Google penalty or lost rankings? How to tell which – and what to do next

A Google penalty is, strictly speaking, a manual action: a reviewer at Google has decided that certain pages, or the whole website, should no longer be shown in the search results, and the decision is listed in its own report in Google Search Console. A drop after a core update or a spam update is something else. It is not a penalty from Google, and there is no request to send. A tracking error or a technical error produces the same curve as both. The flow below takes the three causes in order, with the most common and cheapest to check first.

Traffic fell – which three causes look the same?

A steep fall in clicks and impressions can be because the tracking or the technical setup is broken, because Google has decided on a manual action or because an update has re-evaluated the website. The curve in Search Console does not separate them. Where the evidence sits, and what helps, does.

Google's guide to drops in traffic begins with five common causes: the property in Search Console does not match the website's http or https version, the pages have not been crawled, there is a manual action or a removal request on the website, the website has moved or the traffic follows the season. Only then does the guide go down to page level and to the Page indexing report. The flow below follows the same order: the most common and cheapest to check first.

The steps are an order in which to check. They do not rule each other out: a manual action can coincide with an update, and a technical error can sit on top of both. Go through all three before you draw a conclusion.

Step 1: Is it a tracking error or a technical error?

A tracking error or a technical error is recognised by a sharp fall from a certain date, unrelated to any update, and it is surprisingly often the answer. Check five things before you look for a penalty.

• The right property. A Domain property in Search Console collects http, https, with and without www. A URL-prefix property does not. If the website has moved to https, or if www has been swapped for the bare domain, it looks like a traffic drop in the old property.
• Blocks. Check that the pages respond with 200, that no noindex tag has been carried over from a staging environment, that robots.txt does not shut Googlebot out and that the canonical tag points at the right page. A wrong canonical after a new template is a classic error.
• Server errors and moves. Longer periods of 5xx responses, a domain move without 301 redirects or a new URL structure produce the same curve as a penalty. The Page indexing report in Search Console shows which pages have dropped out of the index and why. How a move is done without a drop is covered in website migration without losing rankings.
• An expired domain or an expired certificate. A domain that has not been renewed does not respond at all. A certificate that has expired produces warnings in the browser and fewer clicks, even though the pages still rank.
• Season. Compare with the same period last year before you look for errors. Many B2B websites drop noticeably in July without anything being broken.

A simple test is to compare with Bing Webmaster Tools. If the traffic falls in both search engines the cause is very likely technical, tracking-related or seasonal, because Bing and Google crawl the same pages. If the traffic falls only in Google, Google's assessment has changed, and then you move on to step 2. If the website has no account in Bing Webmaster Tools that comparison is not available – move on to step 2 once the points above are checked. The rest of the technical sweep – crawlability, canonicals, redirects – is the same set of points that goes into a technical SEO review.

Step 2: Is there a manual action in Search Console?

A manual action is always listed in the Manual Actions report in Search Console, under Security & Manual Actions in the left-hand menu. If it says "No issues detected", the website has no Google penalty. Then also check the Security Issues report, which shows hacked content and malware, before you move on to step 3. If there is an action you see which type it is, whether it covers certain pages or the whole website, and examples of the affected addresses. Look at the pattern in the examples: is it a category, a template, a guest-post archive or pages a previous agency built?

Google's help page on manual actions lists the types, here with the names Search Console uses. The most common for a business website:

• Unnatural links to your site – bought links, link exchanges and link networks. The most common consequence of bought backlinks.
• Unnatural links from your site – the same thing, but it is you who sells or exchanges.
• Thin content with little or no added value – automatically generated pages, copied content, doorway pages.
• Hidden text and keyword stuffing – text in the background colour, lists of keywords without context.
• Cloaking and/or sneaky redirects – Google and the visitor see different things.
• Structured data issue – markup that does not match the page's visible content.
• Site abused with third-party spam and User-generated spam – comment spam, forum profiles and other user-generated spam.
• Site reputation abuse – third-party content that exploits the website's trust.

