Google penalty

What a Google penalty actually is

The word covers two mechanisms that share nothing operationally. The first is a manual action: a human reviewer at Google inspected the site, judged it in breach of the spam policies, and applied a sanction that is written down, dated, scoped, and appealable. It appears in the Manual actions report of Google Search Console. If that report is empty, you do not have a manual penalty, whatever a third-party checker tells you.

The second is algorithmic: a spam system or a core ranking system reassesses the site or the links pointing at it, and the rankings move. Google publishes no notice, gives no scope, and offers no appeal, because in Google's own framing nothing was applied to you. A signal that was inflating your position stopped counting, or a quality assessment of your content shifted. The practical consequence is enormous and almost always missed: with a manual action there is a documented route back to eligibility, while with a devaluation there is often nothing to recover, only ground to rebuild.

There is a third thing people mean when they type the phrase, and it is worth clearing off the table: the regulatory fines Google itself has received from competition authorities. Those are antitrust decisions against Alphabet and have no relationship whatsoever with how a website ranks. If your research trail keeps surfacing that meaning, you are reading the wrong half of the SERP.

The senior stance here: stop using « penalty » as a catch-all for a bad month. It is a diagnostic word, and using it loosely commits you to a repair plan, usually link removal, before you have established that links are the cause.

Manual action vs algorithmic devaluation

Manual actions come in named types, and the type dictates the fix. Unnatural links to your site targets an inbound profile built through schemes. Unnatural links from your site targets outbound selling, which is the one that matters most to anyone running or buying on a link market. Pure spam, thin content with little or no added value, user-generated spam, cloaking and sneaky redirects, hacked site, and structured data issues each carry their own remediation and their own evidentiary bar. A site-wide unnatural links action and a partial one on three URLs are not the same problem, and the report tells you which you have. Read the scope line before you read anything else.

This overview walks through the main penalty types and their symptoms, which is a useful sanity check before you commit to a diagnosis:

On the algorithmic side, the 2026 record is dense enough to make attribution genuinely hard. The August 2025 spam update rolled out over 27 days from 26 August to 22 September 2025 (Search Engine Land, September 2025). The December 2025 core update ran roughly 18 days, from 11 to 29 December. Then 2026 compressed everything: Google announced the March 2026 spam update on 24 March and it completed on 25 March, roughly 20 hours (Search Engine Land, March 2026), with the March 2026 core update starting on 27 March and running about 12 days to 8 April. The May 2026 core update is logged on Google's own status dashboard from 21 May to 2 June, and the June 2026 spam update from 24 June 09:00 Pacific to 26 June 10:00 Pacific, about 49 hours. Two systems moving inside a fortnight means a single traffic curve carries two causes, and separating them by eye is not possible.

One line from Google deserves to be quoted at every netlinking planning meeting: when Google neutralises the effect of spammy links, the ranking benefit those links were generating cannot be regained. That is not a sanction you serve and exit. It is a permanent write-off of borrowed position, and it is why the manual action mechanism is in practice the milder of the two outcomes.

Diagnosing a drop without guessing

Start with the cheapest test. Open Search Console, check Manual actions, check Security issues. Empty on both means you are looking for an algorithmic explanation or, more often than SEOs admit, a technical one. Then plot clicks by day, not by week, and mark the exact rollout windows above. A loss that starts on the first day of a spam update window and stabilises at completion is a different animal from a loss that walks down over six weeks, which usually points at content decay, cannibalisation, or a SERP layout change.

Segment before you conclude. A drop concentrated on one directory of URLs is rarely a site-level penalty, it is a template, an indexation regression, or a category of queries losing its slot. A drop spread evenly across branded and non-branded queries is almost never a spam issue, since brand queries are the last thing spam systems touch. Compare impressions, average position, and clicks separately, because they break in different ways.

This walkthrough covers additional practical checks on a suspect domain, and pairs well with the segmentation approach above:

There is a measurement trap that generated a wave of false penalty diagnoses. In September 2025 Google disabled the num=100 parameter that let tools pull 100 results in a single request. Rank trackers had to paginate, and the volume of deep bot-generated impressions collapsed. An analysis of 319 properties reported impression declines on 87.7 % of them, alongside artificially improved average positions. None of that is visibility, it is instrumentation. Anyone comparing 2026 performance against a pre-September 2025 baseline without annotating 10 to 14 September 2025 is reading a broken chart. Reset the baseline, keep clicks and conversions as the honest KPIs, and treat impression totals from before that date as a separate series.

