Negative SEO: how to detect and protect your site | Ighenatt

Over 422,000 websites received negative SEO attacks during 2024, according to the GoDaddy Annual Cybersecurity Report. The figure surprises less once you understand how cheap it is: for 5 dollars on Fiverr, anyone can buy thousands of spam backlinks pointing at a competitor’s domain. What does surprise is how many site owners discover the attack weeks or months later, when the damage is done and recovery is measured in quarters, not days.

The debate over whether negative SEO actually works remains open. Gary Illyes, Google Search Analyst, has stated that he reviewed “hundreds of supposed negative SEO cases” without finding one that was the real cause of the traffic drop. But professionals who have documented real attacks — with data, timelines, and forensic evidence — tell a different story. The truth likely sits between both positions: Google filters most spam automatically, but sophisticated and sustained attacks can cause measurable harm.

Anatomy of a negative SEO attack: what forms it takes

Negative SEO is not a single attack. It is a category that groups distinct tactics with one shared objective: manipulate the signals Google uses to evaluate your site and trigger a ranking decline.

The most common tactic remains mass injection of toxic backlinks. The attacker generates thousands of links from link farms, PBNs (private blog networks), and hacked sites, all pointing at your domain with irrelevant anchor text — casino, pharmacy, adult content. According to Search Engine Land, these attacks aim to trigger Google’s spam filters against the victim rather than the attacker.

Content scraping has become more dangerous with AI tools that generate slightly modified versions of your text. If the scraper gets indexed first, Google may interpret your version as the copy. The defence here is preventive: implement rel=canonical tags and monitor for duplicate content with Copyscape or Siteliner.

Fake reviews hit local businesses that depend on the Google Local Pack especially hard. A wave of negative reviews with repetitive patterns — poor grammar, vague complaints, suspicious reviewer profiles — can sink a business’s rating within weeks.

Click fraud and CTR manipulation represent a newer vector. Bots inflate clicks on your SERP listings and then immediately bounce, creating a signal of high CTR combined with near-zero engagement. The intended result: Google’s algorithms interpret your page as irrelevant to the query and demote it. This tactic is harder to detect because the traffic appears in your analytics as real visits.

Direct site hacking remains the most aggressive variant: injection of hidden links to gambling sites, insertion of noindex tags on key pages, or malicious redirects that divert traffic. Search Engine Land also documents cases of sentiment manipulation, where attackers spam forums, Quora, Reddit, and social media with false narratives to damage a brand’s E-E-A-T signals. Think of negative SEO as a locksmith working in reverse: they do not open doors, they change the locks on your own house while you sleep.

Real case: Gaming.net and 12 months of digital warfare

Gaming.net lost approximately 90% of its organic traffic between 2024 and 2025 due to a multi-vector attack documented by Unite.AI.

The first vector was malicious query string injection. The attacker generated hundreds of thousands of URLs with junk parameters — ?id=123, ?action=QUERY, ?error=404 — including Cyrillic and Chinese characters. Each URL became an indexable spam page, artificially multiplying the site’s page count.

The second vector was an avalanche of toxic backlinks from foreign directories, adult sites, and hacked forums, with pharmaceutical and fake-contact anchor text pointing at irrelevant internal pages.

The third vector, and the hardest to detect, was RSS feed exploitation. The attacker injected spam keywords into the feed metadata by appending /feed/ to compromised URLs, creating a hidden layer of spam content that Googlebot crawled without the administrators seeing it on the frontend.

Defence required action across multiple layers: .htaccess rules to block harmful query strings, deactivation of public RSS/Atom/JSON feeds, blocking of XML-RPC and REST API endpoints, robots.txt restrictions, X-Robots-Tag: noindex headers for low-value pages, and submission of thousands of junk URLs for removal in Google Search Console. By mid-2025, the situation stabilised — but traffic remained well below historical levels.

The lesson from Gaming.net is straightforward: a sustained multi-vector attack over weeks can cause damage that takes quarters to reverse, even when the response is fast and technically competent.

Three-layer defence protocol: monitor, contain, disavow

Defending against negative SEO works like building security: no single measure protects everything. You need multiple layers that reinforce one another.

Layer 1 — Continuous monitoring

Early detection marks the difference between a minor incident and a months-long crisis. Set up these three lines of surveillance:

In Google Search Console, review the Links > Top linking sites section weekly. Look for unknown domains with suspicious extensions (.tk, .xyz, .ru, .pw). Check Top linking text — if you see casino, pharmacy, or adult anchor text that you did not generate, you have a problem. Enable email notifications for manual actions and security issues.

In Ahrefs, set up new backlink alerts for your domain. Ahrefs allows filtering by low Domain Rating (DR < 10) to rapidly detect links from spam sites. The “Live index” shows only active links, which reduces noise from historical links that have already disappeared.

In SEMrush Backlink Audit, schedule monthly audits. The tool assigns a toxicity score to each link and automatically categorises them into whitelist, remove-list, and review. This accelerates triage when there are thousands of new links to evaluate.

The result? With these three sources active, you detect anomalous link spikes within the first 48-72 hours, before Google processes most of those links.

Layer 2 — Server-level containment

When you detect an active attack, the priority is to stop the flow of new vectors before cleaning up existing damage.

