Negative SEO

Negative SEO refers to attempts to deliberately damage another website’s Google rankings instead of improving your own. Typical methods are spam links, copied content, hacking, fake reviews and spam via a store’s internal search. Google detects most of these attacks itself. It becomes truly dangerous mainly when attackers get into the store itself.

Reviewed by Zoran Artmagic · November 7, 2026

An old image describes the idea behind negative SEO pretty accurately: burn down all the bigger houses in town, and you end up with the tallest one. Instead of making your own store better, the attacker tries to make the competition smaller. The problem with this logic: in Google Search there is a fire brigade, and in most cases it is faster than the arsonist.

Still, it pays to know the methods. Not because every ranking loss hides an attack, but because the few attacks that really work can hit a store hard if nobody is watching.

What negative SEO is and what it isn’t

Black hat SEO refers to methods that violate Google’s guidelines in order to push your own website up: bought links, hidden text, automatically generated pages. Negative SEO turns this around. The same spam methods are aimed at someone else’s website, in the hope that Google will demote it or, in the worst case, remove it from the index.

The counterpart is white hat SEO, optimisation by the rules. And one more distinction matters: not every drop in visibility is an attack. Far more often, a core update, a technical error or a change of your own is behind it.

How attackers proceed and how dangerous it really is

Method	What happens	Danger
Spam links	Thousands of low-quality links from link farms and shady topics, often with over-optimised anchor texts	low, Google usually ignores such links itself
Copied content	Product descriptions and guides are copied and published on other domains	low to medium, Google usually recognises the original reliably
Spam via internal search	Links to the store’s search result pages with spam terms, which then end up in the index	medium, but easy to prevent
Fake reviews	negative fake reviews in the Business Profile or on review platforms	medium, mainly hurts trust and click-through rate
Fake removal requests	alleged copyright complaints to get pages removed from Google Search	medium, can be resolved with a counter-notice
Fake link removal requests	webmasters are asked in the store’s name to delete good links	low to medium
Load attacks	massive numbers of requests that slow down or take down the store	medium, with longer outages the crawl rate drops
Hacking	attackers gain access and change the store	high, the most dangerous form

The table shows the pattern: everything aimed at the store from outside is largely caught by Google. It becomes dangerous when the attacker can get their hands on the store itself.

Hacking: the real danger

An attacker with access to the store doesn’t need spam links. They set important pages to noindex, change the robots.txt, build in hidden redirects or create hundreds of spam pages about medication or gambling under the domain. A well-known example is the so-called Japanese keyword hack, in which automatically generated pages with Japanese text appear in the index. Google marks hacked websites in search results and can demote them until the problem is fixed. Whether your robots.txt still looks the way it should can be checked quickly at any time with the robots.txt Checker.

The way in is almost never sophisticated technology, but the familiar weak points: outdated extensions, security updates not installed, weak or reused passwords, and former employees or service providers whose access was never removed.

The store variant: spam via internal search

One method specifically targets online stores. Attackers place links to the store’s search result pages, for example to a URL with the search term “online casino bonus”. The store then shows a page headed “Search results for online casino bonus”. If this page is indexable, spam terms end up in Google under the domain of a reputable retailer, in the worst case by the thousand.

The defence is simple: search result pages don’t belong in the index. They are excluded via noindex and blocked for crawlers in the robots.txt. What this looks like for Shopware and Shopify is shown in the article on robots.txt for Shopware and Shopify.

Is it really an attack?

Before assuming negative SEO, it is worth looking at the obvious causes. Was there a Google core update at the time of the drop? More on this under Google SEO. Was something changed in the store, such as an update, a new theme, changed URL templates or new filter logic? Has an important page accidentally slipped to noindex? Or has a competitor simply built better pages?

An attack is likely when several signs come together: a sudden rise in referring domains from unrelated areas, foreign pages under your own domain in the index, warnings under “Security issues” in Search Console, or reviews that all appear within a short time and in the same style.

Detecting attacks early

Search Console: messages about manual actions and security issues, new pages in the index that nobody created, and the links report.
Link profile: A regular backlink analysis shows new referring domains and unusual patterns in anchor texts.
Index spot check: A query such as site:your-store.com together with terms like casino, viagra or loan quickly shows whether foreign content appears under the domain.
Copied content: Searching for a distinctive sentence from a product description in quotation marks shows who else uses it.
Reviews: read new reviews in the Business Profile and on platforms regularly, not just the average rating.
Technical monitoring: Outages, slow response times and unexpected changes to robots.txt, sitemap and meta robots are noticed fastest when they are monitored automatically. That is exactly what arboro.PULSE does for Shopware and Shopify stores.

What to do in an emergency

With hacking, secure the store first: block access, change all passwords, close the gap, remove malicious code and spam pages. Then request a review in Search Console so that Google lifts the warning.
With spam links, usually do nothing: Google almost always devalues such links itself. The disavow tool only makes sense with a manual action for unnatural links or a massive, unambiguous attack. Using it preventively can, in the worst case, also devalue good links. More on penalties under Google penalty.
With copied content: ask the operator of the copy to delete it and, if that doesn’t help, file a copyright complaint with Google. More on this under duplicate content.
With fake removal requests: request the restoration of the page via a counter-notice to Google.
With fake reviews: report reviews via the platform’s reporting function, reply factually in public and document the incident.
Legally: Targeted attacks on a competitor can violate competition law, and hacking is a criminal offence. Clean documentation with dates, screenshots and data from Search Console is the basis for any further step.

Prevention in Shopware and Shopify

The best protection is a store nobody can break into. In Shopware, this means installing security updates and extensions promptly, removing unused plugins, enabling two-factor login for all admin accounts and testing backups regularly, not just creating them. Shopify, as a hosted system, takes care of server security. The gaps there tend to lie in staff accounts with too many permissions, apps with far-reaching permissions and access held by former service providers.

For both systems: search result pages belong on noindex, important settings such as robots.txt and meta robots should be monitored, and it should be clear who responds in an emergency. More on the technical foundations under Shopware SEO and Shopify SEO. If you suspect your store is under attack, arboro’s store support helps with analysis and clean-up.