This is a cross-year consolidation of 26 Google Search Central blog posts from 2016–2024 on webspam, site reputation, hacked sites, link spam, manual actions, and disavow. Instead of summarizing post by post, it reorganizes the material by "policy semantics" — so that when you make strategic judgments, you can read the complete framework directly without flipping back through a chronological timeline.
The source file path is listed in the frontmatter sources: field (all paths are relative to ~/kb/).
TL;DR in three sentences
- 2024 was a watershed year: Google systematically expanded its spam policies for the first time beyond "traditional links/cloaking/hacked sites" to three new clauses targeting gray-hat SEO industry practices — expired domain abuse(expired domain reuse),scaled content abuse(large-scale AI-generated content),site reputation abuse(parasite sites / the Forbes Coupons playbook). In November 2024, Google further tightened the wording around site reputation, closing the whitewashing loophole of "white-label partnerships / joint ventures / partial ownership."
- SpamBrain (2018) is the underlying infrastructure; every spam update after 2021 is built on it. Compared to 2020, 2021 caught 6x more spam sites; compared to 2021, 2022 caught 5x more; link spam detections in 2022 were 50x higher; hacked spam detections were 10x higher. SpamBrain is not just a "classifier" — it is a reused "anti-abuse robust platform" (used for harassment, product reviews, scams, and more).
- Google has repeatedly emphasized that most people do not need to use disavow or spam reports. Spam reports are only used to "improve algorithms,"and are not the primary path to triggering manual actions (explicitly stated in the July 2020 policy update). Disavow follows the same logic in this narrative — algorithms already nullify 90% of link spam, and most site owners who take manual action will only harm themselves.
Part 1 — Three New 2024 Policies: Site Reputation Abuse + Scaled Content + Expired Domain
On March 5, 2024, the March 2024 core update and spam update were released on the same day, and Chris Nelson announced three new spam policies, marking Google's first systematic response to three new black-hat tactics prevalent in the industry in 2022–2023: "parasite SEO," "floods of AI content," and "expired domain relaunches."
Source: 2024/03/core-update-spam-policies.en.md;2024/11/site-reputation-abuse.en.md
1.1 Site Reputation Abuse (Parasite Sites / Parasite SEO)
Original definition (2024-03):
"Site reputation abuse is when third-party pages are published with little or no first-party oversight or involvement, where the purpose is to manipulate Search rankings by taking advantage of the first-party site's ranking signals."
Typical manifestation — high-authority publications (Forbes, CNN, news portals) place/coupons/, /casino-reviews/, /best-vpn/ and other subdirectories in the hands of third parties, who place low-quality content to rank using the parent site's authority.
Key dates:
- 2024-03-05: Policy announced, enforcement delayed until 2024-05-05 to give sites a buffer period
- 2024-11-19:Policy language tightened(see below)
- 2025-01-21: "Editorial changes" made based on FAQ feedback; substance of the policy unchanged
Core action of the November 2024 tightening — closing the "first-party involvement" whitewashing loophole:
"no amount of first-party involvement alters the fundamental third-party nature of the content or the unfair, exploitative nature of attempting to take advantage of the host's sites ranking signals."
The new language is simplified to:
"Site reputation abuse is the practice of publishing third-party pages on a site in an attempt to abuse search rankings by taking advantage of the host site's ranking signals."
Several key judgment points from the FAQ (added in December 2024 + incorporated into the formal policy in January 2025):
| Question | Answer |
|---|---|
| Is freelance content a violation? | No — unless there is ALSO intent of "taking advantage of the host site's ranking signals" |
| What about affiliate content? | No — as long as rel="sponsored" is marked |
| What about coupon sections? | It depends on "active or close involvement" — a publisher sourcing content directly from merchants versus accepting white-label services are two completely different situations |
| Will a manual action be automatically revoked after adding noindex? | No; you still need to address the manual action and submit a reconsideration request |
| What if I move the content to a subdomain / subdirectory? | That will not work; it will be considered "circumvention" and may trigger "broader actions against a site" |
| What if I move it to an entirely new domain with no reputation? | That is OK, provided the new domain has no established reputation and does not violate other spam policies |
| What about a 301 redirect from the old domain to the new one? | Do not do it; it will carry the site reputation abuse problem over to the new domain |
| What about links from the old domain to the new one? | Use rel="nofollow" |
Algorithm-level coordination(mentioned in November 2024):
"we also have systems and methods designed to understand if a section of a site is independent or starkly different from the main content of the site. By treating these areas as if they are standalone sites, it better ensures a level playing field..."