For query string injection attacks, implement rules in .htaccess (Apache) or nginx configuration that block unrecognised parameters. If your site runs WordPress, deactivate XML-RPC and REST API endpoints you do not need — they are frequent injection vectors.

For content scraping, strengthen rel=canonical tags across all pages and set up Copyscape alerts for active duplicate monitoring. If you detect scraping in real time, you can report the duplicated content to Google via DMCA.

For fake reviews, document each suspicious review with screenshots and report to the relevant platform. Google has a formal process for removing reviews that violate its policies.

Layer 3 — Selective disavowal with the disavow file

John Mueller, Google Search Advocate, has been direct: “I’d strongly recommend focusing on other things — Google’s systems are really good at dealing with random spammy links.” He is right for 90% of cases. But when you have evidence of a real attack, the disavow file is your last line of defence.

The process has four steps. First, export all backlinks from Google Search Console (Links > External Links > Export) and cross-reference with Ahrefs or SEMrush data for a complete picture. Second, filter toxic links using the tools’ toxicity scores and look for patterns — domains sharing the same extension, identical anchor text, clustered creation dates. Third, create the text file using the format domain:maliciousexample.com (to disavow entire domains) or individual URLs, one per line. Fourth, upload the file in Google Search Console through the disavow tool.

A warning that bears repeating: accidentally disavowing legitimate links is worse than leaving toxic ones. Every domain you add to the disavow file loses all positive influence on your rankings. Keep a detailed log of every disavowed link and the specific reason, because you will need to review it periodically.

Specific tools for each phase of the protocol

The difference between an SEO professional who responds well to an attack and one who freezes comes down to having the tool stack ready before it happens. Setting up your monitoring environment while already under attack is like fitting a burglar alarm with the intruder already inside.

For detection, use Google Search Console (free, direct data from Google), Ahrefs Backlink Audit (the most thorough for link profile analysis), and SEMrush Toxic Score (good for fast triage of high volumes). In practice, combining GSC with one paid tool covers 95% of scenarios: GSC gives you Google’s own view of your link profile, while Ahrefs or SEMrush detect links that GSC has not yet reported.

For continuous monitoring, Google Alerts notifies you of brand mentions and scraped content, and Link Research Tools offers automated alerts that flag potentially malicious links. Set alerts to daily frequency, not weekly — during an active attack, every day matters.

For technical containment, Screaming Frog lets you crawl your own site to detect hidden link injections or suspicious redirects. Think of it as running a scanner through every room in your house after a break-in. Sucuri and Wordfence (for WordPress) monitor server file changes and block attacks in real time. If your CMS is WordPress, Wordfence is practically mandatory: its firewall blocks injection attempts before they reach the database.

For disavowal, the native disavow tool in Google Search Console is the only official channel. But rmoov automates the preliminary process of contacting webmasters to request manual link removal — a step Google recommends attempting before resorting to the disavow. The complete workflow is: identify toxic links, attempt manual removal (webmaster contact), wait 2-4 weeks for responses, and only then include in the disavow file whatever was not removed.

Kinsta documented a case where they cleaned up over 100 toxic backlinks, all with .tk extensions, using Ahrefs to filter by domain, export the list, and generate the disavow file in TXT format ready for Google Search Console. The entire process, from detection to disavow submission, took less than a week. One detail many forget: after uploading the disavow, Google may take weeks or months to process it. Patience is not optional.

What Google says (and does not say) about negative SEO

Google’s official position oscillates between “our algorithms handle it” and “use the disavow tool if necessary.” This ambiguity is not accidental.

John Mueller has publicly criticised companies that sell “negative SEO cleanup” and link disavow services, calling them out for “making things up.” His advice: “Make your site awesome instead of chasing those links.”

Gary Illyes goes further: “I’ve looked at hundreds of supposed cases of negative SEO, but none have actually been the real reason a website was hurt. While it’s easier to blame negative SEO, typically the culprit of a traffic drop is something else you don’t know about — perhaps an algorithm update or an issue with their website.”

Where is the nuance? Google speaks about the average case — the site that receives some spam and their filters clean it up. Documented attacks like Gaming.net’s show that sophisticated vectors (query string injection, RSS feed exploitation, direct hacking) do bypass automatic filters. You cannot rely solely on Google to protect you.

The pragmatic position is this: trust Google’s filters for generic spam, but maintain your own monitoring system for what Google does not catch. It is the same logic we apply to backups: you know the hosting provider runs them, but you still make your own.

Action plan for the next 48 hours

If you want to protect your site before an attack puts it to the test, here are the immediate steps.

Open Google Search Console and navigate to Links > Top linking sites. Export the full list. If you find more than 10 unknown domains with .tk, .xyz, .ru, or .pw extensions that you do not recognise, you have material to investigate.

Set up a new backlink alert in Ahrefs (or the free version via Google Alerts for “[your domain]”). Schedule a monthly backlink audit in SEMrush Backlink Audit. Enable email notifications in Google Search Console for manual actions and security issues.

Verify that your site has correct rel=canonical tags on every page. If you use WordPress, check that XML-RPC and REST API endpoints are blocked or restricted if you do not need them.

And if you are already under attack: document everything before acting. Screenshots of toxic backlinks with dates, full exports of your link profile, and a log of every action you take. This documentation is what separates an effective response from a reaction that can make things worse.