Google Search Essentials: What’s Allowed and What’s Spam in 2026

Google’s old Webmaster Guidelines are now called Google Search Essentials, and they consist of three parts: technical requirements, spam policies and key best practices. The technical requirements decide whether a page can make it into the index at all. The spam policies draw the line between optimisation and manipulation, and breaking them ends in lower rankings or removal from the results.

In 2026 Google changed these rules several times: it added back button hijacking (enforced from 15 June), made it clear that attempts to manipulate AI answers in Search also count as spam (15 May), stated that it may take manual actions based on spam reports (April) and changed how the site reputation policy is applied in the European Economic Area (from 30 August).

This post is only about the rules – what Google considers allowed and what it considers spam. If you’re looking for what affects rankings (content, E-E-A-T, Core Web Vitals, links), I’ve covered that separately in my post on Google ranking factors. Here I translate ‘Google Search Essentials’ into the kind of language you’d use over Sunday lunch, without throwing around terms I don’t explain. And if the very idea of SEO is new to you, start with my post on what SEO is.

What are Google Search Essentials (formerly the Webmaster Guidelines)?

Google Search Essentials is the official Google document that replaced the old Webmaster Guidelines in October 2022. So if you’re looking for ‘Google webmaster guidelines’ or ‘Google SEO guidelines’ – this is the document you want. It describes the minimum a site has to meet to appear in Search, and the practices for which Google lowers rankings or removes pages from the results. The document is split into three parts:

1. Technical requirements – the bare minimum for Google to be able to index a page.
2. Spam policies – behaviours and tactics that lead to lower rankings or complete exclusion from the results.
3. Key best practices – practices that help a site perform better in Search.

An important caveat that Google states outright: meeting all the requirements and following all the best practices does not guarantee that a page will be indexed or shown in the results. It’s a necessary condition, not a sufficient one.

Technical requirements – the minimum to get into the index

This part is shorter than many people expect. Google itself says most sites meet the technical requirements without even realising it. There are three:

Requirement	What does it mean in practice?	Typical mistake
Googlebot isn’t blocked	The page is publicly accessible and the crawler can fetch it.	A block in robots.txt, content available only after logging in.
The page works	The server returns an HTTP 200 (success) status code.	4xx and 5xx errors, redirect loops, ‘soft’ 404s.
The page has indexable content	The text is in a supported format and accessible to Googlebot, and the page doesn’t violate the spam policies.	Content visible only after running a script that doesn’t work for the crawler; a page that violates the policies as a whole.

That’s why technical hygiene matters so much. Avoid redirect loops (which I wrote about in my post on 3XX status codes), fix server errors and make sure internal links point to working pages. Also remember that Google indexes the mobile version of your pages – if part of the content disappears on a phone, for the crawler that content simply doesn’t exist.

Spam policies – what to avoid so you don’t get penalised

In the SEO world, as in Star Wars, there’s the Light Side of the Force (White Hat SEO) and the Dark Side (Black Hat SEO). The latter tempts you with quick results and shortcuts. The rule is simple: if you do something only to trick the algorithm, not to help the user, you’re in the crosshairs.

Since May 2026, Google has said explicitly that spam isn’t only about manipulating rankings, but also about attempts to manipulate generative AI answers in Search (AI Overviews, AI Mode) – the policies apply across the whole of Search, including those answers. Google detects violations in two ways: through automated systems (including SpamBrain, its AI-based spam-prevention system) and – where needed – through people, whose review can end in a manual action. The result is the same: a site can drop in the results or disappear from them entirely. Google also points out that the list isn’t exhaustive and that it can act on any form of spam it detects.

