Negative SEO attack — what to do in the next hour
Breathe. The order of operations is short, most of it is free, and the worst outcomes we see aren't caused by the attack — they're caused by the response. Do the first ten minutes exactly, skip the panic moves, and the rest of the hour takes care of itself.
The first ten minutes
- Run the outside view. The free check reads the domain the way the attack sees it — DNS, registry state, blocklists, the spam-wave screen — in about ten seconds. If it flags red, a human reads the result and tells you what it means, free. If it comes back clear, you may be looking at a wobble, and the honest answer is to go home and watch it.
- Document, timestamped, before you touch anything. Export your full backlink profile and anchor report from your SEO tool, and your referer list from analytics. Screenshots with dates. If this escalates — to Google, to a hosting abuse desk, to a lawyer — the timeline built in the first hour is the case.
- Change nothing yet. Not the content, not the titles, not the internal links. Rankings wobble for a hundred reasons; half of "attack damage" is self-inflicted by people editing a site mid-panic while Google is already recrawling it.
What not to do today
- Don't bulk-disavow on a "toxicity score." The score can't tell a farm from your niche's small press. Panic-disavowing strips partners and syndicators — real damage, done by you, attributed to them. The disavow doctrine exists precisely for this moment; follow it or leave the file alone.
- Don't noindex or delete pages. You'd be completing the attack for them — removing URLs Google already trusts because someone else aimed garbage at them.
- Don't file a reconsideration request. It's for manual actions. If there's no manual action in Search Console, there's nothing to reconsider — and a nervous request invites a human review you didn't need.
- Don't buy "link removal" services. Cold-emailing farm operators to beg deletions marks you as a paying mark; the same operator re-fires next month with a price list.
- Don't announce it publicly. The attacker reads your forum posts and your social feed. Distress is the signal the campaign is working. Work quietly.
The rest of the first hour
- Sink what's still firing. The wave has a verification loop — the farm's bots re-crawl their own links to confirm they resolve. Protection at the edge intercepts that loop the hour it goes up: hostile sources get sunk, verification bots get tarpitted confirming nothing, and a farm that can't verify its links abandons them. This is the step every "what to do" listicle skips, because until now nothing could do it.
- Check your idle domains. Attackers probe the domains nobody watches first. If you have parked or legacy domains, run them through the check too — a hijacked idle domain is frequently the staging ground for the wave hitting your money site.
- Lock the boring doors. Registrar transfer lock on, DNSSEC signed where offered. Five minutes, closes the easy wins while you work the real problem.
The next 48 hours
Once the firing wave is intercepted, work the full order of operations — verify, sink, disavow what registered, harden, watch — at how to fight negative SEO, in order. The disavow file is for the damage already in Google's index, and it runs on Google's clock (weeks, no receipt). The edge runs on yours.
If it turns out to be a wobble
Then you lost an hour and gained a timestamped baseline — which is what you'll compare next month's wave against. Not every dip is an attack, and a defence outfit that can't say that out loud is selling fear. The signatures that separate the two: churn-farm TLD waves first seen in the same days, your domain name inside SEO-service anchor templates, forged referers, verification bots. The full field guide: is this link spam?
Run the outside-view check, export the evidence with timestamps, change nothing. Ten minutes.
They disavow in a panic on a toxicity score — the single most common way an attack inflicts lasting damage is the victim doing it to themselves.
The firing wave: the same hour the edge goes up. What already registered in Google's index runs weeks — which is exactly why interception comes first.
Run the free check — 10 secondsthen the full order of operations →
Keep reading: what is negative SEO? the pillar · the attack types, measured · is this link spam? the field guide