Black Hat SEO: The Sixteen Practices Google Actually Names

Black hat SEO is the informal name for techniques that try to manipulate search rankings rather than earn them. Google does not use the term in the documentation that defines the boundary. It publishes a list of sixteen named spam policies instead, and that list is the only version of the boundary that carries consequences, because it is the one its systems and reviewers act on.

The gap between the folklore term and the published list is worth closing, and not only for people considering something dubious. Three of the sixteen describe work that is sold as ordinary software and ordinary PR, which is how a compliant-looking marketing operation ends up inside a policy without anyone deciding to. Two more describe things done to your site rather than by it.

Why the term exists, and why Google's own documentation avoids it

"Black hat" arrived from security, where it separates people who break systems to exploit them from people who break systems to fix them. Applied to SEO, it carries an implication Google has never endorsed: that there is a clean line between clever and criminal, and that you can tell which side a technique is on by naming it.

Google's framing is different and more useful. Its spam policies page defines spam by intent and effect:

In the context of Google Search, spam refers to techniques used to deceive users or manipulate our Search systems into featuring content prominently, such as attempting to manipulate Search systems into ranking content highly or attempting to manipulate generative AI responses in Google Search.

Deceive users, or manipulate the systems. That is the test, and note that it now reaches generative AI answers as well as the ten blue links. A technique is not safe because it has a respectable name, and it is not dangerous because a blog called it black hat. The page also tells you the list is not exhaustive: "Our policies cover common spam practices, but Google may act against any type of spam practices we detect."

The sixteen practices Google actually names

These are the policy headings, in Google's own order, read on 3 November 2026 from a page Google stamps "Last updated 2026-08-28". Each row summarises what the policy covers. The first two columns follow Google's text. The third is our own reading of who typically causes the problem, and Google does not categorise them that way.

Policy	What it covers	Usually caused by
Cloaking	Showing search engines different content from users	The site owner
Doorway abuse	Pages built to rank for near-identical queries and funnel users onward	The site owner
Expired domain abuse	Buying a lapsed domain to reuse its ranking signals for content with little value	The site owner
Hacked content	Content placed on a site through a security hole	An attacker
Hidden text and link abuse	Text or links placed for engines but hidden from people	The site owner
Keyword stuffing	Filling a page with keywords or numbers to manipulate ranking	The site owner
Link spam	Links created mainly to manipulate rankings, in either direction	The site owner or an agency
Machine-generated traffic	Automated queries to Google, including rank-checking scrapes	Tooling
Malicious practices	Malware, unwanted software, back button hijacking	The site owner
Misleading functionality	Sites promising a service they do not provide	The site owner
Scaled content abuse	Many pages generated to rank rather than to help, however produced	The site owner
Scraping	Republishing others' content without original value	The site owner
Site reputation policy	Third-party content hosted mainly to borrow the host's ranking signals	The host and a partner
Sneaky redirects	Redirects that show users and engines different content	The site owner or an attacker
Thin affiliation	Affiliate pages copying merchant descriptions with nothing added	The site owner
User-generated spam	Spam posted into comments, forums and uploads on your site	Your visitors

Four more headings sit under "Other practices that can lead to demotion or removal". Two of them, legal removals and personal information removals, turn on the volume of valid removal requests a site attracts rather than on any technique. The other two do not: policy circumvention covers continuing to act in ways intended to bypass the policies, including on new subdomains, and scam and fraud covers impersonation and false pretenses.

Three of these catch work that is sold openly

Run your own marketing operation against the list and the uncomfortable entries are not the ones about hidden text. They are the ones that describe standard practice.

Machine-generated traffic: rank checking is named in the policy

This is the entry most teams have never read. Google's wording:

Machine-generated traffic (also called automated traffic) refers to the practice of sending automated queries to Google. This includes scraping results for rank-checking purposes or other types of automated access to Google Search conducted without express permission.

Checking your rankings by script is the example Google chose to lead with. The qualifier that matters is "without express permission", and whether any given commercial rank tracker holds such permission is between that vendor and Google, not something we can determine from outside. What is clear is that a homegrown script hitting Google to log positions is the thing this sentence describes. It is also why the SERP positions quoted in our own articles come from a third-party SERP index rather than from us querying Google.

Link spam: sending a product in exchange for a link is named too

The link spam section lists buying or selling links for ranking purposes, and spells out what counts as buying:

Sending someone a product in exchange for them writing about it and including a link.

That is product seeding, a routine PR and influencer tactic. Google is not banning it. The policy is explicit that commercial links are fine when they are declared: "It's not a violation of our policies to have such links as long as they are qualified with a rel="nofollow" or rel="sponsored" attribute value to the <a> tag." The violation is the undeclared version. If your outreach sends products and asks for a followed link, you are inside the policy's own example and the fix is an attribute, not a retreat. How to get backlinks covers what is left when you take this seriously.

Scaled content abuse: the test is value, not authorship

The AI content question is settled on this page and not in the direction either camp usually claims. Google's definition targets volume without value "no matter how it's created", and the first example given is using generative AI tools "to generate many pages without adding value for users".

So the policy does not forbid AI-assisted writing, and it does not exempt human writing. A hundred hand-written pages that add nothing sit in the same paragraph as a hundred generated ones. Our own position on this, with the quality tests we run before publishing, is in AI content and SEO.

Two more catch what other people do to your site

Two of the sixteen describe things other people do to you. Google notes of user-generated spam that "often site owners are unaware of the spammy content", and names it anyway, in a document about things that get sites demoted. Hacked content works the same way: the attacker causes it, the site carries the consequence.

This is the part of the list that converts security and moderation from an IT concern into a ranking concern. An abandoned comment section or an unpatched CMS is not a different department's problem once it is generating pages Google can see.

What black hat SEO is not

Three things get called black hat that are not on Google's list, and confusing them wastes time that should go on the things that are.

Often called black hat	What it actually is
Negative SEO	Something done to your site, not by it, so it is not a policy you can violate. What to do about unwanted inbound links, and when disavowing is the wrong move, is covered in disavowing backlinks.
Optimising for keywords	Ordinary work. Keyword stuffing is the policy, and the policy describes unnatural repetition, not having a target term.
Programmatic pages	Not named. Doorway abuse and scaled content abuse are named, and both turn on whether the pages help anyone. Volume alone is not the test.

White hat SEO, by the same logic, is not a technique list either. It is the same work with the intent test passed: content that would still be worth publishing if rankings were not the reward.

What to do with this

The list is short enough to audit against directly, which is more than can be said for most compliance exercises:

1. Read Google's spam policies yourself, at least once a year. It changes. The site reputation policy was revised for the European Economic Area in August 2026.
2. Watch for spam updates, because they are one of the two routes Google names: automated systems, and human review that can result in a manual action. Google's September 2026 spam update covers what one changes and how to tell whether it reached you.
3. Walk the sixteen rows above against your own activity, including the work you outsource. Agencies and freelancers can put you inside a policy without telling you.
4. Check the three sold-openly policies first, because they are the ones a well-run team is most likely to be inside without having decided to be.
5. Qualify commercial links with rel="sponsored" or rel="nofollow" rather than arguing about whether a given link counts.
6. If something has already gone wrong, the recovery path is a different piece: Google penalties and how to recover covers manual actions and reconsideration requests.

The useful reframe is that Google never published a list of forbidden tricks. It published a test, applied it to sixteen common patterns, and said plainly that it may act on anything else it detects. Techniques go out of date. The test does not.