A competitor buys links, spins a thousand near-identical pages, and climbs past you. You want Google to know. The route exists, it is free, and it takes about ten minutes, but the rules governing it changed in April 2026, and most guides still describe the old ones.
Here is what changed. Google now says it may use your report to take a manual action, and that if one follows, your submission text goes to the site owner verbatim. Google also says it will refuse to process a submission containing personally identifying information. That paragraph rewrites how you should write a spam report.
This guide covers the current forms, what evidence survives review, what Google’s spam policies actually name, and what happens after you submit.
Report black hat SEO to Google: the spam report form, step by step
Google keeps three reporting routes on one page, “Report spam, phishing, or malware,” last updated April 23, 2026. The three forms are Report spam, Report malware, and Report phishing. Rankings abuse goes to the first.
What Google’s Report spam form asks for
The spam report form sits inside Google Search Console at search.google.com/search-console/report-spam and asks for a URL, a category, and a free text field. You do not need to own or verify the site you are reporting. You do need a Google account.
Before you open the form, collect the evidence:
- The exact URL of every offending page, not the homepage
- Dated screenshots showing the violation as it appeared to you
- The archived version from the Wayback Machine, which survives after the page is edited
- For link spam, an export of the referring domains pointing at the page, sorted by first-seen date
- The search query and the position where the page appeared
Write the free text field the way a reviewer reads it. One paragraph. Name the policy, name the URL, describe what you observed and when. A submission that says “this site is cheating” gives a reviewer nothing to act on.
The April 2026 rule change: your submission text reaches the site owner
Google’s documentation now reads: “Google may use your report to take manual action against violations. Don’t include any personally identifying information in your submission. To comply with regulations, we must send the submission text to the site owner to help them understand the context of a manual action, if one is issued. Because of this, we won’t process your submission if we determine it contains personally identifying information.”
Read that twice. Two things follow.
First, a spam report is no longer only a training signal for automated systems. It can produce a manual action against a real site.
Second, the report is anonymous only in the narrow sense that Google strips your identity from the notification. Whatever you type is forwarded verbatim. If you write “this is Dave from Northside Dental down the road,” the site owner reads that sentence. Keep names, companies, email addresses, and phone numbers out of the free text field. Google will also discard reports it judges to carry personally identifying information, so a careless report does not get filed late. It does not get filed at all.
The practical consequence is retaliation risk. You are describing a competitor who already ignores the rules, and your description reaches them. Write in the third person, describe pages rather than people, and let the URLs do the work.
Google Search Essentials and the spam policies your report should cite
Google Search Essentials, last updated December 10, 2025, replaced what the industry called the Webmaster Guidelines. It has three parts: technical requirements, spam policies, and key best practices. A spam report that cites a named policy travels further than one that complains about unfairness.
The spam policies page was last updated August 28, 2026. It names sixteen policies, and each name is a phrase you can quote in your submission.
Black hat SEO tactics Google’s spam policies actually name
Google’s list is the vocabulary a reviewer already uses. Matching your language to it costs nothing and removes ambiguity.
Cloaking, keyword stuffing, and hidden text
Cloaking shows one version of a page to Googlebot and another to people. Test it by comparing the live page against a fetch with a different user agent.
Keyword stuffing repeats a term past the point where a sentence still means anything. A redirect that lands a visitor somewhere other than the page the search result promised is its own named policy, sneaky redirects. Hidden text and hidden links use white-on-white type, zero-height containers, or off-screen positioning, and Google groups them under hidden text and link abuse.
Doorway pages are near-duplicate pages built for slight query variations that all funnel to one destination. Google calls the policy doorway abuse.
Link spam, paid links, and private blog networks
Link spam is Google’s umbrella term. Underneath it sit paid links, excessive exchanges, and link schemes built to pass ranking signals rather than to help a reader.
A private blog network is a set of sites one operator controls. They exist to link to a money site. The evidence is patterned: shared hosting, shared registrant details, identical templates, and anchor text repeating the same commercial phrase across dozens of referring domains. Run a backlink audit before you claim any of this, because a coincidental footprint is not proof.
If you are building links yourself, the honest route is white hat SEO link building with real editorial placements.
Site reputation abuse, expired domain abuse, and scaled content abuse
These three are the newest names on the list and the ones most guides have not caught up with.