The current list of spam policies (as of October 2026):

Policy	What counts as a violation?
Cloaking	Showing different content to crawlers and to users in order to manipulate rankings.
Doorway abuse	Creating many pages or domains targeting similar queries (e.g. one per city) that only funnel traffic to a single destination.
Expired domain abuse	Buying an expired domain and publishing low-value content on it to exploit its history.
Hacked content	Content added without the owner’s knowledge through a security hole (injected code, pages, redirects).
Hidden text and link abuse	Hiding content from people, e.g. white text on a white background, text positioned off-screen, a font size of 0.
Keyword stuffing	Unnatural repetition of phrases, lists of cities or phone numbers inserted purely for ranking.
Link spam	Buying and selling links that pass ranking credit, excessive link exchanges, automated link building.
Machine-generated traffic	Sending automated queries to Google without permission, e.g. mass rank checking by scraping the results.
Malicious practices	A mismatch between what the user expects and what actually happens: malware, unwanted software, back button hijacking.
Misleading functionality	A site promises a service (e.g. a generator, a PDF converter) that it doesn’t deliver and leads to ads instead.
Scaled content abuse	Mass-producing pages with no value for users – regardless of whether it’s done by a person, a script or AI.
Scraping	Taking other people’s content (often automatically) and publishing it without adding value.
Site reputation policy	Publishing third-party content on a site mainly to benefit from the standing it has earned in Google.
Sneaky redirects	Sending the user somewhere other than what the crawler was shown, or to content they didn’t expect.
Thin affiliation	Affiliate pages where product descriptions are copied from the merchant with no original value added.
User-generated spam	Spammy comments, forum posts and accounts added by users, often without the owner knowing.

Below I go through the policies that have changed most often in recent years or raise the most questions.

Scaled content abuse – mass-producing rubbish

The scaled content abuse policy has been in force since March 2024 and is one of the most discussed. Spammers used to rely on simple article spinners. Today they use generative AI to flood the internet with thousands of articles in a few hours.

The mechanism is simple: someone writes a script that generates 5,000 pages like ‘plumber Leeds’, ‘plumber Bristol’, ‘plumber Little Snoring’, changing only the city name in the text. The content is grammatically correct but completely worthless, because it adds no unique information about the services in that particular place. Google treats this as spam (and if those pages only funnel traffic to one homepage – as doorway abuse as well).

An important caveat: Google does NOT penalise the use of AI as such. The policy definition explicitly says ‘no matter how it’s created’. If you use ChatGPT or Claude as an assistant, an editor or a brainstorming tool, and the final text is checked by a human and offers real value – you’re safe. The problem starts when the goal is to manipulate rankings through sheer scale, without editorial oversight. Google puts rewriting other people’s content with synonyms or machine translation, ‘stitching together’ snippets from different sites, spreading mass-generated content across many sites to hide its scale, and creating pages that make no sense to a reader but are full of keywords, in the same category.

Site reputation abuse – parasite SEO and the changes in the EEA

The phenomenon known as ‘parasite SEO’ is another plague Google has been fighting since 2024. What’s it about? Imagine a respected educational portal or the website of a big newspaper. These sites have huge authority in Google’s eyes. Clever marketers (often promoting casinos, payday loans or dubious supplements) strike a deal with the publisher and buy themselves a ‘corner’ – a page or subdomain where they publish their promotional content.

Thanks to the authority of the parent domain, that content quickly lands high in the results, even though it’s low quality and has nothing to do with what the site is about (e.g. a casino review on a university website). Google responded with a policy it now simply calls the ‘site reputation policy’. Having third-party content (from freelancers, users or partners) isn’t a violation in itself. The violation is publishing it mainly to benefit from the ranking signals the site has earned with its own content. In August 2026 Google clarified the criteria: in a manual review it checks whether the content was created with enough involvement, editorial oversight or contribution from the host site to be considered fully integrated with it (e.g. consistent branding, clear editorial responsibility, a named author).

The 2026 change: after talks with the European Commission (which in November 2025 opened proceedings over this policy under the Digital Markets Act – DMA), Google changed how it enforces it. From 30 August 2026, a manual action for violating this policy:

• outside the EEA – works as before: it demotes the affected part of the site in the results (the rest of the site stays unaffected);
• in the EEA (the EU, Iceland, Norway, Liechtenstein) – doesn’t affect the results users see; instead, the section in question may be separated from the rest of the site in Google’s systems, so that over time it ranks on its own, without ‘borrowed’ reputation.

