Rules, risks and algorithm updates

Last time

You learned how a search engine finds, crawls, indexes and ranks a page. Read day 01 again.

In this lesson

• Tell white hat, grey hat and black hat SEO apart, and say why these labels are not official.
• Name the main Google spam policies, and recognize link spam, cloaking, doorways, scaled content, site reputation abuse and expired domain abuse.
• Tell an automated demotion from a manual action, and follow the steps to recover from each.
• Explain the difference between a core update and a spam update.
• Check if a traffic drop comes from an update or from your own site.

Day 01 showed how search works when everyone follows the rules. This lesson shows what happens when someone does not, and what happens when Google changes its systems. Both can remove your traffic. Only one of them is a penalty.

White hat, grey hat and black hat

SEO writers often put tactics into three groups:

Label	What it means	Risk
White hat	Tactics that follow the search engine rules and help users.	Low
Grey hat	Tactics that no rule names, but that try to manipulate rankings.	Medium, and it can change
Black hat	Tactics that break the rules on purpose to manipulate rankings.	High

These labels come from the SEO industry, not from Google or Bing. Neither search engine uses them in its rules. The grey zone is the most important idea here. A grey tactic can work today and become a named violation after the next policy change. For example, Google added three new spam policies in March 2024: expired domain abuse, scaled content abuse and site reputation abuse. Tactics that were “grey” on one day were spam on the next.

The useful test is not the hat colour. Google gives the test in its own definition. Spam is any technique “used to deceive users or manipulate our Search systems into featuring content prominently.” Since May 15, 2026, that definition also includes “attempting to manipulate generative AI responses in Google Search,” for example AI Overviews and AI Mode. So the GEO tactics from day 01 are under the same rules.

The spam policies

A spam policy is a published rule that says which practice is spam. Google lists its policies on one page. Bing has a similar page, the Bing Webmaster Guidelines. A site that breaks a policy “may rank lower in results or not appear in results at all.”

Google’s list is long. The table groups the policies by the thing that they abuse.

What is abused	Google spam policies
Links	Link spam
What the crawler sees	Cloaking, hidden text and link abuse, sneaky redirects
Content at scale	Scaled content abuse, scraping, thin affiliation, keyword stuffing, doorway abuse
The reputation of a domain	Site reputation abuse, expired domain abuse
The user’s trust	Malicious practices (malware, back button hijacking), misleading functionality, scam and fraud
Things that happen to a site	Hacked content, user-generated spam
Google itself	Machine-generated traffic, for example scraping Google results to check ranks

Google also says that it “may act against any type of spam practices we detect,” not only the listed ones. The list grows. In April 2026, Google added back button hijacking: a site that stops the user from going back to the page that they came from.

The six policies in the next sections matter most for SEO work. They are the ones that SEO tactics break most often, and the roadmap names them.

Link spam (link schemes)

Link spam is “creating links to or from a site primarily for the purpose of manipulating search rankings.” The SEO industry often calls this a link scheme. Examples from Google:

• Buying or selling links that pass ranking credit, for money, goods or services.
• “Excessive link exchanges (‘Link to me and I’ll link to you’).”
• Automated programs that create links to your site.
• Optimized links in guest posts, press releases, forum signatures, widgets and site footers.

Paid links are not always spam. Google accepts that sites buy and sell links for advertising. The link must have a rel="nofollow" or rel="sponsored" attribute. Then it does not pass ranking credit. Day 06 teaches these link attributes and honest link building.

Link spam has one special risk. When Google removes the effect of spam links, “any ranking benefit the links may have previously generated for your site is lost.” You cannot get that benefit back. Google announced Penguin, a system against link spam, in 2012. It made Penguin part of its core ranking systems in 2016.

Cloaking and doorways

Cloaking is “presenting different content to users and search engines with the intent to manipulate search rankings.” An example is a page that adds keywords only when the user agent is a crawler. Two things are not cloaking. A paywall is fine if Google can see the full content and the site follows Google’s paywall guidance. A hacked site often uses cloaking without the owner knowing, so check for hacks too.

Doorway abuse is pages or sites “created to rank for specific, similar search queries” that send users to a less useful middle page. A common case is one page for each city, where each page only sends the user to the same final page. Day 09 shows how to make honest local pages.

