Black Hat SEO Has Sixteen Named Things, and Three of Them Arrive Uninvited

The tactics have names, and three of them can turn up on a page you never touched. Here is the full list, and the checks that take a minute.

Editorial TeamEditorial DeskSeptember 16, 2026 · 10 min read

/ On this page7 sections

The tactics have names, and somebody else writes the list. Google's spam policies name sixteen, and three of them describe content that turns up on a site nobody edited.

So the useful thing to do with the list is not to memorize it. It is to check your own site against it, and most of that takes about a minute.

TL;DR

The label is ours. The list is not. Nothing in the source documents says black hat, white hat, or ethical. They name practices and say what happens.
There are sixteen named practices, plus a separate section of other things that can get a page demoted or removed.
Three of the sixteen describe content the owner did not put there, and the policy text says so in its own words.
The test underneath is one question. Would a page exist in this form if search engines did not?
Structured data misuse is not on the list. It has a document of its own, which is why it is handled differently.
A violation is handled two ways, and only one of them tells you. A human review leaves a notice. A system adjusting rankings leaves nothing.
The two checks worth running tonight are a site: search on your own domain and a nonsense phrase typed into your own search box.

What Black Hat SEO Means

Black hat SEO is the search engine optimization industry's name for work that tries to move a page up the results by manipulating a search engine rather than by being the better answer.

Google does not use the phrase. Its spam policies name the practices instead, sixteen of them, each with a definition and examples.

That difference matters more than it sounds.

A label describes a person's intent, which nobody outside the room can audit. A named practice describes a page, which anybody can look at.

The policies' own opening defines spam as techniques used to deceive users or manipulate search systems into featuring content prominently.

Read the second half of that carefully. It now covers manipulating generative AI responses in Google Search as well as rankings.

Why the Word Is Ours

Neither the spam policies nor Google Search Essentials, the parent document they sit inside, uses the words black hat, white hat, or any form of ethical.

Counted the same day on both pages, each against a control term it does carry. Cloaking, doorway abuse and link spam are all on the spam policies page. Technical requirements and spam policies are both on Search Essentials.

Black hat, white hat and ethical are on neither.

The hats come from westerns, where the hero wore a white one. The etymology ends there, and it is the least useful fact in the subject.

What replaced it in the source is a test rather than a judgment. A practice is named when it deceives a user or manipulates a system, and the examples under each name are all descriptions of a page, never of a person.

A two-column count taken from Google's spam policies page and from Google Search Essentials on the same day. The left column shows a control term drawn from each page and marked present on the page that carries it: cloaking, doorway abuse and link spam on the spam policies page, technical requirements on Search Essentials. The right column shows the three words the industry uses to discuss the subject, black hat, white hat and any form of the word ethical, each at zero occurrences on both pages. A band underneath states the reading: a label describes a person's intent, which nobody outside the room can audit, and a named practice describes a page, which anybody can look at. — Neeraj Jivnani · Counted on Google Search Central's spam policies for Google web search and on Google Search Essentials, both read September 12, 2026, each page searched against a control term it does carry

The Sixteen the Policies Actually Name

Here is the whole list, in one place, in the order the policies give it.

Read the right-hand column first. It decides whether a name on this list is a choice somebody made or a condition your site is in.

The practice	What it is	Can it be true without a decision?
Cloaking	Showing search engines one thing and people another, to manipulate rankings and mislead users	No
Doorway abuse	Pages built to rank for similar queries that lead to an intermediate page less useful than the real destination	Rarely, but see below
Expired domain abuse	Buying a lapsed domain and repurposing it, mainly to manipulate rankings with content of little value	No
Hacked content	Content placed on a site without permission, through a security weakness	Yes, by definition
Hidden text and link abuse	Text or links placed so search engines see them and people do not	Sometimes, through a template or a paste
Keyword stuffing	Filling a page with keywords or numbers to manipulate rankings, often in a list or out of context	No
Link spam	Creating links to or from a site mainly to manipulate rankings	Sometimes, through an agency
Machine-generated traffic	Automated queries to Google, including scraping results for rank checking	Sometimes, through a tool
Malicious practices	Malware and unwanted software, where what a user gets is not what they expected	Yes, and the policy says so
Misleading functionality	A site that promises a service it does not deliver, such as a generator that generates nothing	No
Scaled content abuse	Many pages made mainly to rank rather than to help, no matter how they were produced	No
Scraping	Taking content from other sites and hosting it to manipulate rankings	No
Site reputation policy	Third-party content published on a host site mainly to borrow that host's ranking signals	Sometimes, in a large organization
Sneaky redirects	Sending a visitor somewhere other than the page they asked for, deceptively	Sometimes, after a hack
Thin affiliation	Affiliate pages whose descriptions and reviews are copied from the merchant with nothing added	No
User-generated spam	Spam added to a site by users, through a channel meant for user content	Yes, and the policy says so

A seventeenth heading follows the sixteen. It covers other practices that can get a page demoted or removed: legal removals, personal information removals, policy circumvention, and scam and fraud.