Site owners still get a notification in Google Search Console and can submit a reconsideration request, and eligible sites can also use mediation. For publishers in the EEA (Poland, where I work, included), this means a manual action won’t directly lower their results in Google, but the rented section stops benefiting from the domain’s authority anyway. For you the takeaway is simple: build your own reputation rather than trying to hitch a ride on someone else’s. Guest posts are fine as long as they’re substantive and on topic, and the links in them aren’t paid spam (more on that below). Parasitism – not any more.

Back button hijacking – a new policy from June 2026

On 13 April 2026 Google announced that back button hijacking is now explicitly a violation of the malicious practices policy. Enforcement started on 15 June 2026 – Google gave site owners two months to make changes.

What’s it about? A user clicks ‘Back’ because they want to return to where they came from. Instead, the site manipulates the browser history and shows them a page they never visited, ‘recommended articles’ or ads. Google says that inserting deceptive pages into the browser history has always been against Search Essentials, but such cases have become more common, so the policy was clarified. The consequences are a manual action or an automated demotion.

A practical note: Google points out that the source of the problem is sometimes a library included on the page or an ad platform. If you use content recommendation widgets or third-party ad scripts, check that none of them alters the browser history – the responsibility lands on the site owner either way.

Expired domain abuse – domain necromancy

Another trick from the black magician’s hat is ‘expired domain abuse’. It means buying expired domains that once had a good history and plenty of links, then publishing low-value content on them in the hope that the ‘SEO power’ will carry over.

Examples Google itself gives: affiliate content on a domain that used to belong to a government agency, medical products sold on a former charity’s domain, or casino content on what used to be a primary school’s domain. Buying a used domain isn’t forbidden in itself – the violation is using it mainly to manipulate rankings with content that gives users nothing.

The classics: hidden text, keyword stuffing and link spam

Let’s not forget the classics. Hiding text (e.g. white text on a white background), stuffing links into the footer or building networks of sites linking to each other (PBNs – private blog networks) with no real substance – all of this still breaks Google’s rules. The risk is high – from lower rankings to complete removal from the results.

A few distinctions clients often ask me about:

• Tabs and expandable sections aren’t hidden text. Google says explicitly that accordions, tabs, carousels or tooltips that reveal content on click don’t violate the policies.
• Buying links isn’t always spam. Advertising and sponsored links are fine if they have a rel="sponsored" or rel="nofollow" attribute. What counts as spam is paid links that pass ranking credit, including exact-match anchor links in sponsored articles, guest posts and press releases.
• Keywords are necessary, stuffing isn’t. Google recommends using the words people search for in titles, headings and alt text. The violation is unnatural repetition of phrases, blocks listing the cities a page wants to rank for, or lists of phone numbers with no value.

Other practices that can lead to demotion or removal

Besides the list of spam policies, Google names several situations that also lead to lower visibility:

• Legal removals – a large number of valid copyright removal requests (as well as defamation, counterfeit goods or court orders) can demote other content from the same site.
• Personal information removals – likewise, when there are many requests concerning e.g. doxxing.
• Policy circumvention – e.g. moving penalised content to new subdomains or directories. Google may then remove a larger part of the site from the results or take away its eligibility for features such as Discover.
• Scams and fraud – impersonating businesses or government services, fake contact details, luring users in under false pretences.

Manual actions in Google Search Console and reconsideration requests

When a Google employee decides that pages on a site violate the spam policies, they apply a manual action. It can affect part of the site or the whole site – in that case the report says it applies to all pages. You’re notified by email and in the Google Search Console message centre, and you’ll find the details in the Security & Manual Actions → Manual actions report.