Google’s site reputation policy is the one behind what practitioners call parasite SEO or site reputation abuse: a third party rents space on a trusted domain to rank content the host has nothing to do with. Coupon sections on news sites are the common example.
Expired domain abuse buys a domain for its accumulated history and repurposes it for unrelated content. Check the Wayback Machine and the registration record before reporting one.
Scaled content abuse covers mass-produced pages made primarily to manipulate rankings, whether written by people, generated by machines, or a mix. Volume alone is not the violation. Intent plus low-quality output is.
The remaining named policies cover hacked content, scraping, machine-generated traffic, malicious practices, misleading functionality, thin affiliation and user-generated spam.
Black hat SEO techniques you can prove from outside a site
You cannot see a competitor’s server logs. You can see quite a lot else.
Hidden text, doorway pages, and scraped content
View source. Search for display:none, text-indent:-9999px, and font colors matching the background. Hidden text is the easiest one to prove, because it sits in the markup.
For scraped content, take a distinctive sentence from your own page and search it in quotes. Copy that predates the version on your site is straightforward to show with the Wayback Machine. For AI-generated content at scale, sample twenty URLs from the sitemap and note how many are template variations of one another. That pattern supports a scaled content abuse claim.
Fake reviews and Google Business Profile spam
Local gaming rarely lives in the organic index. It lives in the map pack, and it is reported somewhere else.
Fake reviews, keyword-stuffed business names, and fake service-area listings go through the Google Business Profile redressal flow, not the Search spam report. Review spam aimed at your local rankings is worth reporting the same week you see it, because profile edits move quickly. If your own local rankings and Google Business Profile need work, that is a separate project from reporting anyone.
Fake reviews also damage reputation in ways that outlast a ranking change. Cleaning up review spam and reputation damage is its own discipline.
Negative SEO attack or your own problem? Check before you report
Most people searching for how to report unethical SEO have just watched their traffic fall. A negative SEO attack is real but uncommon. Google’s documented position is that its systems are built to ignore links it does not trust, which is why the disavow tool comes with a warning rather than a recommendation, though Google publishes no figure for how often that holds. Rule out the ordinary explanations first. Our free penalty checker dates the steepest fall in your own page-one keyword count against Google’s confirmed update record, which settles most of this in about a minute.
Reading a traffic drop against a core update
Open Google Search Console. Compare the traffic drop date against the published start of the most recent core update. A decline beginning inside the rollout window is an algorithmic reassessment of content quality, not sabotage. A decline that starts on a random Tuesday with no update running deserves a closer look.
Check the Manual Actions report. If Google has issued a manual action against you, it says so there, plainly, with the policy named. No manual action and no core update overlap means the cause is probably technical: a bad canonical, a robots directive, or a server fault. A technical SEO audit for hacked content and crawl errors catches most of these.
When a backlink audit points at unnatural links
Export your referring domains and sort by first-seen date. A genuine attack looks like hundreds of new spammy backlinks from unrelated sites inside a few days, usually carrying commercial or adult anchor text.
If that pattern is there, the disavow tool in Search Console is the remedy, and it is a blunt one. Disavow whole domains, not single URLs, and only where the pattern is unmistakable. Disavowing links you merely dislike costs you signal you earned. A free backlink audit tells you which category you are in before you touch the file.
Report the attacker too. Document the case first, because the burden of proof sits with you and a false positive wastes everyone’s time.
How to report negative SEO and spam outside Google Search
Google Search is one surface. Several kinds of abuse belong elsewhere.
Bing and the feedback route
Bing does not publish a dedicated, named spam form the way Google does. Microsoft’s “How to report a concern or contact Bing” page routes reports through the feedback link at the foot of the results page, and site owners can raise issues through the Bing webmaster portal. Expect less visibility into what happens next than Google gives you, which is already very little.
Malware, phishing, and legal removal requests
If the page distributes malware, use Google’s Report malware form. If it imitates a bank or a login screen, use Report phishing. Both act faster than a spam report, because both carry a safety consequence rather than a ranking one.
Copyright theft is a different track again. A copyright removal request through Google’s legal removal process handles stolen text and images, and it carries legal weight a spam report does not. Use it when someone has copied your pages wholesale.
What happens after you report black hat SEO to Google
Short version: you will not hear back.