Scaled content abuse

Scaled content abuse is “when many pages are generated for the primary purpose of manipulating search rankings and not helping users.” The key words are “no matter how it’s created.” AI tools are one example, but people can also write scaled spam. Other examples are scraped feeds, auto-translated or synonym-swapped copies, and pages that “make little or no sense to a reader but contain search keywords.”

This policy replaced Google’s older rule on automatically generated content. Google says the principle did not change: automation, including generative AI, “is spam if the primary purpose is manipulating ranking.” AI-written content is not spam by itself. Bing says something similar. Its guidelines say that large-scale content “without oversight, quality control, or editorial review” may be excluded from the index.

Site reputation abuse

A strong site has earned ranking signals from its own content. Site reputation abuse is when a host site publishes third-party content “mainly because of that host’s already-established ranking signals.” An example is a medical site that hosts a “best casinos” page from an advertiser. The page is not part of the site, and it is there only to rank.

Third-party content alone is not a problem. Google names safe cases: news syndication, wire services, forums, editorial columns and clearly marked affiliate links. Google checks how much the host controls the content. It looks at the design, the quality, the authorship, and if the same text is on many other sites.

The rules are different in the European Economic Area (EEA). Outside the EEA, Google can give a manual action. Inside the EEA, Google can rank the third-party section separately from the main domain, without a manual action. Google’s spam policy page explains both cases.

Expired domain abuse

A domain keeps some reputation after its owner lets it expire. Expired domain abuse is buying an expired domain and using it “primarily to manipulate search rankings by hosting content that provides little to no value to users.” Google’s example is casino content on a former school site. Google also says: “It’s fine to use an old domain name for a new, original site that’s designed to serve people first.”

How Google enforces the rules

Google uses two methods:

1. Automated systems. They run all the time on all sites. Google’s main AI-based spam system is SpamBrain. An automated demotion gives you no message.
2. Human review. A person at Google checks the site and can give a manual action. You get a message in Google Search Console.

Most spam is caught by the automated systems. Google says its algorithms “are extremely good at detecting spam.” In April 2026, Google also said that it can now use spam reports from users to take manual action.

Bing works in a similar way. Its guidelines were rewritten in February 2026. A site must now be eligible for grounding and citations in Copilot answers, as it must be for indexing and ranking. A site that breaks the guidelines can lose more than its rank.

Manual actions and recovery

A manual action is a penalty that a person at Google gives a site that breaks a spam policy. Search Console has a Manual actions report. It shows each action, its type, and the pages that it affects. An action can affect a few pages or “the entire site.”

To recover, do these steps:

1. Open the Manual actions report and read the type of each action.
2. Fix the issue on all affected pages. “Fixing the issue on just some pages will not earn you a partial return.”
3. Make sure that Google can reach the pages. They must not need a login or be blocked by robots.txt or noindex.
4. Select Request Review and send a reconsideration request.

A good reconsideration request does three things. It explains the exact issue. It describes the steps that you took to fix it. It documents the result. For unnatural links, Google wants a real attempt to remove the links first. Adding all links to the disavow file without trying is not enough. A review takes “several days or weeks,” and link cases can take longer. Do not send a second request before you get an answer.

If you bought a site that already had a manual action, fix it and say in the request that you are the new owner. Do not confuse this report with the Security Issues report. That report shows hacking, malware and phishing.

An automated demotion has no review request. Fix the issue. Then wait: Google’s systems may need “a period of months” to learn that the site now follows the policies.

Answer the three questions for a site that lost traffic. Notice that a manual action decides the result alone, and that a core update without a large drop needs no action.

Algorithm updates

An algorithm update is a change to how a search engine ranks pages. Google makes many small changes every year, and most are not announced. Google announces the notable ones on the Google Search Status Dashboard. The two main kinds are core updates and spam updates.

	Core update	Spam update
What changes	“Significant, broad changes” to the ranking systems	Improvements to spam detection, for example SpamBrain
Who it targets	No specific site or page	Sites that break the spam policies
Is it a penalty?	No	It demotes spam, so yes in effect
What to do after a drop	Assess the whole site for helpful, people-first content	Check the site against each spam policy
How often (2025 to 2026)	Three times a year in 2025	Three times in 2026 before September

On the dashboard, recent core updates took 11 to 18 days to roll out. Spam updates in 2026 took from 19.5 hours to under 3 days. In October 2026, the September 2026 spam update has started but has no end date yet. Google also announces some narrow updates, for example the February 2026 Discover update.

