Negative SEO: Spot an Attack and Protect Your Site

Every few months a business owner messages us in a panic. Rankings dropped, someone on a forum said "you've been hit by negative SEO", and now they want a disavow file uploaded tonight. Nine times out of ten, the drop has nothing to do with an attacker. It has everything to do with a Google update, a developer change nobody logged, or a competitor who simply published more.

That matters because the wrong response costs you more than the imagined attack would have. Disavowing links you never earned a penalty for can strip away real equity. Chasing a phantom attacker also burns the weeks you should have spent fixing what actually broke. So this page is about detection and defence — how to tell a real attack from a normal ranking problem, what to monitor so you would notice, and how to harden your site so most attacks cannot land at all. Cleanup is a separate job; this is the step before it.

We run SEO services for Malaysian businesses across property, clinics, manufacturing and e-commerce, and the pattern is consistent enough to write down. ZenWeb handles these investigations weekly, and the triage below is the same one our team runs before touching a single link. Google's own guidance on this has been unusually steady for over a decade — the short clip below is still the clearest statement of how Google thinks about it.

1. What Is Negative SEO — And What It Is Not

Quick Answer: Negative SEO is a deliberate attempt by an outsider to damage your search visibility — spam links, scraped content, fake reviews, hacked pages or bogus takedown complaints. It is not a core update, not a slow slide from thin content, and not a competitor simply doing better work than you.

The label gets stretched to cover any ranking loss the owner did not expect, and that is the first thing to fix, because the diagnosis decides the treatment. A useful test: could the damage have happened if no third party existed? If yes, it is not an attack. Before you answer, confirm the loss is even real — Search Console and GA4 numbers never match, and a reporting gap has been mistaken for negative SEO more than once.

• Is negative SEO. Someone points thousands of spam links at your pages, republishes your content at scale, files a false copyright complaint, or organises fake one-star reviews against your listing.
• Is not negative SEO. A core update reshuffled your niche, your developer removed 40 internal links in a redesign, your product pages went out of stock, or a rival published a better guide than yours.
• Sits in between. Links you or a past agency bought years ago. Those are self-inflicted, and they belong in a toxic backlink cleanup, not an attack investigation.

It also helps to remember what a link is meant to do. A backlink is a vote, and Google has spent years learning to ignore votes that were never freely given. If you are unclear on the mechanics, our plain-English explainer on what a backlink is and why it still matters covers the basics in five minutes. Most spam links today are simply not counted — which is why link-based attacks are far less effective than the forums suggest.

Key takeaway: If the damage could have happened with no third party involved, it is a site problem, not an attack — and treating it as an attack delays the real fix.

2. Is It Really an Attack? A Five-Minute Triage Test

Quick Answer: Run five checks in order — manual actions, drop date versus update dates, which pages fell, your own change log, then your referring domains. If the first four explain the loss, stop. You do not have a negative SEO problem and nothing external needs cleaning up.

How to triage a suspected negative SEO attack

Work through these in sequence. Each step either explains the drop or hands it to the next step.

1. Check for a manual action. Open Search Console, go to Security & Manual Actions. A real link penalty is stated there in plain language. No notice means no manual penalty, whatever a tool's "toxicity score" says.
2. Date the drop. Pin the exact day traffic changed, then compare it to announced Google updates. A drop that lands inside an update window is almost always the update — our guide to telling a penalty from an ordinary drop walks through the distinction.
3. Look at which pages fell. Attacks are usually narrow and target money pages. Updates are broad and hit a whole section or the whole site.
4. Read your own change log. Redesigns, plugin updates, robots edits, and CMS migrations cause more ranking loss in Malaysian SMEs than attackers do. If nobody keeps a change log, start one this week.
5. Only now, open your backlink report. Look for a genuine spike in new referring domains that lines up with the drop date, not a long tail of low-quality links you have carried for years.

If you reach step five and the timing does not line up, the drop is internal. Our walkthrough on diagnosing a Search Console traffic drop is the better next read.

Key takeaway: Backlinks are the last thing you check, not the first. Four cheaper explanations sit ahead of them and one of them is usually the answer.

3. What Ranking Drops Actually Turn Out to Be

Quick Answer: Across ZenWeb ranking-drop investigations for Malaysian SMEs, algorithm updates and client-side technical changes explain roughly six in ten cases. Verified external interference accounts for about one in twenty. The numbers below are why we triage before we clean.

Verified cause of ranking drops in Malaysian SME investigations, 2024 to 2026.

Verified cause	Share of cases	Share	Typical fix window
Algorithm or core update		34%	3–6 months
Client-side technical change		26%	2–6 weeks
Competitor out-published the page		17%	2–4 months
Seasonal or demand shift		11%	No fix needed
Site hacked or malware injected		7%	1–8 weeks
Verified external interference		5%	2–12 weeks

Source: ZenWeb client sample, 500+ Malaysian SME accounts, 2024–2026. Licence.

