What Is Negative SEO? How to Spot and Stop an Attack on WordPress

Negative SEO is when someone tries to hurt your site’s place in Google on purpose. It sounds scary, and the tools people use are cheap. But Google is good at ignoring most of it. This guide covers the common types, how to tell if it is happening to your WordPress site, and what to do about it.

What is negative SEO?

Normal SEO is work you do to help your own site rank. Negative SEO is the opposite. Someone outside your site tries to make Google trust it less, so it drops in search results.

Sometimes a competitor or someone with a grudge is behind it. More often, nobody is aiming at you at all. Spam tools crawl the web and attach junk links to thousands of sites at once. From your side, both look the same.

It does happen in the WordPress world. In 2015, Ryan Sullivan, founder of WP Site Care, said a negative SEO campaign nearly took his business offline. His team traced it back to someone in the WordPress community who had hired a third party to do it. WP Tavern covered the story.

A negative SEO attack is much harder to pull off than it used to be. Google says plainly that it “works very hard to make sure that actions on third-party sites do not negatively affect a website.” That line is from Google’s own page on disavowing links.

The common types of negative SEO attack

Spam backlinks

This is the classic one. Someone points hundreds or thousands of low-quality links at your site, mostly from link farms and throwaway domains. The idea is to make it look like you bought links, which is against Google’s spam policies.

A real example: in 2024, a site owner posted in Reddit’s r/SEO that a rise in spammy backlinks was hurting their rankings. Google’s John Mueller replied that there was no need to do anything about them. He said “Google’s systems are really good at dealing with random spammy links” and suggested putting the effort into the site instead. Search Engine Journal wrote up the thread.

Copied content

Scraper sites copy your posts word for word and publish them elsewhere. Now and then the copy gets found before your original. Google normally works out which page came first, but it is still annoying to see. Semrush’s guide to negative SEO suggests asking the site owner to take the copy down first, then reporting it to Google or sending a DMCA notice if that fails.

Hacking and injected spam

This is the type to worry about. If someone gets into your WordPress site, they can add hidden spam pages, links to shady sites, or redirects that send visitors somewhere else. Google’s spam policies call this hacked content and list code injection, page injection, content injection and redirects as the main kinds. Hackers often hide the changes from logged-in users, so you may not notice for weeks.

One well-known example is the Japanese keyword hack. It creates pages of autogenerated Japanese text in random folders on your site, full of affiliate links to stores selling fake brand goods. Google has a full cleanup guide for it, which starts with reinstalling your CMS files, themes and plugins from clean copies.

Fake reviews and fake removal requests

Some attacks target your reputation instead of your rankings. That can mean a wave of one-star reviews on your plugin or business listing, or false copyright complaints asking Google to remove your pages.

The fake complaint trick is real. In November 2023, Google sued two men it said had used at least 65 Google accounts to send fraudulent copyright notices against more than 117,000 web pages. They appeared to be linked to sites selling printed t-shirts, and the goal was to knock competitors out of search results. MediaPost reported on the lawsuit. For fake reviews on Google, you can ask for removal through your Google Business Profile.

Server overload

Bots can hit your site with so many requests that it slows down or goes offline. Semrush also lists hotlinking, where other sites load your images straight from your server, as a way to drain it. If Google’s crawler keeps finding errors, it may visit less often until the site is stable again.

Does negative SEO actually work?

For spam links, mostly no. Google’s disavow page says “Google can assess which links to trust without additional guidance,” and that “most sites will not need to use this tool.” In plain words, Google tends to ignore junk links rather than punish the site they point to.

Mueller put it bluntly in another Reddit reply in 2022: “if your competitors are competent, they won’t build links for you.” A skilled competitor would not waste good links on you, and bad links from an unskilled one do nothing. That is how Search Engine Journal summed up his advice.

Still, nobody outside Google knows exactly how its systems treat every link. Google’s own disavow page admits that “in some circumstances, incoming links can affect Google’s opinion of a page or site.” So it is fair to keep an eye on it.

Hacking is different. Hacked content can get your pages marked as unsafe, removed from results, or hit with a manual action. That is why securing your site matters far more than counting bad links.

What it looked like on our own site

We saw a spam link wave on uwawp.com, the site you are reading now. In a few weeks, more than 700 new domains started linking to us. Ahrefs flagged nearly all of them as spam. Most were cheap .shop and .xyz domains with names like “buy SEO backlinks.”