Almost everything on the list is what is usually called black hat SEO. Hacked content and malware, on the other hand, are not a manual action but have their own report in Search Console, Security Issues. How a hacked website is cleaned up and reviewed is described in Is WordPress secure?.

Step 3: Does the drop coincide with a core update or a spam update?

An algorithmic drop starts on the same day as an update in the Google Search Status Dashboard begins, and develops during the rollout. Match the date of the drop against the list, where Google gives the start date and how long the rollout took. So far in 2026 Google has rolled out four spam updates – 24 March, 24 June, 18 August and 24 September – and two core updates, 27 March and 21 May. In the whole of 2025 there was one spam update, 26 August, and three core updates: 13 March, 30 June and 11 December. The spam update in September 2026 took just over 13 days to roll out – a drop can keep developing for that long before the picture is clear.

Google recommends waiting at least a full week after the rollout is complete before you analyse the website in Search Console, according to Google Search Central on core updates. During the rollout the positions move in both directions, and an analysis in the middle of it gives the wrong picture.

A drop that matches no date on the list is not automatically technical. Google changes its systems continuously, and not everything is announced. If all three steps give a no – the technical setup is intact, the reports are empty and the date matches no update – you treat the drop as algorithmic and follow the section on recovery below. The example there shows what it looks like in practice.

How to lift a manual action

A Google penalty is lifted by fixing the problem on every affected page and then requesting a review in Search Console. The order matters.

1. Fix every affected page. Google's help page on manual actions is clear: fixing the problem on only some of the pages does not bring a partial return to the search results. If the action covers the whole website, the fix covers the whole website.
2. Make sure Google can reach the pages. Fixed pages behind a login, noindex or a robots block cannot be reviewed.
3. Request a review. The request should contain three parts: exactly which problem the website had, which measures you have taken and what they resulted in. For link cases: which links have been removed, which have been disavowed and why they could not be removed. Document it, preferably as a list of the links with a status for each one: removed, disavowed or contacted without reply.
4. Wait for the decision. Google states several days or weeks and writes that link cases take longer. Do not send a new request before the decision has arrived.

A lifted action does not mean the traffic returns to its old level. The rankings from bought links disappear with the links, and thin pages that have been removed bring no traffic. What remains is the ranking the website deserves on its own merits.

Disavow – a last resort, not a routine

Disavow is a tool from Google where you list incoming links that Google should disregard. It is intended for one specific situation: the website has many spam links or bought links, and it has received – or risks receiving – a manual action for unnatural links. Google itself writes that most websites do not need the tool, and that incorrect use can do harm (Google's help page on disavowing links). Google already disregards most spam links on its own. Links that look odd in a tool are no reason to disavow them, and disavowing links that carried rankings is a self-inflicted drop. After an algorithmic drop without a link problem, disavow does nothing.

How to recover after an algorithmic drop – there is no request to send

After an algorithmic drop there is no request to send. What Google has re-evaluated is almost always the usefulness of the content, and recovery consists of making the content better for the person searching and giving it time. Google's systems may need several months to confirm an improvement, sometimes until the next core update, but an improvement can also take effect in between (Google Search Central on core updates).

Google compares it to a list of restaurants being redone: the ones that end up further down have not necessarily got worse. At the same time Google warns against quick changes, such as removing a page element because someone said it is bad for SEO, and recommends changes that are sustainable for users in the long term instead.

What you can do:

• Create content for the reader. That is the whole job. Pages that answer the question better than the alternatives, cover the subject in depth and carry their own insights from someone who knows it. Write for the person asking the question, not for the search engine, and show in the text why you are the right source: your own data, your own experience, concrete examples. That is the only thing that rebuilds trust, and there is no shortcut to it.
• Review the content page by page. Compare the period before and after the drop in the Performance report in Search Console, sorted by page: which pages dropped, and which kept their position? The pattern shows what Google re-evaluated: a template, a category, a type of content.
• Consolidate or remove the thin pages. Ten pages that answer the same question become one. Pages with no value of their own are removed or set to noindex. That also applies to content produced in volume with AI SEO tools without editorial control – more on that in the next section.
• Build trust signals. Mentions, links from relevant websites and a click-through rate that shows searchers choose you. E-E-A-T is the framework Google itself uses to describe it, and how links and mentions are built is something we have described before.
• Change, measure, wait. Do not switch strategy every other week.

