A sudden drop in Google traffic feels like a penalty, and owners often call it one. Sometimes it is. Often it is something else, and the fix is different for each. Before anyone touches your site, find out which of these you are dealing with.
The four things people call a “Google penalty”
- A manual action. A person at Google reviewed your site and found it breaks Google’s spam policies. You get told: it shows in Search Console, and Google says that some or all of the site may stop showing in results.
- An algorithmic drop. Google’s automated systems, including its spam systems and its regular core updates, re-ranked your pages. Nobody sends a notice.
- A security issue. Your site was hacked or is serving malware. Google may show a warning next to your listing or in the browser.
- A self-inflicted problem. A redesign that lost pages without redirects, a “noindex” left on after launch, a blocked robots.txt, an expired domain or SSL certificate. Not a penalty at all, and very common.
The old version of this post also listed a “sandbox penalty” for new sites. Google does not document one. New sites rank slowly because they have not earned links, reviews and history yet, not because they are being held back.
Step 1: find out which one it is
You need Google Search Console. If nobody set it up for your site, do that first; it is free.
- Manual Actions report. Says “No issues detected” or names the problem and the pages it affects. Some actions cover the whole site, some only part of it.
- Security Issues report. Flags hacked content, malware and deceptive pages.
- Pages report (indexing). Shows whether pages dropped out of Google and why.
- Performance report. Gives the exact date the clicks fell.
Then compare that date with the Google Search Status Dashboard, where Google posts the start and end dates of its core and spam updates. A drop that lines up with an update, with nothing in the two reports above, is algorithmic. A drop that lines up with a site change is probably self-inflicted.
If it is a manual action
The report names the policy. Google’s spam policies are public, and these are the ones small businesses run into most:
- Link spam: buying links, link schemes, or a past SEO vendor who built junk links to your site.
- Scaled content abuse: many pages made mainly to rank, not to help anyone. Google names pages mass-produced with AI tools that add nothing as one example.
- Doorway abuse: near-identical pages built to catch searches, such as city pages that differ only by the town name.
- Site reputation abuse: hosting someone else’s content on your site, such as coupon or sponsored sections, mainly to borrow your site’s standing in search.
- Expired domain abuse: buying an old domain to ride its history with thin content.
- User-generated spam: spam left in your comments, forum or reviews section.
Fixing it means fixing all of it. Google says that cleaning up only some of the affected pages will not bring them back. Then file a reconsideration request from the same report. Google says a good request does three things:
- explains the exact issue on your site;
- describes the steps you took to fix it;
- documents the outcome, for example the spreadsheet of links removed and the pages rewritten or deleted.
Be honest and complete. Google says most reviews take several days or weeks, link-related ones longer, and that sending another request before you hear back only slows things down.
About the disavow tool: Google says most sites never need it. It is for a site with a considerable number of spammy, paid or artificial links that caused a manual action, or likely will. Used carelessly, it can throw away links that were helping you.
If it is an algorithm update
There is no request to file, because nothing was applied by hand. What to do depends on the update.
- A spam update. If your site was doing something on the spam-policy list, stop and clean it up. Recovery comes as Google’s systems pick up the change, and Google gives no fixed timeline.
- A core update. Google says core updates do not target specific sites and are not penalties. Your pages were reassessed against everything else on the web. Wait until the update finishes, then compare the pages that lost ground with the pages that now outrank them, and improve yours honestly: more useful, more specific, clearly written by people who know the subject. Google says some changes show in days, while others can take months or wait for the next core update.
Avoid quick fixes such as rewriting dates, padding pages or deleting large parts of the site in a panic. They rarely help, and some make things worse.
If your site was hacked
Clean it completely, close the hole that let the attacker in (often an outdated plugin, theme or password), and update everything. Then open the Security Issues report and click Request Review, describing what you fixed. Google says those reviews also take days to weeks. Keep backups and updates on a schedule so it does not happen twice; that is why the care and support behind our web design work covers platform, theme and plugin updates.
How to stay out of trouble
- Read Google’s spam policies once, or ask your agency to walk you through them.
- Never buy links, and be wary of any vendor who offers “guest posts” in bulk.
- Do not publish pages by the hundred, whether written by people or by tools, unless each one is useful on its own.
- Keep Search Console connected and the alert emails going to someone who reads them.
- Before a redesign, map every old URL to its new home with a redirect.
When to call for help
If you see a manual action for links, or a drop you cannot explain, get a second pair of eyes before you start deleting things. Clean-up done wrong costs more than the original problem. Our SEO team does this work the white-hat way and tells you in plain English what it found.
Want an outside view of where your site stands? Start with the free game plan: four questions, a plan on the spot, and then we review your business and build the full version.
