Spoke
Black-hat risk is a balance-sheet item
Cheap links and generated pages aren't a cost saving. They're a bet against everything your domain has earned, and you should price them that way before you buy them.
The prohibited practices are documented in Google's spam policies, linked. Framing the exposure as a liability is our argument, not a published finding.
People buy banned tactics because they compare them against the wrong thing.
The comparison they make is cheap vendor versus expensive vendor. The comparison that matters is cheap vendor versus losing the channel.
What is the real cost of buying links?
The chance of a penalty multiplied by everything your domain currently earns from search. Not the amount you saved on the invoice.
A link-buying program saving a modest sum each month, against a channel producing serious revenue, is betting the channel to win the saving. Price it that way before you buy, and most of these decisions make themselves.
The math
Put your own numbers in rather than taking a vendor's word for the risk.
Exposure = chance of getting caught × what the search channel earns you per year × years to recover
Three things about that. The chance isn't small and it isn't fixed — detection gets better, and tactics that were safe for years stop being safe with no announcement. What's at risk is the whole channel, because a site-level action doesn't politely confine itself to the pages involved. And recovery runs in quarters at best.
Against that, your saving is a line item. It isn't close.
Two kinds of trouble
A manual action comes from a human reviewer, shows up in Search Console, and has a defined way out: fix it, document it, ask for reconsideration. Unpleasant. Survivable.
Quiet downranking is worse in every way. Nothing is reported. No notification, no reconsideration, and no confirmation when you've fixed it. Traffic falls and you're left guessing.
Most people plan for the first. The second is far more common, which is why "we've never had a penalty" is weak evidence that nothing's wrong.
What's actually banned
Google's spam policies are published and specific. The ones that get sold as services: link schemes, scaled content abuse (lots of pages whose main job is manipulating rankings), doorway pages, cloaking, and buying an expired domain to exploit its history.
Go read them before you sign anything. They're short, they're in plain language, and they describe several things vendors advertise openly.
If you're already exposed
- Work out which kind it is. Check Search Console for a manual action. If there isn't one, you're chasing an algorithmic problem.
- Inventory honestly. Every link campaign, every bulk content program, every vendor, every domain — including the ones from before anybody currently employed was here.
- Remove what you can. Actually removing a link beats disavowing it.
- Disavow the rest, narrowly. Disavow is a scalpel for links you can't remove during a manual action. It isn't a cleanup tool to swing around speculatively.
- Fix the cause. Ending the contract matters more than cleaning up the output.
- Document it, then request reconsideration if there's a manual action. Reviewers can see effort. A vague request fails.
- Expect it to take a while. Months, sometimes longer, with no promise you get back to where you were.
The question to ask before signing
"What happens to us if this vendor's methods get penalized in two years?"
If nobody can answer that, the risk hasn't been priced. It's just been moved onto the asset. And the asset is yours.
More in Buying services
Red flags
A short list of things that end the conversation, and why. Most of them aren't dishonesty. They're somebody describing a product that can't exist.
Contract terms
Everybody's pitch sounds the same. The contract is where firms differ, and these are the clauses that decide what happens when results are slow — which is the situation you'll actually be in.
Channel economics
A switch, a building, and something in between. The comparison that matters isn't cost per lead today. It's what each one is worth after you stop paying for it.
Recovery playbook
What to do when visibility collapses. The first job is working out which of two very different things happened, because the response to one is a process and the response to the other is a diagnosis.