Spoke
What gets penalized, and why the list barely changes
The tactics search engines act against have barely moved in two decades. AI didn't add a new category. It made the oldest one cheap.
Every pattern named here appears in Google's published spam policies, linked below. The observation that the list has been stable is ours.
People expect this list to change every year. It doesn't.
Read a spam policy from ten years ago and you'll recognize almost all of it. That tells you something useful: these aren't fashions. They're the durable ways of faking the signals search actually runs on.
What does Google actually penalize?
Google's spam policies name link schemes, scaled content abuse, doorway pages, cloaking, hidden text, keyword stuffing, expired domain abuse and site reputation abuse, among others. The thread running through all of them is manufacturing a signal instead of earning it — fake links, fake relevance, fake independence, fake volume.
The nuance that matters: most of the damage isn't a penalty in the formal sense. A manual action shows up in Search Console and you can appeal it. Being quietly downranked by an algorithm shows up nowhere, which is why most affected sites never find out it happened.
The list
| Earn the signal | Fake the signal |
|---|---|
| Links from people who found you worth citing | Bought links, link exchanges, private networks |
| One strong page per topic | A pile of near-identical pages |
| Pages for each place you really serve | Doorway pages that differ only by city name |
| The same content for people and crawlers | Something different served to crawlers |
| Words used where they belong | Keyword stuffing, hidden text |
| A domain you built | An expired domain bought for its history |
| Your own reputation | Content parasiting somebody else's |
What AI actually changed
Not the categories. The economics.
Scaled content abuse — generating pages mainly to manipulate rankings instead of helping anybody — used to need a content farm and a budget. Now it needs an afternoon. Google's spam policies name generative AI used to produce lots of pages without adding value as an example of exactly that violation.
So the risk didn't move. It got cheap enough that people incur it without noticing they have.
"We generated two hundred service-area pages" isn't a content strategy. It's a description of the violation.
Two different things people confuse
A manual action is a human decision. It shows up in Search Console. There's a defined path: fix it, document it, request reconsideration. Unpleasant, survivable, visible.
Algorithmic suppression is a ranking system deciding it likes you less. Nothing gets reported. No notification, no appeal, and no confirmation when you've fixed it. You watch traffic fall and you're left to work out why on your own.
The second is far more common.
"We've never had a penalty" usually means "we've never had a manual action," which is a much weaker claim than the person saying it thinks it is.
Why this sits under the basics
Because buying services depends on it. Pricing black-hat risk only makes sense once you know what the liability is, what sets it off, and that most of it arrives in silence.
Anybody selling you the right-hand column above is selling you a position on this list.
More in Search fundamentals
How search works
Three stages, three distinct failure modes, and one diagnostic habit that saves most of the time people waste guessing. Everything else on this site assumes this model.
Semantic understanding
Search systems model meaning rather than matching strings, which is why naturally phrased content now ranks for queries that contain none of its words — and why keyword density stopped being a lever a long time ago.
How AI answers are built
It reads the question, fans it out into several searches, retrieves passages, writes an answer, and credits some of it. Knowing the order tells you which stage you failed at, which is the only way to fix anything.