Automated systems, human review, and manual actions
Google’s spam policies page says it detects violations “both through automated systems and, as needed, human review that can result in a manual action.” It names no detection system on that page. Treat named-system explanations you read elsewhere as inference.
Three outcomes are realistic. Nothing visible happens, because the automated systems already discounted the pages and your report confirmed a pattern Google had scored. Or the site slides down over weeks, with no formal notice at all. Or a reviewer issues a manual action, the site owner gets a notice in their Search Console, and your submission text arrives with it.
Sites hit with a manual action can ask Google to review the fix once they clean up. Many do, and many come back. Reporting a competitor buys you a window, not a permanent result.
Why you should not expect a reply
Google has never confirmed individual reports. There is no ticket number and no status page. One report from one account is a single signal, and Google weighs corroboration: five independent reports about the same URL carry more than one detailed essay.
So report, then go back to work. Chasing a spam report costs you hours you could spend on your own rankings.
Unethical SEO versus white hat SEO: what you are actually reporting
Unethical SEO practices are not a legal category. Almost nothing here is illegal in most jurisdictions, which is why the legality question gets answered wrong so often. It is a breach of Google’s terms for appearing in its index, and Google’s remedy is removal from that index.
Black hat SEO penalties and what they cost
Black hat SEO penalties land in two shapes. The algorithmic kind is quiet and continuous. A manual action is explicit and appears in Search Console with the policy named.
The cost is rarely the ranking alone. Losing the index removes a revenue channel with no notice period, and rebuilding afterward takes longer than losing it did. Sites coming back from one usually need recovering from a Google manual action as a dedicated project rather than a cleanup task.
Ethical SEO practices that survive a core update
White hat SEO is the boring answer that keeps working. Match the page to what the query wants. Build experience and expertise signals a reader can verify. Earn links from sites with editorial standards.
Ethical SEO practices work because they optimize for the same thing Google is trying to measure. Our approach to ethical SEO practices that build content quality uses contextual density: measure the vocabulary that ranking pages share, then cover it deliberately.
That includes how you handle AI-generated content. Google’s policy targets scaled output produced primarily to game rankings, not the tool used to write it. Editorial oversight is the difference, and it is the difference AI-generated content and content quality work has to prove.
Frequently asked questions
Does reporting black hat SEO to Google actually work?
Sometimes, and slowly. Google says it may use reports to take a manual action, which is a stronger statement than it made before April 2026. It still gives no confirmation and no case number. Corroborated reports about one URL carry more weight than a single detailed one.
Is the Google spam report anonymous?
Partly. Google does not tell the site owner who filed it. But if a manual action results, Google forwards your submission text verbatim, so anything identifying you in the free text field reaches them. Google also refuses to process submissions it judges to carry personally identifying information.
What is the difference between the spam report and the Search Quality User report?
The spam report targets one URL for a named policy violation. The Search Quality User report is a broader feedback form covering spammy content, misleading pages, weak results, and inorganic links, aimed at result quality rather than enforcement against a single site.
Can I report black hat SEO without a Google Search Console account?
You need a Google account to submit the form, but you do not need to own or verify the site you are reporting. You will want your own Search Console open anyway, to check whether your traffic drop has a simpler cause.
How long does a Google spam report take?
Google publishes no service level for this. Reports feed both automated systems and, where warranted, human review. Practitioners report movement on obvious cases in weeks and nothing at all on borderline ones. Treat it as a signal you contribute, not a request you file.
Where do I report spam to Google that is not in Search?
Use the product’s own channel. Google Business Profile handles map and review spam, Report malware and Report phishing handle safety problems, and the legal removal process handles copyright. The Search spam report covers ranking manipulation in web results only.
Report the spam, then fix your own rankings
Reporting black hat SEO is worth ten minutes and a folder of screenshots. It is not a growth strategy.
Get a measurement before you decide what is wrong
ProStar SEO runs a free audit that measures your backlink profile, your content quality against the pages currently ranking, and the technical faults behind most unexplained ranking losses. If the diagnosis turns out to be a negative SEO attack, we will say so. If it is a core update and thin coverage, we will say that instead, because due diligence before a disavow file saves more traffic than it costs.
Book a free 30-minute consultation. No contract, no commitment, and a reply within 24 business hours.