— This means that even without a manual action, parasite subdirectories will be automatically stripped of site-wide signals, causing traffic drops, but Google explicitly states: "this doesn't mean these sub-sections have been demoted or are in violation of our spam policies. It means we're measuring them independently."
1.2 Scaled Content Abuse (Large-Scale AI-Generated Content)
Definition:
"Scaled content abuse is when many pages are generated for the primary purpose of manipulating Search rankings and not helping users... no matter how it's created."
Key policy intent — upgrading the old "auto-generated content" policy to "make no distinction between human / automated / hybrid":
"Our long-standing spam policy has been that use of automation, including generative AI, is spam if the primary purpose is manipulating ranking in Search results. The updated policy is in the same spirit of our previous policy and based on the same principle. It's been expanded to account for more sophisticated scaled content creation methods where it isn't always clear whether low quality content was created purely through automation."
— In plain language: if you hire 100 outsourced writers to mass-produce SEO advertorials, that is treated the same as using GPT to mass-produce advertorials —both are considered spam. Google no longer gets hung up on whether content was "written by AI or by humans."
Consistent with the February 2023 AI content guidance(cited in the 2023 webspam report):
"if AI is used for the primary purpose of manipulating search rankings, that's a violation of our long-standing policy against spammy automatically-generated content."
1.3 Expired Domain Abuse (Expired Domain Reuse)
Definition:
"Expired domain abuse is where an expired domain name is purchased and repurposed primarily to manipulate Search rankings by hosting content that provides little to no value to users."
Classic example(given in the original text):
"someone might purchase a domain previously used by a medical site and repurpose that to host low quality casino-related content, hoping to be successful in Search based on the domain's reputation from a previous ownership."
Key boundary:
"It's fine to use an old domain name for a new, original site that's designed to serve people first."
— Using an expired domain for a legitimate business is fine, but specifically buying expired domains and stuffing them with spam content is spam. Google explicitly states this "isn't something people accidentally do" — it is an industry-chain behavior.
Part 2 — Link Spam: Evolution from Penguin to the 2022 Link Spam Update
2.1 Timeline
| Time | Event | Key point |
|---|---|---|
| 2016-09 | Penguin 4.0 goes real-time | No longer a "periodically running algorithm," but part of core ranking |
| 2017 annual report | Doubled efforts to remove unnatural links | Link spam down ~50% year over year |
| 2018 annual report | Continued to nullify bad links | Emphasized that "creating good content is more important than studying link myths" |
| 2019-09 | Evolution of rel="nofollow" | Introduced rel="sponsored" and rel="ugc"; all three became hints rather than directives |
| 2020 annual report | 90%+ of link spam already caught by algorithms | Paid links and link exchanges already "made less effective" |
| 2021-07-26 | Link Spam Update | Primary target: affiliate links not marked with rel="sponsored" plus sponsored/guest posts; two-week rollout, across multiple languages |
| 2022-12-14 | December 2022 Link Spam Update | First time SpamBrain took over link spam; two-week rollout,all languages; simultaneously targeted link-buying sites and outgoing pass-through sites |
| 2022 annual report | Caught 50x more link spam sites than in 2021 | Validated the effectiveness of SpamBrain's takeover |
2.2 Google's Repeatedly Emphasized Stance on Links (verbatim quotes by year)
2018 annual report — manifesto against "link-building myths":
"We continued to remind website owners that if you simply stay away from building links mainly as an attempt to rank better and focus on creating great content, you should not have to worry about any of the myths or realities."
