Check this page with an assistantOpens a chat asking it to summarise this article and name the evidence behind each claim.
Claude opens with the prompt on your clipboard: Anthropic does not support prefilled prompts on the web, and we would rather copy it than ship a button that drops it.
The One-Word Change That Explains Everything
Google used to say there was nothing a competitor could do to harm your ranking or remove you from the index. That became almost nothing. The word was added deliberately, and it is the honest summary of the subject: the general case is that you are fine, and edge cases exist.
The reason the general case holds is structural rather than charitable. A ranking system that let inbound links damage a site would be trivially weaponised, and the obvious victims would be exactly the small sites least able to defend themselves. Discounting untrusted links rather than counting them against the target is the only stable design, which is why it has been the behaviour for over a decade.
What the concession covers is narrower and worth taking seriously. Very large campaigns against very new or very small sites, where there is little established signal to weigh against the noise. And attacks that are not about links at all, which is where the real damage has always been.
Sorting Real Risks From Sold Fears
The attacks people worry about and the attacks that work are almost entirely different sets. The worry is concentrated on backlinks, because that is what the tools monitor. The damage is concentrated on your own site and your reputation, where most people are not looking.
| Attack | Actually effective? | What to do |
|---|---|---|
| Spam links pointed at your site | Rarely; usually discounted | Nothing, in most cases; see the disavow guide |
| Hacked pages or injected redirects | Yes, seriously | Security monitoring, patching, index checks |
| Content scraped and republished at scale | Sometimes, on weaker sites | Ensure originals are indexed first; takedowns where worth it |
| Fake negative review campaigns | Yes, especially locally | Report to the platform; keep earning real ones, per Google reviews |
| Impersonation and fake profiles | Yes, reputationally | Claim your profiles; consistent identity, per entity SEO |
| Fake DMCA or removal requests | Occasionally | Counter-notice; keep evidence of authorship |
| Aggressive crawling of your site | As a performance issue, yes | Rate limiting at the edge |
Notice that the effective attacks are mostly security and reputation problems wearing an SEO label. That is why buying backlink monitoring in response to this fear protects the one area least likely to be attacked successfully, and leaves the others unwatched.
Diagnose Before You Conclude
Almost every suspected attack turns out to be an algorithm update, a change somebody shipped, or seasonality. Work through the boring explanations in order, because they are more likely and much easier to fix.
- Check the date against known updates.
The Search Status Dashboard records confirmed rollouts. A decline starting inside a confirmed update window is overwhelmingly likely to be that update, and the response is in core update recovery.
- Check your own change log.
Deploys, template changes, plugin updates, migrations. A drop starting on a deploy date is an engineering incident. This is why keeping the log matters, as argued in split testing.
- Compare year over year.
Seasonality is the single most common cause of an alarming month-over-month chart. If last year had the same shape, nothing is wrong, per seasonal SEO.
- Look for physical evidence.
Search your own site for pages you did not create. Check for unexpected redirects and for security issues reported in Search Console. An attack that works leaves traces on your site; theories about competitors do not.
- Only then look at links.
And when you do, look for a genuine step change in referring domains rather than for individually unpleasant links. Every site of any age has unpleasant links, and they are not why traffic moved.
Why Defensive Disavowing Usually Backfires
Disavow is a narrow tool, designed mainly for sites carrying a manual action for links they were involved in obtaining. Used speculatively, it removes links you cannot be certain were harmful, some of which were helping, and reversing it is slow.
The asymmetry is what makes it a bad default. If the links were being ignored anyway, disavowing them changes nothing and costs you the ones that were counting. If they were harmful, you have fixed something. Since the first case is far more common, the expected value of a speculative disavow file is negative, and it gets worse the larger the file.
There is also a diagnostic cost. Once you have disavowed broadly, you have introduced a variable that makes every future investigation harder, because you can no longer tell whether a change came from your file or from something else. The narrow circumstances where it genuinely applies, and how to build the file if you are in one, are in the link spam and disavow guide.
The Defences Worth Actually Having
All of them are ordinary operational hygiene rather than SEO products. Keep the site secure, watch what is in your index, claim your identity everywhere, and keep earning real signals so that noise has something to be weighed against.
Concretely: keep software patched and access controlled, because hacking is the attack that works. Run a site search for your own domain occasionally and look for pages you did not publish. Set up alerts for your brand name so impersonation surfaces early. Claim and monitor your review profiles, since coordinated fake reviews are the most damaging local attack and platforms will act on reports.
The strongest protection is unglamorous: a site with genuine references, real reviews, consistent identity, and a history of satisfying searchers has a large amount of signal that noise has to overcome. That is not a defence you buy, it is the accumulated result of doing the work described across earning third-party citations and entity SEO, and it is why established sites are much harder to attack than new ones.
Questions People Ask About Negative SEO
- Is negative SEO real?
Partly. Google's own wording moved from saying there is nothing a competitor can do to harm your ranking to saying there is almost nothing, which is a deliberate concession that edge cases exist. The realistic reading is that link-based attacks are largely ineffective now, while attacks that change your site or your reputation remain genuinely damaging.
- Can competitors hurt me by building spam links to my site?
Rarely, and much less than the industry that sells protection implies. Google discounts links it does not trust rather than punishing the target, because a system that penalised sites for inbound links would be trivially weaponised. Large-scale campaigns against very new or very small sites are the residual risk, and even there the usual outcome is that the links are ignored.
- Should I use the disavow tool defensively?
Almost never. Disavow is a narrow instrument intended mainly for sites with a manual action related to links they were involved in acquiring. Used speculatively it can remove links that were helping you, and there is no undo that takes effect quickly. Most disavow files are written out of anxiety rather than evidence.
- What attacks actually work?
The ones that are not really SEO. Hacked pages injecting spam or malicious redirects, content scraping at scale that competes with your originals, fake negative review campaigns, and impersonation. These damage you through your own site or your reputation rather than through Google's link handling, and none of them is prevented by monitoring your backlink profile.
- How do I tell an attack from an algorithm update?
Check the timing against the Search Status Dashboard and check your own change log first. Broad declines coinciding with a confirmed update are almost certainly the update. Attacks tend to leave physical evidence: unfamiliar pages in your index, unexpected redirects, security warnings, or a sudden cluster of reviews with similar phrasing.
