Signs of Black Hat SEO: What to Check on Your Own Site and in Your Backlinks, in One Afternoon With Free Tools

An afternoon proves a lot, and it does not prove everything

Black hat is not a term you will find in Google's rulebook. Our text search of its spam policies and related documents on November 7, 2026 found neither hat. Google's hiring page, last updated June 5, 2026, warns instead about "unethical SEOs." So this check does not ask what color your agency's hat is. It asks whether your site and your links show anything Google's policies describe. The full policy list has its own page. This one is the inspection.

Four hours and four free tools will get you a long way. They will not get you a verdict. Google's Links report help, read November 7, 2026, says the report is a sample and "isn't a comprehensive list," that its tables stop at 1,000 rows, that it may include links since removed, and that it does not say whether a link is nofollow. Third-party tools have their own gaps. Treat each thing you find as a sign, and write it down.

Hour one: two Google screens that can end the argument

Open the Manual actions report. Google's help page, read November 7, 2026, says it shows a count of actions at the top, or a green check mark if there are none. A listed action means a human reviewer at Google decided pages on your site break the spam policies. Now you have a fact and not a suspicion, and the order of repair work matters more than the rest of this page.

Then open Security issues. Google keeps the two apart on purpose: Manual actions is mostly about attempts to manipulate its index, while the Security issues report lists signs of hacking or behavior that could harm a visitor. A finding here may not be your agency's doing at all. It may be someone who walked in through an old plugin. That is a job for malware removal first, and for SEO conversations later.

Hour two: your own pages, read the way a stranger would

Most of what an agency can do to a site, you can see on the site. You do not need to read code. You need to look in places nobody looks, because that is where this sort of thing is kept.

1. 1

   Search for yourself with site:

   Type site:yourdomain.com into Google and page through it. Look for pages you never approved, a foreign language, pharmacy or casino words, or two hundred pages you did not know you owned. Google says hacked content can include injected pages, so unknown pages may point at an intruder and not at your vendor.

2. 2

   Select all on your main pages

   Press Ctrl+A on the home page and your top service pages. White text on a white background shows up when highlighted. Google's hidden text examples include white on white, text behind an image, text positioned off-screen with CSS and a link on one small character. Google also says accordions, tabs, sliders and screen reader text are fine, so do not panic at a collapsed FAQ.

3. 3

   Read your footer and your partners page

   Google lists blocks of cities and regions a page is trying to rank for as keyword stuffing, and partner pages made only to cross-link as link spam. A footer of forty suburbs or a "resources" page of strangers deserves a question. It is one question, not a conviction.

4. 4

   Read three city pages in a row

   Swap the town names in your head. If nothing else changes, compare what you have with Google's doorway examples, including pages targeted at specific cities that funnel users to one page. Our page on city pages separates the ones that earn their place from the ones that do not.

5. 5

   Click your own result on a phone

   Google notes that hacked redirects can depend on referrer, user agent or device, so a page can redirect when clicked from Google Search and behave when typed in directly. Search for yourself on a phone, tap the result and see where you land.

6. 6

   Ask Google what it was shown

   In URL Inspection, read November 7, 2026, the View crawled page option shows the HTML Google got. Search that HTML for words you do not see on the page. If text exists only for the crawler, read Google's definition of cloaking, then read our technical page before you accuse anyone: server rendering and JavaScript sites have innocent differences too.

Hour three: the fingerprints money leaves in a backlink export

Open External links in Search Console and start with Top linking sites, which Google says is there to help you confirm you recognize the sites listed. Then read the link text. Then repeat it in Bing or Ahrefs Free for a second sample. You are not grading each link. You are looking for a pattern a person would have to arrange. The right column below comes from Google's link spam policy, last updated August 28, 2026; the middle columns are our reading, not Google's.

Because the Links report does not show nofollow, open the page on any link that looks bought and view its source. A paid link marked rel="sponsored" or rel="nofollow" is not a violation: Google calls buying and selling links a normal part of the web's economy when they are qualified that way. Open a handful. Five pages read slowly will teach you more than a tool's red number, and Google says third-party tools have no access to its internal ranking data.

Hour four: the Business Profile, the reviews and the invoices

Local shortcuts sit in plain view. Read your Google Business Profile name against your storefront. Google's guidelines, read November 7, 2026, say a name must not include marketing taglines, service information or location information, and that doing so could result in suspension. Check the address too: a rented mailing address where you do not operate is not eligible. If someone at your agency suggested either, see our local page. Then run the free map pack audit for a look at how the profile stands.

Read your reviews next. A run of five-star praise from people nobody on staff remembers is worth asking about. The New York Attorney General announced on September 23, 2013 that 19 companies had agreed to stop writing fake reviews and pay more than $350,000 in penalties, and that some SEO companies had offered to write them for an investigator posing as a shop owner. That is an old case and a state one. We are not lawyers, so take a real concern to your own attorney.

Finally, the paperwork. Lay out twelve months of invoices and reports. Then look for words with nothing behind them: authority placements, publisher partnerships, link velocity, proprietary network. A publisher partnership is a lovely phrase. It may describe a real relationship, or a private blog network with a nicer tie on. Ask for the list of URLs in writing. Google's own suggested question is whether the SEO will share all the changes it makes and the reasoning behind them. An honest vendor has the list open already.

Forbidden by Google or merely bad work: keep the two apart

Fairness matters here for a practical reason: you may need to prove your case to someone. A vendor who did dull, thin work has probably wasted your money. That is a commercial complaint. It is not a policy violation, and calling it one will end the conversation badly. Gray hat tactics get their own page, because the middle is where most arguments live.

What you found, and what to do on Monday

Keep your hands off the delete button for a day. Save your exports, your screenshots and your invoices first, because a cleanup without records cannot be explained later. Google's hiring page is blunt about why it matters: "Ultimately, you are responsible for the actions of any companies you hire." The notice lands on your domain. The agency has other clients.

• A manual action or a security finding: go straight to the recovery order, or to malware removal if the site was hacked.
• Links someone placed for you: ask for the full list, then read our page on bad links before you touch the disavow tool.
• A vague unease and a thick folder of invoices: do the fuller audit of past work, including who holds your accounts.
• Nothing at all: good. Your vendor may be fine. Ask for a monthly report worth reading and look again next quarter.
• A site that simply seems unwell: run the free site audit or website health check, since a technical fault can look a lot like sabotage.

If you want a second reader, send us your last three reports and we will say what we think they show. We sell this work, so weigh the opinion accordingly. Cleanup is quoted after a look at the site. Ongoing white hat SEO work starts from $575 a month, depending on complexity, setup and budget, with no long contract. DataCram is a web studio in San Antonio, building for the web since 1999. You can reach us at (210) 346-0848.