2019 annual report — nofollow evolution:
"Originally introduced as a means to help fight comment spam and annotate sponsored links, the 'nofollow' attribute has come a long way. But we're not stopping there."
Enforcement details of the July 2021 link spam update:
- All affiliate links must be
rel="sponsored",whether added manually or generated dynamically - Accepted sponsored / guest posts must also be tagged
- Failure to tag → can trigger both manual actions and algorithmic actions
- "Both manual and algorithmic actions may affect how we see a site in Search"
Precise wording of the December 2022 SpamBrain link update:
"Besides using it to detect spam directly, it [SpamBrain] can now detect both sites buying links, and sites used for the purpose of passing outgoing links."
— Note the phrase "used for the purpose of passing outgoing links": even if you did not accept money yourself, as long as SpamBrain determines you structurally serve outgoing link passing, you will be penalized.
2.3 Complete quick reference table for link tagging
| Scenario | What to use |
|---|---|
| Paid links, affiliate links | rel="sponsored" |
| User-generated content (comments / forums) | rel="ugc" |
| Do not want to endorse but it is not an advertisement | rel="nofollow" |
| Multiple scenarios | Combinations such as rel="ugc sponsored" are allowed |
| Default normal citation | No rel needed |
Since September 2019, Google treats all three as hints, not directives — meaning Google may still selectively count them for ranking.
Part 3 — Hacked Sites / Malware: The nohacked Series + Recovery Process
3.1 The full nohacked knowledge package (4 posts in the 2017 series + 2018 Japanese version)
| Subtopic | Source |
|---|---|
| Detection chapter(How do I know if my site is hacked?) | 2017/12/nohacked-30-how-do-i-know-if-my-site-is |
| Prevention chapter(Tips on prevention) | 2017/12/nohacked-30-tips-on-prevention |
| Recovery chapter(Fixing common hack cases) | 2017/12/nohacked-30-fixing-common-hack-cases |
| Resources chapter(Useful resources, non-English versions only) | 2017/12/nohacked-30-more-resources |
| Japanese special article on hack-resistant practices | 2018/03/strong-protection-against-hacking |
3.2 Three typical types of hack cases (repeatedly mentioned in the 2017 annual report + nohacked series)
| Name | Pattern | Link to recovery guide (under web/fundamentals/security/hacked) |
|---|---|---|
| Gibberish Hack | Automatically generates large numbers of gibberish keyword pages → users who click are redirected to pornographic / spam sites | fixing_the_gibberish_hack |
| Japanese Keywords Hack | Generates Japanese pages in random directories, hosting counterfeit goods affiliate links; sometimes adds hacker accounts as Search Console site owners | fixing_the_japanese_keyword_hack |
| Cloaked Keywords Hack | Uses cloaking so pages show spam when crawled but appear as 404 or normal pages when visited by users | fixing_the_cloaked_keywords_hack |
3.3 Six detection actions (December 2017 how-do-i-know)
- Check Google Search warning types:
This site may be hacked(serving ads) /This site may harm your computer(serving malware) / red screen (malware/unwanted software/deceptive site / phishing) - Distinguish Malvertising vs Hack: Malvertising means bad ads are loaded on the page, not that the site itself has been modified
- Check for open redirects(that whole OWASP unvalidated redirects thing)
- mobile incognito self-check — some bad ad networks only trigger on mobile devices
- Verify in Search Console + check messages(critical!)
