
- Monitor, do not panic. Check Search Console for manual actions and security issues. A spike in referring domains is worth a glance, not a disavow.
- Watch for copies. Search for distinctive sentences from your key pages now and then, and act on copies that outrank you.
- Keep your own link history clean. The links most likely to hurt you are ones built on your behalf. Our analysis of whether toxic backlinks matter goes further on this.
If you inherited a site, the last point matters most. A previous owner’s paid links are a far more likely cause of a manual action than a competitor’s spam, and they are the case the disavow tool was designed for.
Is negative SEO illegal?
It depends on where you are and what was done, and this is not legal advice. Pointing links at a site is a different thing from breaking into it or publishing defamatory reviews, and laws on unauthorised access, defamation and copyright vary by jurisdiction. If you believe you have been hacked or targeted with fake reviews, document everything and speak to a lawyer where you are.
One limitation to keep in mind. Google says it ignores obviously spammy links, but it does not tell site owners which individual links it has discounted, and Mueller’s answer addresses the common case rather than every possible one. You cannot verify from outside that a particular link is being ignored. What you can verify is whether you have a manual action, whether your site is secure and whether your content is being copied, and those are where your time is better spent. If you want a wider view of the tactics behind this kind of attack, our guide to black hat SEO sets them out.
Frequently asked questions
Can a negative SEO attack hurt my rankings?
The link version rarely does. Google ignores obviously spammy links, and John Mueller’s advice was to ignore them. Hacking, scraped content and fake reviews can do more harm.
Should I disavow spammy links I did not build?
Generally no. Google says there is no need to disavow obviously spammy links. Disavow is for links you are responsible for or links named in a manual action.
How do I protect my website from negative SEO?
Keep the site secure and updated, check Search Console for manual actions and security issues, watch for copies of your content, and keep your own link building clean.
Is negative SEO illegal?
It depends on the jurisdiction and the method. Hacking, defamation and copyright infringement are treated differently in different places, so take local legal advice.
The takeaway Spammy links from strangers are the least dangerous form of negative SEO, and Google’s advice is to ignore them. Spend the effort on security, monitoring and your own link history instead.
