Diagnosis
Negative SEO or core update: who took the traffic?
Most owners who suspect an attack have actually met a ranking update, a technical fault or a seasonal dip. Here is how to tell them apart with dated evidence.
Start with the date, not the link count
Write down the first day clicks fell. Then ask what else happened that week.
Google announces broad core updates and spam updates on its Search Status Dashboard. Each one lasts about two weeks. If your decline begins inside such a window and your link profile was quiet before it, the attack theory is weak. If the curve fell before any update and a link cluster arrived in the same fortnight, the theory gets stronger.
Even then, correlation is not cause. Rankings move for dozens of reasons, and a cluster of junk links is often a side effect of a site already being talked about.
Local businesses see this often. A clinic or a shop that loses its map and organic positions in the same fortnight usually has a core-update or listing story, long before it has a link story. Check the Business Profile and the page templates first.
If the cluster does look odd, the spike thresholds page gives example numbers for judging its size, and the runbook says what to preserve.
Myth against reality
| Claim we hear | What the evidence supports |
|---|---|
| Any rival can sink my site with a few thousand junk links | Google says its systems ignore most such links; documented harm is rare and usually involves manipulated anchors or a hack |
| Toxic score above 60 means penalty | Scores are vendor-made; Google publishes no such number |
| Impressions fell, so the cause is links | Impressions also move with AI Overviews, tracking tools and reporting changes |
| The disavow file will bring traffic back | It removes support from named links; it does not repair content or intent problems |
| A manual action and an algorithmic drop are the same thing | Manual actions show a message in Search Console; algorithmic changes do not |
Seasonal dips and audience shifts that look like an attack
Some drops have no link cause and no update cause either. A holiday week in your main market can cut clicks for a site that sells seasonal goods, and a shift in the countries your readers come from can do the same. Check those first. They cost nothing to test.
Say your site serves one country, and a large share of its visitors are abroad during a public holiday week. The clicks fall, the link list looks unchanged, and nothing in Search Console reports a fault. The cause is the calendar. A dated record makes that obvious.
Holiday weeks and market mix
Compare this year's dip with the same week last year, not with the week before. A holiday that repeats every year shows up in both comparisons, which makes it easy to spot. Then split the clicks by country in Search Console.
If the drop sits in one country, a regional change is a better first guess than a global attack. Check whether any link cluster you found comes from that same country, because a cluster from somewhere else cannot explain a local loss.
Changes in your own reporting
Reporting itself can move. A changed filter, a new property or a tracking tag that fires twice will shift the numbers without any ranking change. Confirm that the tool you use for the curve has kept the same setup through the same window.
Write down any change to your analytics next to the curve. It is the cheapest explanation to rule out, and it takes only a few minutes.
Your own site changes
Keep a change log for the site itself. Redirects, robots.txt rules, noindex tags and a new theme are the changes to look for first, because each one can remove pages from view without anyone noticing. Lay that log over the curve. Not from memory.
A change made late in the week can show on the curve the following week, so widen the window when you compare. Three weeks before and after is a sensible starting point. Nobody needs a perfect window.
Dated changes worth checking against your curve
Disavow tool launched
Google gives site owners a way to disown links, after the Penguin update of April 2012.
Penguin 4.0
Penguin becomes part of the core algorithm and works in real time, discounting spam links instead of demoting whole sites.
Link spam update
Google announces SpamBrain-powered neutralisation of spam links used to pass or manipulate ranking.
Core update plus new spam policies
Google targets scaled content abuse, expired domain abuse and site reputation abuse alongside a large core update.
Spam update
Another spam update; check the Search Status Dashboard for exact start and end dates against your curve.
A fast triage you can do in an afternoon
Segment the loss
In Search Console, compare the three weeks after the fall with the three before: by page, query and country. A single section falling points to content or technical causes.
Look for manual actions and security issues
Both live under Security and manual actions. No message, no manual penalty.
Diff the link lists
Compare this month's refdomains file with last month's. A flood shows as hundreds of new rows, not tens.
Check your own changes
Redirects, robots.txt, noindex tags, a new theme, a server move. These cause more sudden drops than rivals do.
Reading the link profile during a traffic drop
A link profile tells you a story only when you read it against a baseline. A total number of backlinks rarely moves in a useful way, because natural links accumulate year after year. Look at the rate. The shape of the new rows is the part that matters.
Keep the same source. Keep the same calls every month. Counts from two different tools will never agree, and a comparison across them can produce a false spike. Our own index is the same tool each time, which is what makes the monthly diff meaningful.
Watch the rate, not the total
Divide the new referring domains by the number of months since your last pull. A flat average with one month far above it is a candidate for investigation. A steady trickle of the same size every month is not.
Say your baseline is about ten new domains a month. A month with forty is a reason to open the file, not yet a reason to panic.
Compare like with like
Set the domain list you watch, the call types and the row limit once, then leave them alone. A changed row limit can make a file look larger without a single new link arriving.
Store the settings in the same folder as the exports. Next year's reader should be able to rerun the same comparison.
Check the pull date
Our index refreshes roughly once a month. A link placed after your last pull will not appear until the next one, so a quiet month is not proof that nothing arrived. Record the pull date beside each file, and read the diff against that date.
A flag raised in the middle of a cycle may already be stale, which is why the monthly rhythm beats a daily panic.
We can show that links appeared. We cannot show who placed them. Do not name a competitor in a public post or a client report on the strength of link data.
Questions owners ask about attack versus update
The questions below come up when owners try to tell an attack from an update.
Can a negative SEO attack cause a drop that looks like a core update?
Rarely, and it is hard to prove. Google says its systems ignore most spam links, so a cluster seldom changes rankings on its own. The bigger risks are a hack, a broken template or a change in your own redirects. Check those before you blame the links.
What if the drop began on the same day as a link cluster?
Then the cluster deserves a careful look, but the coincidence is not proof. Check whether the lost clicks sit on the pages the links target. If they fall on unrelated pages, the links are probably a bystander.
How long should I wait before deciding?
Until the update has finished rolling out and two monthly pulls are saved. Update windows run for a couple of weeks, so a decision on day three is a guess. Use the wait to collect the evidence.
Should I pay a service to remove the links?
Not on the strength of a traffic chart. Removal services contact sites you may never have looked at, and you cannot easily check what they sent. A saved file and a clear decision cost far less and keep you in control.
When the answer is still unclear
Sometimes the evidence stays mixed. A core update lands, a small cluster of links arrives, and traffic falls. In that case, fix what you can fix openly: thin pages, slow templates, mismatched intent.
Keep the monthly link record running. If clicks do not return after the update finishes rolling out, and the cluster has grown, you will have the dated files to support a careful disavow. Until then, do not spend money on removal services.
