The short answer
The techniques to avoid are the ones Google names in its spam policies: cloaking, keyword stuffing, link spam, scaled content abuse, expired domain abuse, sneaky redirects, hidden text and links, doorway pages, scraping and user-generated spam. They share one trait. Each exists to manipulate rankings rather than to help the person reading the page.
Google's policy page is blunt about the consequence: sites that violate the policies may rank lower, or may not appear in results at all. Enforcement is either automatic, through spam-fighting systems, or manual, through a human reviewer.
- Intent is the test. A tactic built to trick the algorithm is spam, even when it looks like ordinary optimization.
- A drop after an announced update is an algorithmic reassessment, not a penalty. Only a manual action is a penalty, and it shows in Search Console.
- Every risky tactic has a legitimate version that earns the same signal honestly and survives the next update.
What Google Treats as Spam
These are drawn from Google's spam policies for web search, with Google's own definition alongside the form each one usually takes. The full, current list lives in the official documentation, which is the version you should trust if anything here ever falls out of date.
| Policy | What Google means by it | Common form |
|---|---|---|
| Cloaking | Presenting different content to users and search engines with the intent to manipulate rankings. | Serving keyword-rich text to Googlebot and a different page to visitors. |
| Keyword stuffing | Filling a page with keywords or numbers in an attempt to manipulate rankings. | A phrase repeated unnaturally, long location lists, keyword-only alt text and footers. |
| Link spam | Links created mainly to manipulate rankings rather than earned on merit. | Bought or sold dofollow links, excessive exchanges, private blog networks, automated link building. |
| Scaled content abuse | Generating many pages for the primary purpose of manipulating rankings and not helping users. | Mass-produced pages, including unreviewed AI output published at volume. |
| Expired domain abuse | Buying an expired domain and repurposing it mainly to manipulate rankings with low-value content. | A lapsed authoritative domain refilled with unrelated or thin content to inherit its history. |
| Sneaky redirects | Sending users somewhere different from what the search engine was shown. | A result that redirects a human visitor to an unrelated or lower-quality page. |
| Hidden text and links | Text or links placed on a page to sway crawlers while staying invisible to readers. | White text on a white background, font-size set to zero, or content positioned off-screen. |
| Doorways and site reputation abuse | Pages or third-party content made to ride signals they did not earn. | Near-duplicate doorway pages funnelling to one destination, or spam published on a reputable host. |
How Google Enforces the Rules
There are two ways a violation is acted on, and they feel very different in your reports.
Algorithmic demotion. Google's automated spam-fighting systems assess pages as part of ranking. When they catch manipulation, the affected pages are demoted without anyone at Google touching your site and without a notice. This looks like an ordinary ranking drop, often lined up with an announced spam or core update. There is nothing to appeal. You fix the underlying problem and wait for the systems to reassess.
Manual actions. Google issues a manual action when a human reviewer has determined that pages on a site are not compliant with the spam policies. If a site has a manual action, some or all of it will not be shown in search results. This one does come with a notice, in Search Console under Security and Manual Actions, naming the violation and whether it affects the whole site or specific pages. After you fix it, you request a review from that report.
The practical takeaway: before you assume the worst, open the Manual Actions report. If it is clean, you are not penalized in the strict sense, and a recent drop is more likely an algorithmic reassessment. Our guide to why Google rankings drop walks through telling the two apart.
A Worked Example
Illustrative scenario, not client data
A local services company buys a package of fifty dofollow links and rolls out a template of near-identical city pages, each stuffed with the same service plus a different town name. Rankings climb for a few weeks, then collapse. Here is the sequence that separates a guess from a diagnosis.
- Check Manual Actions. The report shows a manual action for unnatural links to the site, affecting it site-wide. This is a penalty, not an update.
- Name the violations. Two policies are in play: link spam from the bought links, and keyword stuffing with thin, templated doorway pages.
- Fix the cause, not the symptom. Have the bought links removed where possible, disavow the rest, and either consolidate the city pages into genuinely useful location content or remove them.
- Request a review. Document what changed and submit a reconsideration request. Google says these take several days or weeks, and link-related reviews can take longer.
The lesson is in the timeline. The links and the templated pages bought a few weeks of traffic and cost months of recovery, with no guarantee rankings return to where they were. The honest version of each move would have taken the same effort and kept compounding.
Confirm the damage before you react.
Murkuz connects Google Search Console, Analytics 4 and Bing Webmaster Tools to Claude or ChatGPT, read-only. When a drop looks spam-related, ask Live_Traffic_Drops which queries and pages lost ground and by how much, then point Inspect_URL at a page to see Google's own index status and which URL it chose as canonical. The Manual Actions report itself stays in Search Console, where it belongs.
What to Do Instead
Every tactic on the list has a legitimate counterpart that earns the same signal without the risk. The honest version is usually the same amount of work, and it keeps paying off.