- If unsure, ask an expert or post in the Webmaster Help Forums
2017 annual report data: hacked sites up 32% year over year(2016 vs 2015 was +180%);61% of hacked webmasters never received a Google notification — because they had not registered for Search Console (2017-03 nohacked year in review)
3.4 Three things for prevention (2017-12 prevention)
- Understand the most common intrusion paths(top_ways_websites_get_hacked_by_spammers)
- Be cautious with free versions of paid plugins / themes — "premium plugins available without payment" are backdoors 99% of the time
- WordPress / Joomla botnet protection — even if there are no visible changes, your site may already be inside a botnet running spam / DDoS / clickbot activity
3.5 Recovery process
- Detect → locate the intrusion point
- Clean up (follow the corresponding fixing guide for the hack type)
- filing for reconsideration request(2017 annual report data:84% of reconsideration requests were ultimately successfully cleaned)
- Google algorithms re-evaluate, warning is lifted
3.6 Hacked spam data in the SpamBrain era
| annual report | data |
|---|---|
| 2018 annual report (2017 data) | "detect and remove from search results more than 80% of these sites" |
| 2019 annual report (2018 data) | hacked spam impact "continued to decline", faster detection |
| 2020 annual report (2019 data) | hacked spam was more stable than in previous years; co-signed by Cherry Prommawin + Duy Nguyen |
| 2021 annual report (2020 data) | detection capability +50%, "removed most of the hacked spam" |
| 2022 annual report (2021 data) | hacked spam reduced by 70%(SpamBrain gets the main credit) + gibberish spam on hosting platforms reduced by 75% |
| 2023 annual report (2022 data) | hacked site detection 10x improvement vs 2021 |
Part 4 — Manual Actions + Reconsideration Process
4.1 Google's internal narrative on manual actions
Webspam annual reports over the years have repeatedly stated the same structure:
algorithmic systems are the main force + manual actions are supplementary + Search Console notifications are the only official communication channel + reconsideration is the path out of penalty
Specific data evolution (raw numbers extracted from annual reports):
| Year | Number of manual actions | Data point |
|---|---|---|
| 2015 annual report | 4.3M messages | 4.3M messages total all included manual actions |
| 2016 annual report | 9M+ messages / 10,000+ structured data sites received manual actions | "took manual action on more than 10,000 sites that did not meet the quality guidelines for inclusion in search features powered by structured data" |
| 2017 annual report | 6M+ messages related to manual actions (out of 45M total messages) | |
| 2018 annual report | 4M+ manual actions (out of 186M total messages, 96M successfully delivered) | |
| 2019 annual report | 4.3M manual actions (out of 90M+ total messages) | |
| 2020 annual report | 2.9M manual actions (out of 140M+ total messages) | Key inflection point: manual actions continued to decline because "many spam issues have already been taken care of by our algorithms" |
— this curve makes one thing clear:Google has long wanted to exit the manual action business, and hand enforcement entirely over to algorithms / SpamBrain.
4.2 Reconsideration success rate reference
- 2015 annual report: reconsideration requests +33%
- 2017 nohacked year in review:84% of reconsideration requests were ultimately successfully cleaned(hacked sites dimension)
4.3 Three high-incidence manual action scenarios (excerpted from Webmaster Guidelines)
- link schemes(2018 annual report / 2021 link tagging / 2022-12 link spam update)
- non-compliant structured data(10,000+ sites hit in the 2016 annual report)
- third-party spam (this site's forum / hosting / file uploader / internal search abused by spammers)(2021-05 prevent portions of site from spam — this article specifically covers this)
4.4 How to save your site when third parties abuse it (2021-05 prevent portions)
Full checklist:
- block automated account creation — reCAPTCHA / Securimage / Jcaptcha + email verification + blacklist suspicious domains
- Turn on moderation features — new users require review, disallow anonymous posts, links require a reputation threshold
- monitor spam content:
- Register for Search Console + check Security Issues + Manual Actions report
- Use
site:your-domain-name viagrathis type of query to check - Run Google Alerts for
site:your-domain-name spammy-keywords - Check server logs for traffic spikes
- Identify and terminate spam accounts — mass registrations in a short time, same IP range, strange user agents, commercial usernames
- noindex or disallow untrusted content —
<meta name="googlebot" content="noindex">or robots.txtDisallow: /guestbook/ - Tag UGC links with
rel="ugc"orrel="nofollow" - Concentrate UGC under a single subdirectory —
example.com/user-generated-content-dir-name/rather thanexample.com/best-online-pharma-buy-red-viagra-online - Keep CMS updated — Akismet / security plugins
Key quote: "Low-quality content on some parts of a website can impact the whole site's ranking." — subdirectory spam drags down the whole site, and is two sides of the same coin as site reputation abuse.