Core updates

A core update does not punish a site. Google uses an image: a list of your 20 favourite restaurants. New restaurants open, and the list changes. A restaurant that moves down is not “bad.” Others are just better now.

So a core update has no quick fix. Google tells you to avoid “quick fix” changes. Instead, improve the content for users. A site may recover in a few days or in “several months.” Sometimes it must wait until the next core update.

The helpful content system

Google announced the helpful content system in 2022. It rewarded content made “by people, for people” and demoted content made mainly for search traffic. In March 2024, it “became part of our core ranking systems.” It is no longer a separate system or a separate update. Today, helpfulness is part of every core update.

Google gives questions to assess your content. Some warning signs of “search engine-first” content:

• You publish many pages on many topics, in the hope that some rank.
• You mainly summarize what others say, without adding value.
• You write to a word count. Google says it has no preferred word count.
• You change page dates to look fresh, but the content has not changed.

Google also asks three questions about each page. Who made it? How was it made, for example with tests or with AI? Why was it made? Google says “Why” is the most important. The answer must be “to help people,” not “to get search traffic.” Day 05 teaches E-E-A-T, the related idea of experience, expertise, authoritativeness and trust.

Tracking volatility

Volatility is how much the rankings move in a period of time. High volatility in a whole industry often means that an update is rolling out. Your own drop with a calm industry often means a problem on your site.

Use three sources:

• The Google Search Status Dashboard gives the confirmed start and end of each update.
• Volatility trackers check a fixed set of keywords every day. MozCast checks 10,000 keywords and shows a “temperature.” An uneventful day is about 70°F. Semrush Sensor is a similar tool. These trackers are third-party estimates, not Google data.
• Search Console shows your own clicks and positions.

Google gives a method for the comparison. First, wait until the update has finished. Then wait “at least a full week” more. Compare that week with a week before the update started. Look at web, image, video and news search separately. A small drop, for example from position 2 to 4, needs “no drastic action.” A large drop, for example from 4 to 29, needs a deeper assessment.

Scenario (example data)

Core update Spam update Problem on your site

Compare the week that starts on day

22

Example data. Pick a scenario, then move the compare week. Notice when the comparison is too early, and that a calm industry line with a sharp drop in your clicks points to your own site.

Measurement has its own day. Day 08 teaches Search Console reports and rank tracking in detail.

What matters most

1. Read the policy, not the label. The test is intent: are you trying to manipulate rankings or AI answers? Hat colours change; the policy page is the rule.
2. Know the six big policies. Link spam, cloaking, doorways, scaled content, site reputation abuse and expired domain abuse cover most SEO risk.
3. Check for a manual action first. It is the only case with a clear fix and a review request.
4. A core update is not a penalty. Improve the whole site for people, and be patient.
5. Compare the right weeks. Use the dashboard dates and a volatility tracker before you change anything.

Key terms

• White hat, grey hat, black hat: industry labels for tactics that follow the rules, push against them, or break them.
• Spam: techniques that deceive users or manipulate search systems or AI answers.
• Spam policy: a published rule that says which practice is spam.
• Link spam: links made mainly to manipulate rankings, also called a link scheme.
• Cloaking: showing search engines different content from what users see, to manipulate rankings.
• Doorway abuse: many similar pages made to rank for similar queries, which send users to a less useful page.
• Scaled content abuse: many pages made mainly to manipulate rankings, however they are made.
• Site reputation abuse: third-party content published on a host site mainly to use the host’s ranking signals.
• Expired domain abuse: using an expired domain’s reputation to rank low-value content.
• SpamBrain: Google’s AI-based spam detection system.
• Manual action: a penalty that a person at Google gives a site for a policy violation.
• Reconsideration request: a request to Google to review a site after you fix a manual action.
• Algorithm update: a change to how a search engine ranks pages.
• Core update: a broad change to Google’s ranking systems that does not target specific sites.
• Spam update: a notable improvement to Google’s automated spam detection.
• Helpful content system: a Google system for people-first content, now part of the core ranking systems.
• Volatility: how much rankings move in a period of time.

