Google Manual Actions: Penalties, Security Issues, and the Reconsideration Request

# Google Manual Actions: Penalties, Security Issues, and the Reconsideration Request Most ranking losses are not personal. They are the measured result of an algorithm re-weighting pages across an entire market, and they arrive without warning, without a letter, and without anyone at Google ever looking at your site. A manual action is the opposite: a specific human reviewer at Google examined your site, concluded that it violates the search quality guidelines, and applied a targeted demotion to it. That distinction matters because the two problems have completely different diagnoses, completely different fixes, and completely different recovery paths. Treating a manual action like an ordinary ranking dip — tweaking titles, adding content, waiting for the next update — wastes months while the penalty sits on the site. ## What a Manual Action Is (and What It Isn't) A manual action is a human decision. Google's web spam review team can flag a site for violations that automated systems either cannot confirm or have not yet caught at scale: blatant link buying, cloaking, large-scale doorway pages, hacked content. When a reviewer flags the site, the demotion can hit the whole domain or just specific sections, and it stays in place until the site owner fixes the underlying problem and Google agrees the fix is real. What a manual action is not is any ranking change you happened to notice. An algorithm update that reshuffles the results, a competitor publishing something better, a technical mistake that deindexed a section of the site — none of these involve a human reviewer, and none of them can be lifted by a reconsideration request. The first step in any suspected-penalty situation is therefore to confirm the penalty actually exists before you start ripping pages out of your site. ## Where Google Tells You: the Manual Actions Report Google does not leave you to guess. Every site verified in Google Search Console has a Manual Actions report, and if a reviewer has flagged the site, the violation appears there with a name, an affected scope, and an example. This is one of the rare places in search where Google communicates directly: no speculation required, no third-party penalty checker needed. Check it before anything else. If the report says "No issues detected," you do not have a manual action, and the ranking drop has a different cause — a search-intent mismatch, a technical fault, a shift in the competitive set. If the report lists one or more issues, you have your diagnosis in writing, including which parts of the site it covers. A "partial matches" scope is actually useful information: Google is telling you exactly which section it objects to. ## The Triggers That Catch Real Businesses Spam guidelines sound like they target scam operations, but ordinary service businesses trip them constantly, usually through marketing tactics that someone recommended in good faith a few years ago. **Doorway and duplicated location pages.** A contractor serving fifteen towns who generates fifteen near-identical "Plumber in [Town]" pages, each with the same two paragraphs and a swapped city name, is building exactly what the doorway-pages guideline describes. The pages exist to capture searches rather than to serve a distinct audience, and reviewers recognize the pattern quickly. The same applies to thin service-area pages created en masse for towns where the business has no real presence or local proof. **Link schemes.** Buying links, trading links at scale, using "link packages" from an agency, placing keyword-rich links in widgets, footers, or sponsored posts without disclosure — these all fall under link spam. This is the most common serious penalty for small businesses, and it usually arrives via a cheap SEO package bought years earlier whose links Google's systems eventually identify. **Thin, scraped, or affiliate-only content.** Pages whose content is copied, auto-generated, or assembled to host outbound links add nothing to the results, and Google's guidelines call that out directly. **Cloaking and sneaky redirects.** Showing search engines one page and users another — including injecting text that matches the page background or redirecting a ranking page to something unrelated — is straightforwardly deceptive and treated accordingly. **User-generated spam.** Forums, comment sections, and spammy profiles hosted on your domain can attract action if they are allowed to pile up. For most service-business sites this is a minor risk, but an abandoned blog with hundreds of casino and pharma comments can earn a flag. ## Security Issues: When the Problem Is a Hack Hacked sites get their own category, and it behaves differently. If Google detects injected spam pages, hidden pharmaceutical text, or redirects to malicious domains, it can flag the site with a security issue, mark results with a warning, and restrict how the site appears. The Search Console Security Issues report lists what was detected and, importantly, example URLs. A hack penalty is not an accusation about your marketing. It is a containment measure protecting searchers. The recovery path is technical: remove the malicious code, close the vulnerability, clean or eliminate the spam pages it created, and then request review. Many businesses discover a months-old compromise this way — the penalty is often the first visible symptom of an intrusion that has been quietly harvesting the site's rankings. ## Why a Manual Action Behaves Differently From an Algorithmic Drop An algorithmic drop has a rhythm: it correlates with a known update, it affects many similar pages at once, it can