Part 5 — Policy Intent of the Disavow Tool (Why Google Repeatedly Says "Most People Don't Need It")
None of the 26 articles is specifically about disavow, but multiple places repeatedly convey the same official line:
5.1 Policy positioning of spam reports — the only dedicated piece in 2020-07
Source: 2020/07/how-spam-reports-are-used-at-google.en.md (authored by Gary Illyes)
One core sentence(updated to quality guidelines in 2020-07):
"we use spam reports only to improve our spam detection algorithms"
Gary's defensive logic:
"Most of the time, it's much more impactful for us to fix an underlying issue with our automated detection systems than it is to take manual action on a single URL or site." "In theory, if our automated systems were perfect, we would catch all spam and not need reporting systems at all."
— this policy can be directly mapped to the semantics of disavow: Google's stance is "we already automatically nullify it, don't worry about it unnecessarily."
5.2 Position of disavow in the 2020 annual report — a tool description, not the main battlefield
Source: 2021/05/working-with-you-for-safe-and-spam-free-search-2020.en.md
The Disavow links tool is mentioned in the context of being one item in the Search Console tool list, appearing alongside the "new version of the Crawl stats report" and "SafeSearch filtering report" — it is no longer positioned as a core SEO strategic tool.
5.3 The repeatedly restated "three link myths debunked"
Across many years (2018/2019/2021/2022 annual reports + 2021-07 link spam update), Google used nearly identical wording to dissuade use of disavow:
| Myth | Google's direct rebuttal |
|---|---|
| "You must disavow bad links" | 2018 annual report: "algorithms... made a number of bad linking practices less effective for manipulating ranking" |
| "I have to manually manage my backlink profile" | 2019 annual report: "if you simply stay away from building links mainly as an attempt to rank better and focus on creating great content, you should not have to worry" |
| "Negative SEO attacks require disavow for defense" | 2020 annual report: "more than 90% of link spam was caught by our systems" |
| "After the 2022 link spam update I have to self-check my disavow file" | 2022-12 update:"As we have always emphasized, links obtained primarily for artificial manipulation of Search rankings are link spam. Our algorithms and manual actions aim to nullify these unnatural links at scale" |
— The policy intent is very clear: Google does not want webmasters spending energy on disavow, because (a) algorithms already nullify most cases; (b) webmasters randomly disavowing on their own may actually hurt good links; (c) the disavow tool exists primarily for webmasters who "intentionally built spam links in the past and now want to clean up their record."
Part 6 — Deceptive Behaviors:back button hijacking / deceptive downloads
6.1 Evolution of Safe Browsing coverage
| Year | New Safe Browsing coverage added | Source |
|---|---|---|
| 2007 | webmaster tools integration | historical review |
| 2015 | Deceptive Sites + Unwanted Software | 2016-09 citation |
| 2016-02 | deceptive download buttons | 2017 annual report citation |
| 2016-11 | repeatedly dangerous sites | 2017 annual report citation |
| 2017-03 | macOS protection extension + Chrome predictive phishing protection | 2018 annual report citation |
| 2017-12 | mobile unwanted software | 2018 annual report citation |
| 2018-01 | deceptive Chrome extension installation | 2018 annual report citation |
| 2020-2021 | Countering customer support scams / tech support scams (expanded to hundreds of millions of searches/yr) | 2021 annual report |
6.2 Six categories of the Search Console Security Issues report (2016-09)
Source: 2016/09/more-safe-browsing-help-for-webmasters.en.md
The updated Security Issues report provides 6 types of specific explanations:
- malware
- deceptive pages(social engineering)
- harmful downloads
- uncommon downloads 5. (+ inferred sub-items such as phishing / unwanted software)
Each category is paired with: tailored recommendations + sample URLs + remediation actions.