Exercise

Exercise · about 15 min

Audit one page and one update

Part A: audit a page against the spam policies.

1. Search Google for best [product] [your city], for example best coffee grinder Melbourne.
2. Open two organic results that are not big brands.
3. For each page, check these signs: links with optimized anchor text to shops, the same text with only the city name changed, many near-identical pages on the site, no author, and no sign that someone tested the products.
4. For each page, name the spam policy that is closest to any sign that you found, or write “none”.

Part B: read one update.

1. Open the Google Search Status Dashboard, then the Ranking history.
2. Pick the most recent core update. Write down its start date, end date and duration.
3. Write the two weeks that you would compare in Search Console, following Google’s method.
4. Open MozCast. Look for high temperatures in the days of that update.

Show a possible solution

Part A depends on the query. These matches are common:

• Optimized anchor text to shops, with no rel="sponsored" attribute: link spam.
• The same page for many cities with only the city name changed: doorway abuse.
• Many thin pages on many topics, with no author and no tests: scaled content abuse, and a weak answer to Google’s “Who, How and Why” questions.
• A “best” list on an unrelated, strong site, for example a news site with a casino page: possibly site reputation abuse.

Most pages show none of these signs. A sign is not proof. Only Google decides if a page breaks a policy.

Part B, an example with the May 2026 core update: it started on May 21, 2026 and ended on June 2, 2026, after 11 days and 21 hours. Wait at least a full week after June 2. Then compare a week such as June 3 to June 9 with the week before May 21, for example May 14 to May 20. MozCast temperatures in an update often rise above the calm level of about 70°F, but other events can also raise them.

Check yourself

A tactic is not named in any Google spam policy, but its only goal is to make a page rank higher. Which statement is the best advice?

It is white hat, because no rule names itIt is risky, because Google can act on any spam practice and adds new policies over timeIt is safe until Google sends a manual action

A site loses traffic during a core update. Search Console shows no manual action. Most pages fell from position 4 to position 25. What should the owner do first?

Send a reconsideration requestDelete the pages that droppedAssess the whole site with the helpful content questionsDisavow all backlinks

A news site lets an advertiser publish an unrelated, unauthored page about loans. Many other sites host the same text. Which policy fits best?

Expired domain abuseCloakingSite reputation abuseHidden text abuse

A link spam update removed the effect of the paid links to a site. The owner deletes the links. Why does the ranking not go back to the old level?

Google never lifts a spam demotionThe ranking benefit from the spam links is lost and cannot be regainedThe site must first send a reconsideration request

Your clicks fell sharply on one day. The Status Dashboard shows no update, and MozCast is about 70°F. What is the most likely cause?

A core update that Google did not announceA problem on your own site, for example a broken releaseA manual action, which always makes the industry calm

Sources

• Spam policies for Google web search (Google Search Central)
• Google Search spam updates and your site (Google Search Central)
• Google Search’s core updates and your website (Google Search Central)
• Creating helpful, reliable, people-first content (Google Search Central)
• A guide to Google Search ranking systems (Google Search Central)
• What web creators should know about our March 2024 core update and new spam policies (Google Search Central Blog, March 2024)
• Latest documentation updates (Google Search Central, read in October 2026)
• Manual actions report (Search Console Help)
• Google Search Status Dashboard: Ranking history (Google, read in October 2026)
• Bing Webmaster Guidelines (Microsoft Bing; the page needs JavaScript, so the lesson uses the report below)
• Bing adds GEO to official guidelines, expands AI abuse definitions (Search Engine Journal, February 2026)
• Google finishes rolling out the August 2026 spam update (Search Engine Journal, August 2026)
• Google spam policies now officially cover AI Overviews and AI Mode in Search (PPC Land, May 2026)
• MozCast (Moz) and Semrush Sensor (Semrush)
• White hat vs. black hat vs. gray hat SEO techniques (iConnect)

Next

Day 03 starts technical SEO: site structure, status codes, robots.txt, sitemaps, canonical tags, JavaScript rendering and page speed.