Is Your Website Safe After Google's Spam Update? 12 Checks
Is Your Website Safe After Google's Spam Update? A 12-Point Self-Check
Most websites do not break Google's spam policies on purpose. They break them by accumulation: a page added in 2021, a plugin that quietly inserts links, an agency habit nobody questioned.
After four spam updates in 2026, it is worth an afternoon to look. This is the checklist we use. It needs a browser, your Search Console login and a spreadsheet, and it does not need a developer. If you want the background first, our explainer on the 2026 spam updates covers what each policy means.
Score one point for every check you pass. The scoring guide is at the end.
Part 1: Your content
1. No near-duplicate pages. Search Google for site:yourdomain.com and scan the titles. If you see the same page repeated with a town, product or keyword swapped, that is the pattern doorway abuse describes. Fix: consolidate into one strong page, redirect the rest, and keep separate pages only where the content genuinely differs.
2. No pages that exist only to catch a search. Open your sitemap and look for pages under roughly 300 words with no original information. Ask of each one: if a customer landed here, would they find what they came for? Fix: expand it with real information, merge it into a stronger page, or remove it.
3. Every article has a named author. Open five recent posts. Is there a real person, a short bio and a reason they are qualified to write? Anonymous "admin" posts signal content nobody stands behind. Fix: add bylines and an author page, and be honest about who wrote and who edited.
4. Nothing was published in bulk. Check your blog's publishing dates. Thirty posts in a week, all the same length and structure, is a pattern. Fix: unpublish or substantially rework anything that says nothing original. Fewer, better posts will serve you better than a large archive.
5. Your content says something the top results do not. Take your best post, search its main query, and read the top three results. If yours could be swapped for any of them without anyone noticing, it has no reason to rank. Fix: add something only you have: a case, a number, a photograph, a process, an opinion with reasoning.
Part 2: Your reputation signals
6. Your reviews are genuine and disclosed. Google's policies cover fake and undisclosed incentivised reviews. If you have ever offered a discount, gift or entry into a draw in exchange for a review, that needs to be disclosed, and in many places it should simply stop. Fix: collect reviews by asking real customers, with no reward tied to a positive rating.
7. No third-party content you did not oversee. Look for sections of your site that host articles by outsiders on unrelated topics, coupon pages, or "sponsored" posts. This is the shape of site reputation abuse. Fix: remove it, or take full editorial responsibility for what remains.
8. Your domain has only ever been yours. If you bought an existing domain, check its history on the Internet Archive. An old domain repurposed for something unrelated is expired domain abuse. Fix: if the history is unrelated to your business, plan a migration to a clean domain with proper redirects, and take advice before moving.
9. Your links are earned, not bought. In Search Console, open Links and review the sites linking to you. Large numbers of links from irrelevant, low-quality sites or obvious directories you never joined are worth examining. Fix: stop any paid link arrangements. Disavowing is rarely necessary and should be a considered step, not a reflex.
Part 3: Your experience
10. The back button behaves. On your phone, open your site from a Google search, click through to two inner pages, then press back each time. You should return to exactly where you were. If you are sent somewhere new, shown an ad, or cannot go back, you have the problem Google began enforcing against on 15 June 2026. Fix: find the script or plugin responsible. Usually it is a pop-up, a redirect or a third-party widget.
11. Pop-ups do not block the content. Visit as a first-time visitor. If a full-screen overlay covers the page before the person has read a word, particularly on mobile, it is a quality problem even if it is not a spam one. Fix: delay it, make it dismissible, or size it so the page is still usable behind.
12. Nothing hidden from users is shown to Google. View your page, then view its source or text-only version. Keyword lists in the footer, text coloured to match the background and links hidden behind images are all classic cloaking and hidden-text signals. Fix: remove them. There is no legitimate reason for them to exist.
How to score yourself
Score | What it means | What to do |
11–12 | Healthy | Review again in six months. |
8–10 | Some inherited habits | Fix the failures this month, starting with checks 6, 7 and 10. |
5–7 | Real exposure | Work through the failures in order before publishing anything new. |
0–4 | A problem you probably already feel | Get someone independent to review the site before spending on content or ads. |
What this checklist cannot tell you
A clean score does not guarantee rankings. Spam enforcement removes what should not be there. It does not make the rest of your site good. A site that passes all twelve can still lose to a competitor who explains things better, loads faster and has more genuine proof.
Also, a low score does not prove you were hit by an update. Check Search Console before assuming a cause, because a drop in the weeks around an update has more ordinary explanations than people like to admit.
Frequently asked questions
How do I know if my website has a Google penalty? For a manual action, open Search Console and look under Security and manual actions. If there is nothing listed, you have no manual penalty. Algorithmic demotions have no notice, so look for a sharp, sustained drop in specific pages.
Can I recover from a spam update? Yes, but slowly. Google says recovery can take months, because its systems need time to confirm the site now follows the rules.
Are city pages for different locations always doorway pages? No. A page for a location you genuinely serve, with content specific to that place, is fine. The problem is near-identical pages differing only in the place name.
Should I disavow links after a spam update? Rarely. Google has said it handles most low-quality links itself. Disavow only if you have a real history of paid or manipulative linking.
How often should I run this check? Twice a year is plenty for most business sites, and after any redesign, migration or change of agency.
Want a second pair of eyes on it? Our free audit covers the technical and content issues on this list and ranks what to fix first, in a Conversion Leak Report you can act on. Request your Free Website Audit.