6.3 Safe Browsing Site Status Tool(2017-03)
Source: 2017/03/updates-to-google-safe-browsings-site.en.md
The new UI provides simpler clearer results, target users: "people who are visiting the tool from a Safe Browsing warning they've received, or doing casual research on Google's malware and phishing detection". Technical details (AS / ASN) were moved to the malware dashboard.
6.4 Mobile sneaky redirects + back-button hijacking patterns
Source: 2017 annual report
Trends observed in 2016:
"we saw a rise in spam that redirects users, without the webmaster's knowledge, to other sites or pages, inserted into webmaster pages using widgets or via ad units from various advertising networks."
— This is the landmark mention of back-button hijacking / sneaky mobile redirects in the annual reports. Google has continuously cracked down on this since 2017.
6.5 Scams & Fraud (2020 annual report + 2021 annual report)
customer support scam / tech support scam was a new topic added in the 2020 annual report:
"many scammers pretend to be offering customer support phone numbers to popular services and products, only to trick users who call in into paying them via bank transfers or gift cards."
Data:
- Systematic protection began in 2018+, with hundreds of millions of searches protected each year
- 2021: scam coverage expanded by another 40%
- 2022: expanded to all languages; clicks on scam sites year-over-year -50%
6.6 Online Harassment (added in the 2021 annual report)
Source: 2022/04/webspam-report-2021.en.md
SpamBrain was extended to harassment scenarios, for name queries, "reduce the prominence of sites with exploitative removal practices" (referring to mugshot sites and similar sites that charge fees to remove negative history).
Part 7 — Historical lessons: from old link schemes to the current framework
7.1 Evolution of "old language → new language" in webspam annual reports
| Time period | Mainstream spam types (mentioned in the first paragraph of the annual report) | Primary tools / systems |
|---|---|---|
| 2015 annual report | hacked sites(+180%)+ thin/low-quality content | algorithms + manual actions + 4.3M messages |
| 2016 annual report | hacked +32% + mobile sneaky redirects + CMS UGC abuse | Penguin 4.0 real-time rollout + 9M messages |
| 2017 annual report | hacked spam(detect & remove 80%+)+ CMS UGC + link scheme | "unnatural links down 50% year-over-year" + 45M messages |
| 2018 annual report | hacked + user-generated spam(-80%)+ link spam | changed rel=nofollow → sponsored/ugc; 186M messages |
| 2019 annual report | scraped/auto-gen content(-60% impact)+ scam/fraud | 90M messages,manual action 4.3M |
| 2020 annual report | SpamBrain made its public debut + AI-based spam fighting | 99% spam-free + auto-gen sites -80% + 140M messages |
| 2021 annual report | SpamBrain (+6x sites) + link spam update + harassment expansion | hacked -70%,gibberish on hosting -75% |
| 2022 annual report | SpamBrain link spam +50x,hacked +10x;AI content guidelines published | scam clicks -50% |
| 2023 (October spam update) | cloaking + hacked + auto-generated + scraped content in languages including TR/VI/ID/HI/ZH | spam update |
| 2024-03 | Three major new policies launched + rolled out in sync with the March 2024 core update | Policy-driven rather than system-driven |
| 2024-11 | Tightened policy language for site reputation abuse | Closed the laundering channel via first-party involvement |
7.2 Key "lesson" quotes (suitable for direct citation in strategy PPTs)
"Content quality is the foundation of anti-spam"(2019 annual report):
"We think that one of the best ways of fighting spam of all types is by encouraging website owners to just create great quality content."