Those are not spam policies. They are separate routes to the same outcome.

One thing you may expect to find here is missing. Marking up a page with structured data it does not deserve is not one of the sixteen, because structured data has guidelines of its own in a separate document.

The Three That Can Land Without You

The policy text is unusually direct about this, and it says so three separate times.

Hacked content is defined as any content placed on a site without permission, due to vulnerabilities in a site's security.

Of user-generated spam, the policies say plainly that site owners are often unaware of the spammy content. Under malicious practices, they note that site owners sometimes do not realize that their downloadable files are considered malware.

Three admissions, in a document written as a list of violations.

That changes what the list is for. Thirteen of the sixteen are choices, and if you did not make them you can stop reading those rows.

The other three are conditions, and a condition has to be looked for.

The defenses are ordinary, and Google's guidance on preventing user-generated spam lists them. It opens on spammers generating content on an unsuspecting victim site.

Moderate what new accounts post.
Put noindex on posts from accounts with no history.
Attach nofollow or ugc to links in untrusted content.

The cheapest detection is in there too. Search your own domain with the site: operator and read what comes back.

There is no tool to buy and no account to open. You are looking for pages you do not recognize, in languages you do not publish in, about products you do not sell.

The Search Box Nobody Thinks Of

There is a fourth route, and it uses a feature you probably switched on and forgot.

Type a phrase into a site's own search box that matches nothing, and many sites still build a real page at a real URL with that phrase printed on it.

The abuse is exactly what it sounds like. The phrase is chosen by a stranger, the page sits on your domain, and search engines can index it.

The security literature has a name for the page it produces: a reflection URL.

The scale is worth one sentence. Internal site search was in use on 47.23% of the top million sites and 11.76% of the top ten thousand domains could be exploited this way, in a 2024 USENIX Security Symposium paper on the practice.

Doorway abuse, one of the sixteen, names pages that are closer to search results than a clearly defined, browseable hierarchy. That is a fair description of a search page that exists only because somebody typed something.

Checking is quick. Type a nonsense phrase into your own site's search box, look at the URL that comes back, and see whether that page is something a crawler would be allowed to keep.

Read the list as an inventory

What is your site exposed to?

Nothing below is a thing you did. Tick what your site has, and the named policies those features leave open come back with what to look for. Having one of these is not a violation. It is a place a violation can arrive without anybody deciding it.

Nothing ticked yet

Tick what your site has. These are features, not things you did.

The sixteen practices named in Google's spam policies for Google web search, sorted into two groups by a single question: can this be true of a site without its owner deciding anything? Thirteen sit in the first group, which are choices somebody makes, and are listed by name: cloaking, doorway abuse, expired domain abuse, hidden text and link abuse, keyword stuffing, link spam, machine-generated traffic, misleading functionality, scaled content abuse, scraping, site reputation policy, sneaky redirects and thin affiliation. Three sit in the second group, highlighted, because the policy text itself says the owner may not know: hacked content, which is defined as content placed on a site without permission; user-generated spam, of which the policy says site owners are often unaware; and malicious practices, where the policy notes that site owners sometimes do not realize their downloadable files count as malware. A band at the foot records that a seventeenth heading covers other practices that can lead to demotion or removal, and that structured data is governed by a separate document and is not on this list. — Neeraj Jivnani · Every name and definition is quoted from Google Search Central's spam policies for Google web search, read September 12, 2026; the sort into two groups is ours

What Happens If Any of It Is on Your Site

Start with what happens to a site that has nothing to read. An empty Search Console is not a clean bill of health, and that is the line to carry out of this section.

The policies name two ways a violation is found. Violations are detected through automated systems and, as needed, human review that can result in a manual action, and sites that violate the policies may rank lower in results or not appear in results at all.

Only the second of those puts anything in front of you.

A human review produces a notice you can read, sitting in an account you control, and it persists until somebody resolves it. The automated route produces nothing you can open. No notice, no label, no date.