Third-party penalty checkers deserve a blunt verdict: none of them can see a manual action. They infer from visibility curves, which is the same inference you can make yourself with better data, and they sell certainty they do not have.

Recovery: what works, what is theatre

For a manual action, the sequence is unglamorous and non-negotiable. Establish the exact scope from the report. Fix the cause completely, not partially: for an unnatural links action that means auditing the full referring profile, removing what you control, and using the disavow file only for what you genuinely cannot remove. Document the work with dates, contacted domains, responses, and the resulting file. Then file one reconsideration request that reads like an incident report: what happened, what was removed, what changed in the process so it does not recur. Reviewers respond to evidence of structural change. They do not respond to apology, and a request filed before the cleanup is done burns a review cycle and resets your clock.

This one is narrowly focused on manual penalties and their handling, which is the case where the procedure genuinely matters:

For an algorithmic loss there is no request to file, and this is where most agency retainers waste six months. If a spam system devalued a set of links, disavowing them changes nothing about your current position, because the benefit is already gone and Google has said it does not return. If a core update reassessed your content, the work is the content and the entity signals behind it, and recovery typically lands on a subsequent core update rather than the week after your fix. Plan on that cadence. The March 2026 core update ran about 12 days and the May one about 12 as well, which gives you a realistic sense of how often the door opens.

The disavow tool itself is now a narrow instrument. It is correct for a paid-link footprint you inherited, for a genuine negative campaign, or as documented remediation attached to a manual action. It is wrong as routine hygiene, and a bloated disavow file built from a spam-score threshold is one of the few ways to make your own situation worse.

Where this bites in a netlinking operation

If you buy links, the exposure is asymmetric and you should price it that way. The buyer's realistic downside is devaluation: the links stop counting, the position they bought evaporates, and Google's permanent-loss wording applies. The seller's downside is the harsher one, an unnatural outbound links manual action, which lands on the host site and takes it out of usefulness for everyone. That asymmetry is why the quality of the media you place on matters more than any per-link price, and why seeing the real host site before you commit is not a nice-to-have.

April 2026 changed the risk calculus in a way that has not been widely absorbed. Google updated its documentation to state that spam reports may be used to take manual action, and that the text of a report can be shared verbatim with the reported site owner. A competitor who can see your footprint now has a working lever. Anything mechanically detectable, identical anchor patterns across a set of hosts, a network of sites sharing a template and a footer block, a page that exists only to hold outbound links, is a reportable pattern rather than merely a suboptimal one.

The structural answer is boring and it works: place on sites that would survive a human reviewer's visit. We run our owned French editorial media at Nautilinks on that constraint, which means every host is published openly with its own audience and its own editorial line, and it also means we say no to placements that would leave a signature. If you are building the same discipline into an ongoing programme rather than a one-off purchase, calibrating volume and anchor mix over months is what keeps a profile from ever needing this article.

What we see go wrong

The most expensive error is a false positive. A site loses 40 % of its traffic, someone declares a link penalty, and three months of budget go into removal outreach and a 4 000 line disavow file. The actual cause was a migration that broke canonical tags, or a category filter that dropped half the site out of the index, or the September 2025 impression artefact. Rule: rule out technical and measurement causes before you touch the link profile, because the link work is irreversible and the technical work is not.

The second is timing a fix against the wrong update. With a spam update and a core update landing days apart in March 2026, teams attributed content losses to spam systems and spent the quarter cleaning links that were never the issue. Log the dates, hold the two hypotheses separately, and test the cheaper one first.

The third is treating an algorithmic devaluation as something that can be appealed. There is no reconsideration path for it, no form, and no contact who will restore anything. Emails to Google do not exist as a mechanism here.

The fourth is the panic disavow. Feeding a tool's spam metric into a disavow file removes links Google was counting perfectly happily, and produces a second drop that gets blamed on the original problem. Disavow is a scalpel with a documented indication, not a broom.

The fifth is scale without operational capacity. Programmatic content, expired-domain reuse, and reputation-abuse arrangements all sit squarely inside the categories Google has been enforcing against through 2025 and 2026. Each is workable at small scale with real editorial control behind it. Each becomes a manual action waiting for a reviewer once the volume outruns the ability to defend any individual page.