This distinction matters. A drop after an algorithm update (colloquially an ‘algorithmic penalty’) doesn’t show up in that report and can’t be ‘appealed’ – you have to improve the site and wait for the systems to reassess it. If the drop coincided with a spam update or core update, check the dates in my list of Google algorithm updates. You only submit a reconsideration request for a manual action.

How to go through the process:

1. Read the description of the action. Expand it in the report – you’ll see the type of violation and sample URLs.
2. Fix the problem on all pages, not just the sample ones. A partial fix won’t bring your visibility back.
3. Make sure Google can access the fixed pages – no login, paywall or robots.txt blocks. Check this with the URL Inspection tool.
4. Submit a reconsideration request in the same report. A good request describes exactly what the problem was, what steps were taken to fix it and what the outcome is (e.g. a list of removed pages or links).
5. Wait for a response. According to Google, most requests are reviewed within a few days to a few weeks; link-related cases can take longer. You’ll get the result by email and in Search Console.

Key best practices according to Google

The third part of Search Essentials isn’t a list of prohibitions but of recommendations. Google lists them briefly:

• create helpful, reliable, people-first content, not content written for the algorithm;
• use the words people search for in prominent places: the title, headings, image alt text and link text;
• make your links crawlable – they’re how Google discovers other pages;
• tell people about your site in places where those interested in it hang out;
• follow the best practices for images, video, structured data and JavaScript;
• enable the search result features that fit your site;
• if some content shouldn’t be in Search, exclude it with the right method (e.g. noindex).

How to turn these recommendations into concrete actions – helpful content, E-E-A-T, Core Web Vitals, the mobile version, links – I describe in detail in my post on Google ranking factors. Here one sentence is enough: the policies tell you what you mustn’t do, the best practices – what’s worth doing.

FAQ – common questions about Google’s rules

Do Google’s Webmaster Guidelines still apply?

Yes, but under a new name. The Webmaster Guidelines were replaced by Google Search Essentials. The quality guidelines became the spam policies, and the general guidelines became the technical requirements and key best practices.

Can you be penalised for AI-written content?

Not for using AI as such. The violation is generating many pages with no value for users in order to manipulate rankings (scaled content abuse) – regardless of whether the content was written by a person or a language model.

What’s the difference between a manual action and an algorithmic penalty?

A manual action is applied by a person, you can see it in the Manual actions report in Search Console, and once you’ve fixed things you can submit a reconsideration request. An algorithmic drop isn’t reported anywhere – after making fixes, you have to wait for Google’s systems to reassess the site.

Does following Google’s rules guarantee high rankings?

No. Google states clearly that meeting the requirements and best practices doesn’t even guarantee indexing. The rules protect you from penalties; rankings are decided by the ranking systems.

How do you report a site that breaks Google’s rules?

Through the spam report form. Since April 2026, Google has said it may take a manual action based on a report – previously, reports were used mainly to improve its automated systems. One thing to watch: if Google does take a manual action, the text of your report is passed on to the owner of the reported site, so don’t include any personal data in it (Google rejects reports that contain it).

Did Google launch a new algorithm in 2026?

Not in the sense of one ‘new algorithm’. Google regularly updates its existing systems: by 13 October 2026 there had been two core updates (March and May), four spam updates (March, June, August and September) and one Discover-only update (February). You’ll find the dates and a comment on each in my Google algorithm updates timeline. The policy changes described in this post are something else – they tell you what can get you penalised, not how rankings are calculated.

Summary

Google’s rules in 2026 aren’t complicated: a page has to be accessible to the crawler, work and have indexable content, and anything you do mainly to trick the rankings – from hidden text to renting out a domain’s reputation – can end in a penalty. This year back button hijacking was added to the list, the policies now explicitly cover AI answers in Search, spam reports can end in a manual action, and the site reputation policy works differently in the EEA than in the rest of the world. Is it worth risking your business’s hard-won results for a temporary jump in the rankings? The answer is no. In the end there’s always a human on the other side of the screen – and it’s their attention you’re competing for.