Most ranking drops have their own causes: a technical problem, a Google update, content that has fallen behind the competition. But there is a much rarer, and rather more unsettling, cause worth knowing how to recognise: negative SEO, a set of techniques deliberately used by third parties (usually a competitor, though not always) to try to damage another website's ranking, instead of improving their own.
Why negative SEO exists
In some cases it turns out cheaper to try to sink a well-ranked competitor than to beat them through your own work. It is a practice that goes against Google's guidelines (and in many cases against the law, depending on the technique used), and Google has strengthened its systems for detecting and neutralising it automatically over the years, but it still happens, especially in highly competitive industries where the gap between being on page one or page two means a meaningful economic difference.
The most common techniques
The most frequent forms of negative SEO include: suddenly building a mass of very low-quality links toward the target site (link spam, hoping Google will read that pattern as manipulation and penalise the site), scraping and republishing the target site's content across many other sites before Google indexes the original, trying to make the copied content look like the authentic one, creating hundreds of fake negative reviews on Google Business Profile, or even, in more aggressive cases, trying to compromise the site's technical security (injecting malicious content, generating massive fake traffic to trigger hosting security alerts).
How to tell a real attack from a normal drop
The clearest sign of negative SEO is a sudden, anomalous pattern that does not match anything you have done: a sharp increase in links from very low-quality or clearly spammy domains over a very short period, a strange spike in negative reviews within a few days with no real incident to justify them, or content identical to yours suddenly showing up on dozens of low-quality sites. A legitimate problem (algorithm update, your own technical error) rarely shows that kind of concentrated pattern unrelated to any change you made yourself.
Google is generally quite good at ignoring link spam
It is important not to panic: Google has spent years improving its ability to identify spam links and, in most cases, simply ignores them without letting them affect the target site's ranking. The disavow tool exists precisely for cases where a toxic link pattern is suspected to be having a real effect, but it is recommended to use it cautiously and only when there is reasonable evidence of real impact, not as an automatic preventive measure against any odd-looking link that shows up.
What to do if you suspect it is happening to you
The first step is documenting the pattern with screenshots and concrete data (date, volume, source of the suspicious links or reviews), not acting on gut feeling alone. Next, check Search Console for any manual action notification (negative SEO alone rarely triggers one, but it is worth ruling out). For fake reviews on Google Business Profile, they can be reported directly from the platform, flagging that they do not correspond to real customers. For copied content, there is the copyright infringement takedown process (DMCA) that can be filed directly with Google to request removal of the duplicate content infringing your rights from its results.
When to use the disavow tool
It is recommended to reserve it for cases where the volume of toxic links is high, recent, and clearly unrelated to any strategy of your own, and always after attempting, where possible, to contact the owners of those sites to request the link be removed. Using disavow indiscriminately, rejecting any link that looks suspicious with no real criteria, can in some cases do more harm than the problem it was meant to solve, because you risk also disavowing legitimate links that were adding value.
The best defence is still a solid foundation
A business with a healthy, diverse link profile, well-documented original content with clear authorship, and an online reputation built organically over time, is far more resistant to any negative SEO attempt than one with a weak foundation. In practice, investing in honest, sustained SEO is also the best protection against these attacks, because Google trusts sites with a consistent track record more, and trusts sites that show sudden, anomalous changes less.
An illustrative case: the flood of negative reviews overnight
A family restaurant well rated for years, with a 4.7 average on Google, woke up one day to fifteen one-star reviews all posted during the same early morning hours, all with generic text and accounts with no other prior activity on Google. The pattern was too obvious to be a coincidence: no real customer leaves a review at three in the morning on a random Tuesday. The business reported each of those reviews individually through the platform, documented dated, timestamped screenshots, and contacted Google Business Profile support explaining the pattern. Although the process took several weeks, most of those reviews ended up being removed for violating the platform's policies. In the meantime, the business decided not to panic or change anything about its usual strategy, precisely because the pattern clearly pointed to a one-off attack rather than a real service problem.
The importance of not overreacting
A common mistake when suspecting negative SEO is overreacting: suddenly changing the entire content strategy, de-indexing pages as a precaution, or mass-disavowing links without having analysed them one by one. These disproportionate reactions can cause more real damage to rankings than the attempted attack itself, which in most cases Google is already filtering automatically without any drastic intervention needed from the affected business.
How to protect the site before an attack happens
Besides reacting well once it has already happened, there are reasonable preventive measures: reviewing the link profile with some regularity to spot anomalous changes quickly, enabling hosting security alerts that flag unusual traffic spikes, and keeping recent backups of the site in case a more aggressive attack were to compromise the site itself. None of these measures is exclusive to preventing negative SEO, they are general good maintenance practices that also happen to reduce exposure to this specific kind of risk.
Step by step: documenting and reporting a negative SEO attack
If an ongoing attack is suspected, it is worth acting in order rather than reacting all over the place. First, export the complete link profile (dated) using the available analysis tool, to have an exact snapshot of the moment. Second, filter links by creation date and isolate the ones that have appeared during the suspicious period, noting each one's source domain. Third, for suspicious reviews, take screenshots with visible date and time before reporting them, because once reported and hidden they can no longer be checked as evidence. Fourth, file the corresponding report on each platform (link spam in Search Console, fake reviews on Google Business Profile, duplicate content via DMCA if applicable), attaching all the documentation gathered. Fifth, mark a review on the calendar at two and six weeks to check whether the pattern has subsided or is still active, adjusting the response as it evolves. This documented process, besides increasing the odds the platforms take action, leaves a useful record in case the attack repeats in the future or if it were ever necessary to prove the pattern to a third party.
Frequently asked questions
How do I know if a ranking drop is negative SEO or simply a competitor improving their own SEO?
The key difference is the pattern: a competitor improving their own SEO produces a gradual drop explainable by reviewing their content and authority; negative SEO produces sudden anomalies in your own link profile or reviews that have nothing to do with anything you did.
Is negative SEO legal?
It depends on the technique: some practices (like defamation through fake reviews, or misuse of copyrighted content) can carry legal consequences depending on applicable law, though pursuing them legally is usually complicated by the difficulty of reliably identifying who is behind it.
Can I report a specific competitor directly to Google if I suspect them?
You can report the suspicious pattern through Search Console's spam tools, but Google does not usually confirm or publicly identify who is responsible, nor does it act as an arbiter in disputes between specific businesses.
Is negative SEO common or is it something exceptional?
It is relatively uncommon compared to the normal causes of a traffic drop, but it is not nonexistent, especially in highly competitive, high-margin industries where the temptation to resort to aggressive shortcuts is greater.
Should I review my link profile preventively even if I do not suspect anything odd?
Yes, it is good general practice to review it once or twice a year, not only when suspecting an attack, because it also helps spot broken links, missed opportunities and other problems that have nothing to do with negative SEO.
What do I do if I find my content copied word for word on another site?
First check each version's indexing date (yours should be earlier if the content is genuinely yours), and then file a copyright infringement removal request with Google if the copy is clear and unauthorised.