Instead of: Buying dofollow links
Earn links by publishing something worth citing: original data, a genuinely useful tool, or the clearest explanation of a topic. Mark any paid or sponsored link with rel="sponsored".
Instead of: Keyword stuffing
Cover the topic properly in natural language. Use the words a reader expects where they fit, and let the depth of the answer carry the relevance.
Instead of: Scaled, unreviewed AI pages
Use AI to draft, then have a person edit, fact-check and add something only you can: first-hand experience, real examples, a point of view.
Instead of: Cloaking or sneaky redirects
Serve the same content to people and to Google. If a page needs to change for mobile or location, keep the core content and intent identical.
Go deeper on the honest versions: white-hat link building, human expertise with AI drafting, anchor text ratios and, if you already carry risky links, when to use the Google disavow tool.
Further reading
The primary sources for this page, official documentation first. Each one was opened and read in full before it was listed here.
Official docsGoogle Search Central
Spam policies for Google web searchThe authoritative, current list. Every tactic on this page is defined here in Google's own words, along with what happens to sites that break the rules. Start here and treat everything else as commentary.
Official docsGoogle Search Central
Google Search EssentialsThe umbrella for the technical requirements, the spam policies and the key best practices that make a site eligible to appear in Search at all.
Official docsGoogle Search Central
Creating helpful, reliable, people-first contentThe positive version of this page. Google's self-assessment questions for content made for people rather than to game rankings. Read it before you change anything after a drop.
Official docsGoogle Search Console Help
Manual Actions reportWhat a manual action is, which violations trigger one, and how to request a review once you have fixed the problem. The report itself lives in Search Console under Security and Manual Actions.
GuideAhrefs
Black Hat SEO: What It Is and How to Avoid ItA plain-English rundown of the common tactics and why the short-term gain rarely survives the next update. A useful second read alongside Google's policy page.
Frequently Asked Questions
What SEO techniques should I avoid?
Avoid anything whose main purpose is to manipulate rankings rather than help people. Google's spam policies name the specific tactics: cloaking (showing search engines different content from users), keyword stuffing, link spam (including buying or exchanging links that pass ranking signals), scaled content abuse (mass-producing pages with little value), expired domain abuse, sneaky redirects, hidden text and links, doorway pages, scraping and user-generated spam. The common thread is intent. If a technique only exists to trick the algorithm, it is on the list.
What is the difference between black-hat and white-hat SEO?
White-hat SEO earns rankings by making pages genuinely more useful: clear content that answers the query, a site that is easy to crawl, and links that other people choose to give you. Black-hat SEO tries to manufacture those signals artificially, for example by buying links or stuffing keywords. The practical difference is durability. White-hat work compounds and survives updates. Black-hat work tends to produce a short spike followed by an algorithmic demotion or a manual action.
Is buying backlinks against Google's rules?
Paying for links that pass ranking signals is link spam under Google's policies. That includes buying or selling dofollow links, excessive link exchanges and large-scale automated link building. There is a legitimate version: a paid or sponsored link is fine as long as it is marked with rel="sponsored" or rel="nofollow" so it does not pass ranking signals. The violation is not the payment, it is passing ranking credit through a link you paid for.
What is keyword stuffing?
Google defines keyword stuffing as filling a web page with keywords or numbers in an attempt to manipulate rankings. In practice it looks like the same phrase repeated unnaturally, long lists of cities or variations a page does not really serve, and alt text or footers that are just comma-separated keywords. Modern ranking systems read language in context, so over-repetition reads as a low-quality signal, not a relevance boost. Write for the reader and use terms where they make sense.
Will Google penalize AI-generated content?
Not for being AI-generated by itself. Google judges content on whether it is helpful, reliable and made for people, regardless of how it was produced. What its policies do target is scaled content abuse: generating many pages, by any method, mainly to manipulate rankings rather than help users. Unreviewed, thin AI output published at volume falls under that. AI drafting that a person edits, fact-checks and adds real value to does not.
How do I know if my site has a Google penalty?
A penalty in the strict sense is a manual action, and it is easy to confirm. Open Google Search Console and go to Security and Manual Actions, then Manual actions. If it says no issues detected, there is no manual action. A drop after a core or spam update is not a manual action, it is an algorithmic reassessment, and it will not show in that report. Use the shape and timing of the drop to tell them apart: a manual action comes with a notice, an algorithmic change lines up with an announced update.
How long does it take to recover from a manual action?
Fix every instance of the violation first, on every affected page, then request a review from the Manual Actions report with a note on what you changed. Google says most reconsideration reviews take several days or weeks, and link-related reviews can take longer because the team has to reassess the links. Recovery is not guaranteed and rankings rarely snap back to where they were, which is the main reason the tactics are not worth it in the first place.