Short answer
Google’s spam policies page, last updated 28 August 2026, lists 16 policies. Every spam update enforces this list and nothing else. If your site breaches none of them, a spam update did not cause your drop, whatever the dates say.
This page is the map. Each policy is explained in a line, grouped by what it is actually about, with a link to the full recovery guide where one exists.
Google defines spam as techniques used to deceive users or manipulate its systems into ranking content highly. Since May 2026 that explicitly includes trying to manipulate AI responses in Search.
What changed in 2026
Four changes, and most policy roundups still miss them.
- 13 April: back button hijacking added to the malicious practices policy.
- 14 April: Google may now use spam report submissions to take manual action.
- May: spam policies now apply to generative AI responses in Search, including AI Overviews and AI Mode.
- 26 October: user-generated spam guidance updated, covering link-shared content and monitoring abuse in Search Console.
The 14 April change matters most commercially. A competitor’s spam report can now lead to a human reviewer acting on your site.
Group one: borrowed authority
Ranking on standing you did not earn. These three were the biggest enforcement story of 2024.
| Policy | What it means | Full guide |
|---|---|---|
| Site reputation abuse | Third-party content using your domain’s standing | Recovery guide |
| Expired domain abuse | An aged domain repurposed for unrelated content | Recovery guide |
| Link spam | Links bought, exchanged or schemed to manipulate ranking | Recovery guide |
Buying and selling links is not itself a violation. Google recognises paid links as normal advertising. The violation is failing to mark them with rel=”sponsored” or nofollow.
Group two: content built to rank
The most common findings in audits, by a wide margin.
| Policy | What it means |
|---|---|
| Scaled content abuse | Many pages made mainly to rank, by any method. Guide |
| Scraping | Republishing others’ content, or stitching pages together without adding value |
| Thin affiliation | Affiliate pages copying merchant content with nothing original. Guide |
| Keyword stuffing | Repeating terms unnaturally, including blocks of city names |
| Hidden text and link abuse | Content visible to search engines but hidden from people |
Scaled content abuse names AI, humans and both. How the content was made does not matter. Why it was made does. Covered in traffic dropped after adding AI content.
Not every hidden element is a violation. Tabs, accordions and expandable sections used to improve experience are explicitly allowed.
Group three: deceiving the user
Showing one thing and delivering another.
- Cloaking — different content shown to search engines than to people.
- Sneaky redirects — sending users somewhere other than what they clicked.
- Doorway abuse — pages built to rank for variations then funnel users elsewhere. Near-identical location pages are the common case.
- Misleading functionality — promising a tool or service the page does not provide.
- Malicious practices — malware, unwanted software, and since April 2026, back button hijacking.
Group four: abuse you may not have caused
These can happen to a site without the owner knowing.
- Hacked content — injected pages, links or code from a compromise.
- User-generated spam — spam left in comments, forums or profiles.
- Machine-generated traffic — automated queries sent to Google.
Hacked content often recovers fastest of anything on this page, once the injection is removed and the vulnerability closed.
Manual action or algorithmic?
Any of these can be enforced two ways.
- Algorithmically, by SpamBrain. No message. Reassessed continuously, typically two to eight weeks after a genuine fix.
- Manually, by a reviewer. A message in Search Console names the problem. Fixed with a reconsideration request.
Check the Manual Actions report first. It takes a minute. The full distinction is in manual action versus algorithmic penalty.
How to use this list
- Read each policy against your worst-hit page type. Note any honest match.
- No match? A spam update is not your cause. Check whether a core update is, covered in core update vs spam update.
- A match? Remove it rather than reduce it. Halving a violation gets caught again at the next enforcement.
The full spam recovery method is in spam update recovery. Google’s own wording is on its spam policies page, which is the authority if anything here falls out of date.
Marketplaces and classifieds sites are the most exposed to user-generated spam, covered in marketplace and classifieds SEO recovery.
What the 14 April change means if a competitor reports your site is covered in can a competitor report my site to Google?.
Back button hijacking, the newest of these policies, is covered in full in back button hijacking: Google’s newest spam policy.
Other behaviour that can lead to removal
Google’s spam policies page also describes behaviour outside the sixteen policies that can lead to content being demoted or removed, including:
- Legal removals, such as valid copyright complaints.
- Personal information removals, such as doxxing content.
- Policy circumvention: actions taken to get around a spam policy or a manual action.
- Scam and fraud in its various forms.
Circumvention is the one to note. Moving violating content to a new subdomain or domain to escape an action is treated as a violation in its own right.
Recheck the policies whenever your business model changes. Adding user submissions, partner sections, AI-assisted publishing or an expired domain each brings different policies into play. Most violations start as a reasonable business decision nobody checked against the rules.
Not sure whether your site matches a policy?
Most sites that fear a spam penalty do not have one, and the few that do usually know which policy. Send your Search Console access and within 48 hours I will tell you whether any of the 16 applies.
Get free recovery audit