So a site with no notice has learned one thing and not the other. It is not under review. The silence establishes nothing beyond that.

Recovery splits the same way, and so does the question of when you will know. One route closes on a decision somebody makes. The other closes whenever the systems next reassess, on no published timetable.

The Half That Is Now About AI Answers

The spam policies' definition now covers attempting to manipulate generative AI responses in Google Search, not only rankings.

That is not a new discipline, whatever is being sold on the strength of it.

The named practices did not change. What changed is the second place a manipulated page can show up.

Scaled content abuse is the clearest example of the shift.

Its first published example is using generative AI tools or other similar tools to generate many pages without adding value for users, and the policy says plainly that the issue is not how the content was produced.

So the question a publisher is being asked is the same one as before. Not whether a machine wrote it, but whether the page was made to help somebody.

A two-column comparison of the two routes by which a Google spam policy is enforced, drawn from the two consecutive sentences in the policies that state both. The left column is human review resulting in a manual action: you are told, because it leaves a notice in Search Console; the notice stays until it is resolved; and recovery ends when a review says it does. The right column, highlighted, is the systems acting without a review: the page ranks lower or stops appearing, nothing arrives, no notice and no label and no date, a system adjusting rankings leaves nothing behind, and recovery comes whenever the systems reassess, on no published timetable. A band underneath states the consequence: if you lost traffic and Search Console is empty, the absence of a notice tells you almost nothing, because the quieter of the two routes leaves no evidence at all. — Neeraj Jivnani · Both routes are stated in two consecutive sentences of Google Search Central's spam policies for Google web search, read September 12, 2026; reading the quiet route as a diagnostic problem rather than a lighter penalty is ours

Does Any of It Still Work

Some of it still works, for a while, and pretending otherwise is what makes this subject hard to write about honestly.

The question keeps getting asked by people who have watched a competitor do well on something obvious. The reassuring answer, that none of it works any more, is not one we can give.

The honest framing is not whether it works. It is who carries the cost when it stops, and how long the gap is between the two.

One line in Google Search Central's spam policies prices that gap better than any case study can. The policies cover common spam practices, they say, and Google may act against any type of spam practice it detects.

So the list is not a boundary. Treating it as one, and sitting a little inside the line, is the version of this that goes wrong slowest and therefore costs the most.

For a business with anything to lose, we think the arithmetic almost never clears. The upside is a period of rankings you cannot forecast, and the downside lands on the one asset you cannot rebuild quickly.

There is also a quieter cost. The ones that touch a page make it worse for the person who lands on it, so the traffic they win converts at a rate nobody models when they are choosing the tactic.

Black, White and Grey

White hat SEO is the same industry vocabulary pointed the other way: work that tries to make the page the better answer rather than to manipulate the system that picks one.

The line between them is not ethics, whatever the labels suggest. It is a plainer question.

Would a page exist in this form if search engines did not?

Grey hat names the space where that question has two defensible answers. A simplified accessible version of a site can look, technically, like serving two different pages, and a person who builds one is not deceiving anybody.

That is the real content of the grey category: practices where a description in the policies fits and the intent behind the test does not.

Reporting a Site That Is Doing It

You can report a site through Google's search quality user report, which the spam policies link to.

Two things temper what it achieves.

The policies say what the reports are for. Google uses them to improve its spam detection systems, which makes your evidence training rather than a case.

And a competitor outranking you with something that looks like a violation is a different problem from a competitor outranking you. Reporting is not a plan, and it should never be the thing that happens instead of one.

The List Reads Better as an Inventory

A menu is a list of things you might choose. An inventory is a list of things you already have, and that is the reading this list rewards.

Nobody has to decide anything to be on it.

The names will keep moving, and more will arrive as the ways of generating pages cheaply keep arriving. Learning them by heart is the wrong work.

What does not move is the exposure. A comment box, a login form, an upload field and a search box have sat under one policy name or another for as long as the list has existed.

They are on your site because they are useful. That is exactly why nobody looks at them.

/ What Black Hat SEO Means

/ Why the Word Is Ours

/ The Sixteen the Policies Actually Name

/ The Three That Can Land Without You

The Search Box Nobody Thinks Of

/ What Happens If Any of It Is on Your Site

/ The Half That Is Now About AI Answers

/ Does Any of It Still Work

/ Black, White and Grey

/ Reporting a Site That Is Doing It

/ The List Reads Better as an Inventory

/ More on SEO