"The 99% spam-free rate has remained stable over the long term"(Repeated across 2018–2022 annual reports):
- 2017 data: "less than 1 percent of search results users visited are spammy"
- 2019 data: "well under 1 percent"
- 2020 data: "more than 99% of visits from our results lead to experiences without spam"
- 2021 data: "more than 99% of searches spam-free"
- 2022 data: "more than 99% of visits from Search are spam-free"
"40 billion spammy pages discovered every day"(2020 data, 2021 annual report) "25 Billion pages discovered each day are spammy"(2019 data, 2020 annual report) "SpamBrain 2018 launched, 200x more spam sites caught than launch baseline"(2022 annual report)
7.3 Evolution of SpamBrain itself (independent timeline)
| Time | Milestone |
|---|---|
| 2018 | SpamBrain first deployed (retroactively confirmed in later annual reports) |
| 2020-06 | First publicly named in the 2020 annual report "AI-based spam detection" |
| 2021 data | SpamBrain caught 6x sites vs 2020; hacked sites -70%, gibberish spam -75% |
| 2022-04 | Officially named "SpamBrain" in the 2021 annual report; expanded to cover harassment + product reviews + scams |
| 2022-12 | SpamBrain Took over link spam(link spam update by SpamBrain) |
| 2022 data | 5x sites vs 2021; link spam 50x; hacked sites 10x; crawling-time spam speed improved |
| 2023-10 | Spam update focused on multilingual (TR / VI / ID / HI / ZH) cloaking + hacked + auto-generated + scraped content |
| 2024-03 | March 2024 spam update released alongside three major new policies |
7.4 Evolution of Search Console / Removals report and related tools
Source: 2020/01/new-removals-report-in-search-console.en.md
Three major functions of the Removals report(Launched 2020-01):
- Temporary removals — Hide URLs for ~6 months (buy time to find a permanent solution)
- Temporary remove URL: hide from results + clear cache
- Clear cache URL: only clear cache + clear snippet
- Outdated content — Public submissions via the Remove Outdated Content tool, reporting "this content is no longer on the page"
- SafeSearch filtering — History of adult content marked by users via the SafeSearch Suggestion tool
— This is a "temporary stopgap" tool for site owners dealing with hacked spam / third-party spam, used in conjunction with long-term manual actions / reconsideration requests.
Appendix A: Cross-year webspam annual report data cards
Convenient for direct citation when giving talks / writing reports.
| Data point | 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 |
|---|---|---|---|---|---|---|---|---|
| User spam reports | 400K | 180K | 90K | 180K | 230K | n/a | n/a | n/a |
| Reported acted-on rate | 65% | 52% | n/a | 64% | 82% | n/a | n/a | n/a |
| Hacked sites year-over-year | +180% | +32% | -80% impact | Continuously ↓ | Stable | -Large drop | -70% | -10x detect |
| Manual actions | 4.3M | 10K (structured) | 6M+ | 4M+ | 4.3M | 2.9M | n/a | n/a |
| Total messages sent to site owners | 4.3M | 9M+ | 45M | 186M | 90M+ | 140M+ | n/a | n/a |
| Spam pages discovered/day | n/a | n/a | n/a | n/a | 25B | 40B | n/a | n/a |
| Spam-free rate | n/a | n/a | <1% spam | <1% spam | <1% spam | >99% clean | >99% clean | >99% clean |
Appendix B: Index of core Spam policy reference pages
Direct paths (all are developers.google.com/search/docs/...):
- Spam policies overview:
/search/docs/essentials/spam-policies - Link spam section:
/search/docs/essentials/spam-policies#link-spam - Site reputation section:
/search/docs/essentials/spam-policies#site-reputation - Scaled content section:
/search/docs/essentials/spam-policies#scaled-content - Expired domains section:
/search/docs/essentials/spam-policies#expired-domains - Policy circumvention section:
/search/docs/essentials/spam-policies#policy-circumvension - Qualify outbound links:
/search/docs/advanced/guidelines/qualify-outbound-links - Report spam:
/search/docs/advanced/guidelines/report-spam - Manual actions report doc:Search Console help / answer 9044175