The junk links did not lift our Ahrefs Domain Rating at all, which shows how little weight Ahrefs gives them. Whether Google ignores them too is harder to say. uwawp.com is a young site, and it does not yet rank for some searches you would expect, even the names of our own plugins. That could simply be because the site is new. It could be the spam. We cannot tell from the outside, and nobody else can either.

So we are treating it the way Google suggests: watch Search Console, keep building the site, and keep a clean record in case we ever need to disavow. We will share what happens in a separate case study.

How to spot a negative SEO attack

You do not need to check every day. For most sites, a quick look once a month is enough.

• Start with the Manual actions report in Search Console. It matters most. If Google has taken action against your site, it shows here, under Security & Manual Actions. Google also sends a message in Search Console when it happens. An empty report means no human reviewer has flagged your site. See Google’s guide to the Manual actions report.
• Then open the Security issues report, right next to it. It warns you if Google has found hacked content or malware on your site.
• Look for a sudden jump in new linking domains. Search Console’s Links report shows your top linking sites. Ahrefs and Semrush show new referring domains by date, so a spike is easy to see.
• Check for copies. Search Google for a unique sentence from one of your posts, in quotes. If other sites come up with the same text, they copied it.
• Search site:yourdomain.com and scroll through the results. Pages you never wrote, often about pills or casinos, are a sign of hacking.
• Watch your traffic, but do not panic over a drop. It can come from a Google update or a technical mistake. Check the reports above before blaming an attack.

How to stop a negative SEO attack on WordPress

1. Lock down WordPress first

Hacking is the attack that actually works, so start here.

• Keep WordPress, themes and plugins updated. Delete the ones you do not use.
• Use strong passwords and two-factor login for every admin account.
• Install a security plugin that scans for changed files and blocks repeated login attempts.
• Keep regular backups stored off your server, so you can roll back a hack quickly.

If you do find hacked content, clean it up, fix the hole the attacker used, then ask Google to review the site through the Security issues report.

2. Deal with copied content

Most copies are harmless and do not need any action. If a copy is outranking you, contact the site’s host or file a copyright removal request with Google. Linking between your own posts also helps Google see which version is the original.

3. Handle spam links calmly

For most sites, the right move is to do nothing. Google already ignores most spam links. Disavowing is a tool for a specific problem, and using it wrongly can hurt you.

Google’s advice is to disavow only when both of these are true:

• You have “a considerable number of spammy, artificial, or low-quality links” pointing to your site.
• Those links have caused a manual action, or likely will.

Google also asks you to try getting links removed first. It warns that “blindly adding all backlinks to the disavow file is not considered a good-faith effort.” So review what you add, and never disavow real links from real sites.

4. Keep a record

If you do disavow, keep notes on what you added, when, and why. Months later, you will want to know whether a line came from a real attack or a panic one afternoon. A plain text file has no memory of that.

Where Spurn fits in

We built Spurn, a free WordPress plugin, for exactly that last step. You paste in backlink exports from Ahrefs, Semrush or Search Console. Spurn picks out the domains and links, drops repeats, and shows you the new ones to review. Risky entries, like whole blog platforms or big sites such as Wikipedia, start unticked so they do not slip in by mistake. Each batch is saved with its date, source and reason, and Spurn exports a file in Google’s format when you are ready.

Spurn does not decide what counts as spam for you, and it does not upload anything to Google. Its job is to keep your disavow file accurate and remember where each line came from. It is free on WordPress.org. You can also read why we built Spurn or go through the Spurn docs.

Negative SEO FAQ

Can a competitor get my site banned from Google?

It is very unlikely through links alone. Google says it works to stop third-party actions from hurting your site, and it can judge which links to trust. Hacking is the bigger risk, so keep WordPress secure.

Should I disavow every spam link I find?

No. Google says most sites never need to disavow. Use it if you have a manual action for unnatural links, or a large number of bad links you think will cause one. Review every entry before you add it.

How long does it take to recover from a manual action?

It depends on how fast you fix the problem. After you clean up and send a review request, Google says link-related requests can take longer than usual to process. You will hear back in Search Console.

Does Google penalize sites for spam links they did not build?

Generally no. Google says its systems are very good at detecting spam. When Google’s disavow page describes harmful links, its example is links you, or an SEO you hired, built or paid for.