The two largest buckets are both fixable without touching a single link, and "site hacked" outranks external interference, which tells you basic hosting hygiene protects you more than any disavow file will. If your drop follows a core update, our guide to recovering from a Google core update is the right playbook; if rankings held steady while traffic fell, see why traffic drops while rankings stay stable.

Key takeaway: Around one in twenty investigated drops is genuine outside interference. Budget your panic accordingly and check the other nineteen causes first.

4. Link Spikes: What a Real Attack Pattern Looks Like

Quick Answer: A spam burst arrives fast, peaks within a fortnight and dies. Genuine coverage builds and then keeps a tail. A citation build climbs steadily. Reading the shape of the curve tells you more than any toxicity score, because the shape is very hard for an attacker to disguise.

Most owners look at a single number, total referring domains, and cannot tell whether 400 new domains is normal. Plot it weekly instead. Knowing what safe backlink work costs in Malaysia helps here too, because a genuine campaign has a budget and a pace, and neither of those looks like the first row below. The three patterns cover almost everything a Malaysian SME will ever see.

Weekly new referring domains for three link patterns over eight weeks.

Pattern	W1	W2	W3	W4	W6	W8
Spam link burst	60	510	280	70	8	3
Genuine PR pickup	18	42	36	25	19	15
Citation & directory build	9	11	14	13	16	14

Illustrative patterns modelled on ZenWeb-managed account monitoring, Malaysia, 2024–2026.

The spam burst is unmistakable once you see it plotted: a near-vertical rise, then collapse. It is also the pattern Google is best at ignoring. Set a weekly alert on new referring domains in whichever tool you already pay for, and check it beside your Search Console data so you are comparing links against actual impressions. A burst with no matching movement in impressions or clicks is noise, however alarming the raw number looks.

Key takeaway: Plot referring domains weekly, not as a running total. The shape of the curve identifies the source faster than any third-party toxicity score.

5. Scraped Content and Fake Reviews: The Two SMEs Actually See

Quick Answer: Malaysian SMEs are far more likely to be hit by content scraping and coordinated fake reviews than by link spam. Both are cheap to run, both damage revenue before they damage rankings, and both are detectable with searches you can run yourself in ten minutes.

Content scraping. Someone copies your service pages or product descriptions and republishes them, often on a marketplace listing or a thin affiliate site. Take a distinctive 12-word sentence from your best page, search it in quotes, and see who else has it. If your own page is not first, that is the problem to solve. Fixing it is usually a matter of strengthening the original — clear internal links, faster indexing, and the canonical hygiene covered in our guide to finding and fixing duplicate content. Sellers duplicating listings across platforms face the same issue; our page on ranking Shopee and Lazada listings explains why your own site still needs to hold the original.

Fake reviews. A cluster of one-star reviews lands in a few days, often with no order history, vague complaints and near-identical phrasing. This hurts twice: your map-pack click-through falls, and buyers who do click leave. Report each one through Google's inappropriate-review process, keep screenshots and timestamps, and answer publicly in a calm, factual tone. Our guides on reporting and removing a fake Google review and responding to negative reviews properly cover the wording that works and the wording that makes it worse.

Key takeaway: Run a quoted-sentence search and a review audit monthly. These two checks catch the attacks Malaysian SMEs are genuinely exposed to.

6. Which Attack Types Cause Real Damage

Quick Answer: Ranked by verified cases, scraping and fake reviews dominate. Spam links appear often but rarely move rankings. The two that hurt most per incident are hacked page injections and false copyright complaints, because both remove your pages from results rather than just competing with them.

Verified external interference cases by attack type and severity, Malaysia.

Attack type	Share	%	Damage per incident
Scraped content republished		38%	Low to moderate
Coordinated fake reviews		27%	High on enquiries
Spam backlink burst		19%	Usually none
Hacked page injection		11%	Severe
False copyright complaint		5%	Severe, fast

Source: ZenWeb client tracking, Malaysia, 2024–2026. Licence.

The bottom two rows deserve attention out of proportion to their frequency. A hacked injection quietly adds spam pages to your site — Google then judges you on content you never wrote, which is exactly the behaviour described in Google's spam policies. If it has already happened, work through cleaning malware from a hacked website first, then recovering rankings after a hack. Injected spam pages also flood your crawl budget, the same failure mode we describe in fixing filter-page crawl bloat — thousands of junk URLs crowding out the pages that earn money.

False copyright complaints are rarer but faster, and they are the one negative SEO tactic that can pull a page out of results outright rather than merely outrank it. A page can disappear while the claim is reviewed, which is why keeping dated proof of authorship (publish dates, original files, drafts) is worth the five minutes it takes.

Key takeaway: Frequency and damage do not match. Spam links are common and mostly harmless; hacks and false takedowns are rare and genuinely dangerous.

7. How to Harden Your Site Before Anything Happens

Quick Answer: Defence against negative SEO is ordinary site hygiene done consistently — patched software, two-factor logins, verified Search Console ownership, weekly backlink and review alerts, and a change log. None of it is exotic, and together it removes most of the surface an attacker could use.