Example: an SEO experiment where every step gave a no

In the autumn of 2026 we built one of our own websites as an experiment: a new domain with no trust signals and a large number of template pages published at a fast pace. The question was how far such a website gets in Google and Bing on the content alone, and what happens when it grows fast.

The answer came within three weeks. Google gave the website broad visibility almost immediately: thousands of impressions a day with an average position on the first page, even though the domain was newly registered. The website then grew to close to 1,800 pages, a large share of which were never crawled. In mid-October the visibility in Google disappeared within a day, from thousands of impressions a day to under a hundred, and the average position went from the first page to far down the results.

The flow ruled out one thing after another. The technical setup was intact: the pages responded 200, the canonicals were right, no noindex, robots.txt open. The Manual Actions and Security Issues reports showed "No issues detected", and the pages remained in the index. No season, and no announced update: the latest spam update had finished just over a week earlier, and no new one had started. Bing was not affected at all – there the pages stayed in positions 4 to 8.

Every step gave a no, and it was still not a penalty. Our interpretation is that Google re-evaluated the whole website: a young domain with no trust was allowed broad visibility, grew fast in number of pages and had nothing yet to show it deserved the place. Then Google withdraws the broad visibility, while Bing judges the content on its own. Three lessons for anyone building something new: early visibility on a new domain is a loan, not proof of merit; fast growth in number of pages without matching trust is a signal Google reacts to; and the comparison with Bing settles whether it is Google's assessment or the website that falls short. What helps then is not a request for review, but giving the domain what it lacked: fewer and better pages, inbound links and time.

In our experience the threshold for this kind of re-evaluation depends on how established the domain is. A new domain can be re-evaluated after a couple of weeks of broad visibility, while an established website with links and searches for the brand tolerates considerably more before the same thing happens. That is an observation from our own websites and from colleagues in the industry, not a rule Google has described.

When do AI content and scaled content become spam?

AI content and scaled content become spam when the pages are created to manipulate rankings rather than help the visitor – whatever the tool. Google's spam policies define scaled content abuse like this: "Scaled content abuse is when many pages are generated for the primary purpose of manipulating search rankings and not helping users." The policy judges the result, not whether a human or a model wrote the text. An AI-written page that answers the question better than the competition is not spam. A thousand template pages that all say the same thing are, even if a human wrote the first one. The same line applies to programmatic SEO: the template is allowed as long as every page has content of its own.

The policy was introduced in March 2024 together with two more: expired domain abuse, where expired domains are bought for their old authority, and site reputation abuse, where third-party content is published on an established domain to borrow its trust. The site reputation policy came into force on 5 May 2024, and it is the answer to the question about guest posts. A guest post you yourself have editorial responsibility for is not the problem. The problem is content someone else runs under your domain, outside your control.

How AI tools are used with editorial control is described in AI SEO in practice, and how a text is written to answer the question in writing SEO content that ranks and gets cited.

How does SEOS Design help if traffic has fallen?

We often start with an SEO audit. After a traffic drop we structure it around the three steps in this order: technology and tracking, manual actions and security issues, and then the drop against Google's updates and against the content page by page. The result is an assessment of what has happened and a prioritised list of what needs to be done.

If the analysis shows that the traffic cannot be regained on the same pages – because it was built on links that are gone or pages that should never have existed – that goes in the report. Then we recommend fewer pages with more substance instead, a clear structure and trust signals that hold through the next update. If you want to do the review yourself, the method is in the step-by-step guide to an SEO audit. Otherwise: get in touch with the website's address and the date the traffic fell.