Google runs periodic spam updates, improvements to the automated systems that decide whether a site is trying to earn rankings or manipulate them. The main system has a name, SpamBrain, and it runs continuously, but a few times a year Google ships a notable upgrade and announces the rollout on its ranking updates list. When one rolls out, sites that cross the line rank lower or disappear from results entirely. There is no notice, no email, and in most cases no warning inside Search Console. Traffic just drops, and the owner finds out when the phone stops ringing.
We watch these updates closely because our clients live and die on organic traffic, and because the sites that get hurt are rarely run by people who think of themselves as spammers. Most of the damage we see lands on ordinary businesses that inherited bad SEO work, bought a cheap content package, or simply had nobody watching the site. This post covers what the updates actually punish, why recovery is slower than anyone expects, and how to tell whether your own site is carrying risk.
TL;DR
- Google's spam updates are automated and give no warning. Recovery takes months of observed clean behavior, and rankings propped up by discounted links never come back at all.
- Hacked sites count as spam even when the owner never knew. One exploited plugin can drag down every legitimate page on the domain.
- AI content is not penalized. Publishing volume whose primary purpose is to rank is, no matter who or what wrote it.
- Location pages that only swap the city name are doorway pages. Near-identical sets get pruned together.
The recovery math is the part that should scare you
Fixing the problem does not restore your rankings the next week. Google's own documentation says that after a site cleans up, its automated systems need to learn over a period of months that the site complies before rankings recover. Read that as a business number: if an update catches your site in March, doing everything right in April can still mean a summer of lost leads.
And for one category the math is worse. With link spam, Google does not restore the value of bad links after you clean them up. Any ranking benefit those links ever generated is permanently gone once the system discounts them. A site that ranked for years on a bought link profile does not return to its old positions after a cleanup. It returns to wherever it deserves to rank without those links, which is often pages lower. That is not a penalty being lifted. That is the scaffolding being removed.
Hacked content: the spam violation nobody plans for
The first category on our list is the one almost no business owner thinks of as an SEO problem. If your site gets compromised, even quietly, the injected pages and redirects put you squarely inside Google's spam policies. Google demotes or removes hacked content because it harms users, and it does not matter that you did not put it there.
The pattern is depressingly common on neglected WordPress sites. An outdated plugin gets exploited, the attacker plants a few hundred pages deep in the site, pharmacy offers, casino links, knockoff goods, and hides them from the theme so nothing looks wrong to anyone who visits the homepage. The owner finds out when rankings collapse, or when a customer mentions that Google is flagging the site. By then the damage includes every legitimate page on the domain, because the demotion applies to the site, not just the injected pages.
This is why we treat security posture as part of search posture. Patching, monitoring, and working backups are not just an uptime story. They are the difference between a bad week and a lost year of organic visibility.
Scaled content abuse: the AI question everyone is asking
Google's newest named policy is the one AI made urgent, and it is widely misunderstood in both directions. Google does not penalize AI-written content as such, and it has said so plainly: appropriate use of AI is fine, and its ranking systems reward high quality content "however it is produced." What it penalizes is scale without value: generating many pages whose primary purpose is to manipulate rankings, whether a human, an AI, or a scraper produced them. The policy is about intent and usefulness, not authorship.
In practice, the line is easy to see when you stand on either side of it. A well researched article that answers a real question your customers ask, drafted with AI assistance and reviewed by someone who knows the subject, is fine. Five hundred thin articles a month pumped out by a tool that promises to dominate every keyword in your niche is exactly what this policy exists to catch. If a vendor is pitching you on content volume as the strategy, they are pitching you on the violation. The winning play with AI and search is building genuine visibility, not manufacturing volume.
Doorway pages and keyword stuffing: the local business trap
These two older policies show up constantly in local service businesses, because the temptation is so natural. You serve forty towns, so you build forty pages, one per town. The problem is what goes on them. Google's own keyword stuffing example is listing cities and regions without real context, and its doorway policy targets sets of near identical pages that exist only to catch geographic searches and funnel visitors to the same place.
Location pages themselves are not the violation. They work, and we build them. The difference is substance. A city page that earns its existence carries real local proof: actual projects in that town, genuine service area detail, references a resident would recognize. A city page that is the same five paragraphs with the town name swapped in is a doorway, and a spam update will eventually treat the whole set accordingly. If you have a pile of these, the move is to consolidate and strengthen before the algorithm prunes them for you.
Link spam: the debt you may not know you're carrying
Link spam covers bought links, excessive link exchanges, automated link building, and keyword rich links stuffed into footers and widgets. It is the oldest game in SEO and the one Google has spent two decades getting better at detecting.
The risk for most business owners is inherited. If an agency ever built links for you and cannot tell you exactly where each one came from and why it exists, you are carrying risk you cannot see. Remember the recovery math above: when those links get discounted, the rankings they propped up do not come back. The only link building worth doing is the kind you would be comfortable explaining to Google directly, real mentions on real sites that had a genuine reason to reference you.
The rest of the list
A few other policies are worth knowing even if they touch fewer businesses. Expired domain abuse targets buying an old domain to trade on its former reputation. Site reputation abuse targets established sites renting their authority to third party content, the payday loan reviews on a university site pattern. User generated spam covers open comment sections and forums that fill up with junk nobody moderates. Each of these now draws specific enforcement, and each has the same underlying test as everything above.
That test is the common thread: Google is not grading effort, it is grading intent. Content and links that exist for readers survive every update. Content and links that exist for the algorithm eventually get found, and the cost of getting found is measured in months of lost traffic, not days.
What to do before the next update, not after
Run an honest inventory. Do you know every plugin on your site and when it was last updated? Can you account for every batch of content that was ever published at scale? Do your location pages say anything a competitor's could not? Could your last SEO vendor produce a list of every link they built? If any of those answers is no, that gap is worth closing while it is still cheap to close.
If your traffic already dropped and you do not know why, or you inherited SEO work you cannot fully account for, that is worth a look now rather than after the next rollout. The sites that sail through spam updates are the ones where somebody checked.
Not sure where your site stands? We will run a spam exposure check on it and tell you exactly what we find, no charge. Get in touch and we will take a look.