partially reverse in a later refresh, and rankings often fluctuate while the system re-evaluates. A manual action is a wall: affected pages fall hard and stay down until the action is revoked. Traffic does not dribble back after the next update. Nothing you do to the pages themselves lifts the demotion, because the demotion is not about page quality — it is about trust in the site. This is why the diagnosis order matters. Confirm the manual action first. Only if the report is clean should you move to the much larger category of ordinary ranking problems, where the diagnosis is about relevance, technical health, and competition rather than compliance. ## Cleaning Up: What Google Wants to See in the Record Google's guidance on recovery is explicit that removing the visible problem is not enough; the reviewer needs evidence that the underlying practice is gone and will not return. In practice that means a documented cleanup: - List the violating links or pages. Export backlinks from Search Console, identify those matching the spam pattern, and either remove them (contact the linking site) or disavow the ones you cannot get removed. Keep the outreach record — dates, addresses, replies. - Fix the pages. Doorway city pages either become genuinely distinct local pages with real local content and proof, or they get removed and consolidated. There is no third option where they quietly remain. - Close the hole. For hacked sites, patch the vulnerability, update the platform, change credentials, and verify the cleanup with a fresh scan — reviewers can and do check. - Document everything with dates. The reconsideration request will reference this record. The reviewer is assessing intent as much as state. A site that deleted two spam pages but kept the system generating them reads as an attempt to pass review, not a real reform, and it gets rejected. ## The Reconsideration Request: Documentation Beats Apology Once the cleanup is complete, the reconsideration request — filed from the Manual Actions report — asks a human to re-review the site. The request itself is a written document, and the strong ones share a shape: a plain acknowledgment of what was done and why it violated the guidelines, a chronological account of the cleanup with evidence, and a statement of what changed going forward. Links to spreadsheets of removed links, copies of outreach emails, and before/after crawls do more than paragraphs of apology. Reviews take time — typically days to weeks — and the outcome arrives as a message in Search Console. A successful review lifts the action, and affected rankings recover as the site is reprocessed. A rejection names the remaining problem; that is not a dead end but an instruction to keep cleaning the specific pattern cited and file again. Sites with deep, years-old link spam commonly need two or three rounds. Patience during this loop is a real cost of the violation. ## Prevention: Habits That Keep You Off the Review Queue Because the fix is expensive, prevention is mostly about refusing the tactics that cause the problem. Never buy link packages, and ask any agency to show exactly how it builds links. Treat "we'll create 50 city pages" offers with suspicion — one genuinely useful page per town beats fifty thin ones. Audit backlinks occasionally so a bad legacy profile gets cleaned before Google flags it. Keep the site's software current, monitor for injected content, and moderate comments. None of this is exotic; the sites that earn manual actions almost always know which shortcut got them there. Manual actions are rare relative to ordinary ranking problems, but they are also the one class of ranking failure where Google tells you the answer directly. Reading the Manual Actions report takes a minute, and it should be the first minute of every serious ranking-drop investigation. For the broader diagnostic sequence around ordinary drops, see the guide on [why rankings drop](https://seodone.ai/blog), and for the on-page fundamentals that keep a site competitive in the first place, start with [what SEO Done covers](https://seodone.ai/features). ## Frequently Asked Questions **How do I know if my site has a manual action or just lost rankings after an update?** Check the Manual Actions report in Google Search Console. If it lists a violation, you have a manual action; if it is clean, the drop is algorithmic, technical, or competitive, and the recovery path is entirely different. **Can a manual action affect only part of my site?** Yes. Reviewers can apply a site-wide action or a partial one, and the report states the scope. A partial match is useful information — it points at the section of the site the reviewer objects to. **How long does recovery take after a successful reconsideration request?** The review itself usually completes within a few weeks, but rankings recover as Google reprocesses the site, so full restoration can take longer. Sites with heavy legacy spam should expect the review loop to take more than one attempt. **Is disavowing links enough to lift a link-spam penalty?** Disavowing signals the links you cannot remove, but reviewers also want evidence of removal attempts and a change in practices. A disavow file alone, with no documented cleanup or outreach, rarely satisfies a reviewer. **Do bought links always cause a manual action?** Not always — some never get flagged, and Google's systems also simply discount many of them. But the ones that do get flagged cost far more than the rankings they bought, which is why purchased links are a bad trade even when they appear to work. Learn more about [how SEO Done works](https://seodone.ai) and browse the [SEO Done blog](https://seodone.ai/blog) for more guides.