- Reconsideration request:Search Console help / answer 35843
- Helpful Content FAQ:
/search/help/helpful-content-faq
Appendix C: Scope of this wiki
This wiki does not cover:
- Algorithm system mechanisms (SpamBrain internal structure / Penguin historical details) → see Google ranking systems + Core/Spam Updates + business information establishment or Google public papers
- Core updates evolution (independent of spam updates) → see GSC Blog: Core Updates and Algorithm Iteration Evolution (2010–2026)
- E-E-A-T / Helpful Content policy perspective → see GSC Blog: Quality Policies and E-E-A-T Evolution (Webmaster Guidelines → Search Essentials)
- Search Console tool usage details (Disavow / URL Removal operations) → see Search Console + Analytics + Trends three-tool suite usage (traffic diagnostics / keyword research / Looker Studio)
- Scattered spam Q&A from Office Hours → see Google SEO Office Hours Highlights (2022.11–2024.08) + Compilation of 3 Major FAQ Topics
Two French/Japanese-only stub articles(This wiki skips their substantive content but retains them in the sources index):
- 2016/10/equipe-safe-browsing-nouvelle-documentation (French)
- 2018/03/strong-protection-against-hacking (Japanese)
- 2017/12/nohacked-30-more-resources (no English version; available in 8 languages: pt-BR/fr/ja/ru/zh-CN/th/zh-TW/tr)
Sources and related materials
- https://developers.google.com/search/blog/2016/05/how-we-fought-webspam-in-2015?hl=en
- https://developers.google.com/search/blog/2016/09/more-safe-browsing-help-for-webmasters?hl=en
- https://developers.google.com/search/blog/2016/10/equipe-safe-browsing-nouvelle-documentation?hl=en
- https://developers.google.com/search/blog/2017/03/nohacked-year-in-review?hl=en
- https://developers.google.com/search/blog/2017/03/updates-to-google-safe-browsings-site?hl=en
- https://developers.google.com/search/blog/2017/04/how-we-fought-webspam-webspam-report?hl=en
- https://developers.google.com/search/blog/2017/12/nohacked-30-fixing-common-hack-cases?hl=en
- https://developers.google.com/search/blog/2017/12/nohacked-30-how-do-i-know-if-my-site-is?hl=en
- https://developers.google.com/search/blog/2017/12/nohacked-30-more-resources?hl=en
- https://developers.google.com/search/blog/2017/12/nohacked-30-tips-on-prevention?hl=en
- https://developers.google.com/search/blog/2018/03/strong-protection-against-hacking?hl=en
- https://developers.google.com/search/blog/2018/06/how-we-fought-webspam-webspam-report?hl=en
- https://developers.google.com/search/blog/2019/03/this-year-in-search-spam-webspam-report?hl=en
- https://developers.google.com/search/blog/2020/01/new-removals-report-in-search-console?hl=en
- https://developers.google.com/search/blog/2020/06/how-we-fought-search-spam-on-google?hl=en
- https://developers.google.com/search/blog/2020/07/how-spam-reports-are-used-at-google?hl=en
- https://developers.google.com/search/blog/2021/04/how-we-fought-search-spam-2020?hl=en
- https://developers.google.com/search/blog/2021/05/prevent-portions-of-site-from-spam?hl=en
- https://developers.google.com/search/blog/2021/05/working-with-you-for-safe-and-spam-free-search-2020?hl=en
- https://developers.google.com/search/blog/2021/07/link-tagging-and-link-spam-update?hl=en
- https://developers.google.com/search/blog/2022/04/webspam-report-2021?hl=en
- https://developers.google.com/search/blog/2022/12/december-22-link-spam-update?hl=en
- https://developers.google.com/search/blog/2023/04/webspam-report-2022?hl=en
- https://developers.google.com/search/blog/2023/10/october-2023-spam-update?hl=en
- https://developers.google.com/search/blog/2024/03/core-update-spam-policies?hl=en
- https://developers.google.com/search/blog/2024/11/site-reputation-abuse?hl=en
- GSC Blog: Core Updates and Algorithm Iteration Evolution (2010–2026)
- GSC Blog: Quality Policies and E-E-A-T Evolution (Webmaster Guidelines → Search Essentials)
- Google SEO Office Hours Highlights (2022.11–2024.08) + Compilation of 3 Major FAQ Topics