How to fight negative SEO — what actually works, in the order to do it

Every "how to fight negative SEO" article ends the same way: disavow and pray. That's step five of seven, and it's the weakest step. This is the full order of operations we run against an active campaign — including the two steps nobody else writes about, because nobody else can see them.

Step 1 — Confirm it's an attack, not a wobble

Rankings dip for a hundred reasons that aren't attacks. An attack has signatures a wobble never produces: a wave of new referring domains on churn-farm TLDs (.shop/.store/.xyz — first seen within days of each other, not organic growth); anchors with YOUR domain name written into SEO-service sales templates — the farm framing you as its paying client; forged referers from known spam hosts in your analytics; and cloud-VM bots re-crawling your pages to verify their links fired. One signature, maybe coincidence. Two, act.

Step 2 — Do no harm (the first 24 hours)

The two biggest self-inflicted wounds: bulk-disavowing on a generic "toxicity score" (it will strip partners and niche press — see the disavow doctrine), and deleting or noindexing pages in a panic. Instead, document: export your full backlink profile, your anchor report, and your analytics referers, timestamped. If this escalates — to Google, to a host, to a lawyer — the timeline is the case.

Step 3 — Verify with the outside view

Check the domain the way the attack sees it: our free check reads DNS, blocklists, registry state, and runs the backlink spam-wave screen — ten seconds, and if it flags, a human tells you what it means, free. GSC's Links report is the second pair of eyes. Know what neither can see: the part of the campaign that hasn't fired yet. That lives at the edge, not in any report.

Step 4 — Sink what's still firing (the step everyone skips)

Every other guide treats the attack as history — links already indexed. But a campaign is a conveyor: this week's wave is staged before it fires, and the farm's bots return to verify every link. Intercept at the edge and the economics die: hostile links get sunk before they register, verification bots get tarpitted confirming nothing, and a farm that can't verify its links abandons them. This is the layer we built because it didn't exist.

Step 5 — Disavow what already registered

For the damage already in Google's index: per-property files (never shared across sites), domain-level entries (farms rotate paths), a written KEEP-list applied before any scoring (never disavow a syndicator), versioned re-uploads. Full doctrine: how to disavow properly. And hold the framing: disavow is the ambulance, the edge is the wall — it unwinds the past, it stops nothing.

The line you will be quoted, and why it is wrong

Every forum thread and several official-adjacent guides will tell you: “ignore it — you can’t control who links to you, and Google is very good at ignoring spam links.” Hold that against Google’s own paid-link penalties, issued thousands of times a year. Both cannot be true. A system that can reliably tell a link you bought from a link someone aimed at you would never need to penalise buyers — and a system that penalises buyers is, by definition, a system that cannot always tell. The official line quietly assumes perfect intent-detection; the penalty stream is the standing proof that intent-detection fails.

The practical consequence: “disavow and pray” is cleanup, not defence. Documented recovery runs six to twelve months — months in which the next wave fires unopposed and the damage compounds invisibly: analytics stay green while real users are quietly replaced. Sinking the source cancels the wave’s effect at the edge; the disavow file is the broom for what landed before the wall went up.

The desk check — five signs the reports are lying to you

Before the signatures in the log files, there are the signs in the reporting on your desk. Five that should start a proper conversation:

1. Your top anchor isn’t your own name. A healthy profile is dominated by the brand — sixty percent or more. If the top anchor names a product, a service, or a seller, the profile has been worked.
2. The same metric is “being watched” for the third report running. Watching is not fixing — a number worth naming is a number worth a plan.
3. Conversion tracking broke and stayed broken. That is not a technical footnote; it is the one number the attack cannot inflate going dark.
4. Nobody can name the links they would fight to keep. Managing a profile means knowing it in both directions — what should go and what must stay. If your agency reads you a toxicity score but cannot name ten links they would defend, they are not managing the profile; they are reading a dial.
5. No line in any report ties spend to revenue. Metrics that cannot reach money are metrics the attack can fake.

Step 6 — Harden the surface

Attackers probe the boring stuff first: registry transfer lock on, DNSSEC signed, HSTS and a Content-Security-Policy in place. The free check flags all four if they're missing — they're five-minute fixes that close the easy doors.

Step 7 — Watch it forever

Campaigns re-fire. Churn farms sell the same "client" list to the next buyer. The defence that worked this month needs a watch behind it: backlink waves, DNS drift, registry state, blocklist movement — continuous, or the next wave gets a free month before you notice.

Check Free Now — 10 secondsor read the attack types we track

Keep reading: what is negative SEO? the pillar  ·  the disavow guide  ·  how to read a verdict