In our experience, the sites that get hurt were already soft before anyone targeted them. An attacker with a spam list cannot do much to a well-maintained site. A site running a three-year-old plugin stack is a different story.

• Patch on a schedule. Core, theme and plugins updated monthly, with a staging check first. Our WordPress security guide covers the specifics for the CMS most Malaysian SMEs run.
• Two-factor everything. Hosting, CMS admin, domain registrar, Google Business Profile. Registrar access is the one people forget and the one that hurts most.
• Keep HTTPS clean. A lapsed certificate looks like compromise to both users and crawlers — see why HTTPS still matters.
• Own your Search Console property. Verified in the business owner's account, not only the agency's, so alerts reach you directly.
• Set weekly alerts. New referring domains, new reviews, and Search Console coverage spikes. Detection speed is the whole game.
• Log every change. Date, who, what. This single habit resolves most "is it an attack?" questions in under a minute.
• Plan domain moves carefully. Rebrands are the moment sites are most fragile — our guide to keeping rankings through a domain name change covers the redirect mapping to get right.

Key takeaway: Hardening is not an anti-attack project. It is maintenance that happens to close the doors an attacker would need.

8. When Disavow Is Warranted — And When It Backfires

Quick Answer: Disavow when you have a manual action for unnatural links, or when you can see a clear, dated spam burst you did not build and cannot get removed. Everywhere else, leave it alone. Google ignores most spam links already, and a broad domain-level disavow can remove links that were helping you.

Google's own documentation calls this an advanced feature that can hurt your performance if used carelessly, and says most sites will never need it. That guidance is worth reading before you upload anything: disavow links to your site. And if the bad links predate you, bought years ago by a previous agency, that is a toxic backlink cleanup rather than a negative SEO response. The matrix below is how we decide.

Disavow decision matrix by observed signal, confirmation rate and recommended action.

Signal observed	Confirmed as attack	First action	Disavow?
Manual action for unnatural links	Not required	Document and request removals	Yes
Dated spam burst, no manual action	About 1 in 3	Monitor 4–6 weeks	Only if impact shows
High "toxicity score", no spike	Rare	Ignore the score	No
Scraped content outranking you	Often	Strengthen the original page	No
Review flood on your listing	Often	Report and reply publicly	No
Unknown pages indexed on your domain	Almost always	Treat as a hack immediately	No

Source: ZenWeb triage framework and client sample, Malaysia, 2024–2026. Licence.

Notice how few rows end in "yes". If you do have a notice in Search Console, follow the proper route in our guide to fixing a Google manual action, and if the account is complicated or revenue is at stake, our note on when to bring in an SEO agency for penalty recovery explains what outside help should actually deliver.

Key takeaway: Disavow is a penalty tool, not a hygiene tool. Without a manual action or a measurable impact, uploading a file risks more than it protects.

9. Conclusion

Quick Answer: Treat negative SEO as a monitoring discipline, not an emergency. Triage before you clean, watch the shape of your link and review curves, harden the basics, and reserve disavow for the narrow cases that genuinely call for it.

The businesses that come out of this well are not the ones with the most aggressive cleanup. They are the ones who noticed early because someone was watching, and who could tell within an hour whether the cause was internal. That is a process problem, not a tooling problem, and it is well within reach of a Malaysian SME running a small team.

If you want that monitoring running without adding it to your own week, it is part of how we run SEO for Malaysian businesses: we set the baseline, watch the alerts, and act only when the evidence actually calls for it.

10. Frequently Asked Questions

1. Can a competitor really damage my Google rankings?

It is possible but uncommon. Google ignores most spam links automatically, so link-based attempts usually fail. The methods that do work are content scraping, coordinated fake reviews, hacking, and false copyright complaints. In our Malaysian client investigations, verified outside interference explains roughly one drop in twenty.

2. How do I know if I have been hit by negative SEO?

Check Search Console for a manual action, match the drop date against Google update dates, see whether the loss is narrow or site-wide, review your own change log, and only then look for a dated spike in new referring domains. If the first four steps explain the drop, it is not an attack.

3. Should I disavow spam links pointing at my site?

Usually not. Disavow is intended for sites with a manual action for unnatural links, or a clear spam burst you did not build and cannot get removed. Google describes it as an advanced tool that can harm performance if misused, and most sites never need it.

4. What should I do about scraped copies of my content?

First confirm your original still ranks first for a quoted sentence from the page. If it does, the copy is doing no harm. If it does not, strengthen the original with better internal linking, faster indexing and correct canonical tags before considering a takedown request.

5. How often should a Malaysian SME check for this?

Monthly is enough for most businesses: one backlink review, one review-profile check, one quoted-sentence search on your top pages, plus automated Search Console alerts. Increase the frequency only if you are in an unusually aggressive niche or have already been targeted once.