Black hat SEO is anything that breaks Google’s spam policies. White hat SEO stays inside them. Grey hat SEO (also spelled gray hat) is everything in between: tactics Google hasn’t named, or has named with words like “excessive” and “primarily” that leave room to argue.
The line is not necessarily the tactic itself, but why you’re doing it.
Almost every spam policy Google has is defined by purpose, so the same guest post, AI-written article or expired domain can be fine on one site and spam on another.
The lines also move. Three tactics that were grey for years became named spam in 2024, and since August 30, 2026, one of those rules works differently for people searching from Europe.
White hat vs grey hat vs black hat at a glance
| White hat | Grey hat | Black hat | |
| What it is | SEO inside Google’s rules | Tactics in the vague parts of the rules | Tactics Google’s spam policies name |
| Google’s view | What its best practices recommend | Depends on purpose and scale | Spam |
| Examples | Useful pages, technical fixes, internal links, earned links | Link swaps, guest posts for links, expired domains, AI content in bulk | Paid links that pass ranking credit, cloaking, hidden text, hacked links |
| Risk | Low | Medium, and it tends to grow | High |
| Shelf life | Long | Until Google tightens the rule | Until Google catches it |
Where the lines come from
The lines come from Google Search Essentials, the rulebook Google used to call its Webmaster Guidelines. It has three parts: technical requirements, key best practices and spam policies. The spam policies are the part that matters here. They list 16 things Google treats as spam, and that list is what SEOs mean by black hat.
The hat labels themselves are SEO slang. Google’s documents stick to the word spam.
What stood out to me reading the policies is how often they use the word “primarily.”
Link spam is creating links “primarily for the purpose of manipulating search rankings.” Expired domain abuse is buying an old domain and repurposing it “primarily to manipulate search rankings.”
Scaled content abuse covers pages made mainly to manipulate rankings, “no matter how it’s created.”
So Google doesn’t ban guest posts, AI writing, buying old domains or swapping links. It bans doing them mainly to push rankings, especially at scale.
Google’s AI content guidance says the same thing about AI: appropriate use of AI or automation isn’t against its guidelines, and using it mainly to manipulate rankings is.
Purpose is hard to prove, so Google’s old quality guidelines gave site owners two tests.
The first: “Does this help my users? Would I do this if search engines didn’t exist?” The second was a rule of thumb: would you feel comfortable explaining what you’ve done to a competitor?
I’d run every tactic through both. A link from a supplier’s “where to buy” page passes easily. A link you paid a blogger for, with your keyword as the anchor text, fails both.
What black hat SEO looks like
Black hat SEO is any tactic on Google’s spam policy list. Here are all 16, in plain English:
| Spam policy | What it looks like |
| Cloaking | Showing Google one version of a page and visitors another |
| Doorway abuse | Lots of near-identical pages built to rank for similar searches, all funneling to one place |
| Expired domain abuse | Buying an old domain for its links and filling it with low-value content |
| Hacked content | Spam pages or links planted on a site through a security hole |
| Hidden text and links | Text or links visitors can’t see, like white text on a white background |
| Keyword stuffing | Cramming keywords into a page until it reads badly |
| Link spam | Buying, selling or trading links to push rankings, private blog networks (PBNs), automated link building |
| Machine-generated traffic | Bots sending automated searches to Google, like rank-checking scrapers |
| Malicious practices | Pages or downloads that do something users didn’t expect, like installing unwanted software |
| Misleading functionality | Pages that promise a tool or service and don’t deliver it, like a fake file converter |
| Scaled content abuse | Mass-producing pages to rank, whether with AI, scraping or cheap writers |
| Scraping | Copying other sites’ content and republishing it |
| Site reputation (parasite SEO) | Third-party content published on a strong site to borrow its rankings |
| Sneaky redirects | Sending visitors somewhere other than the page Google indexed |
| Thin affiliation | Affiliate pages that copy the merchant’s descriptions and add nothing |
| User-generated spam | Spam dropped into comments, forums or profiles on someone else’s site |
The same rules now cover AI answers. Since May 15, 2026, Google’s spam policies say spam includes “attempting to manipulate generative AI responses in Google Search,” so buying or faking citations to show up in AI Overviews or AI Mode is black hat too.
Black hat SEO tools are mostly automation for the tactics in that table: software that blasts links onto thousands of sites, article spinners that reword other people’s content, and scrapers. Most black hat link building runs on them, and if a tool’s main selling point is volume, it’s usually a black hat tool.
Black hat SEO examples from real sites
Getting caught isn’t a small-site problem. Some of the best-known penalties hit big brands, including Google itself.
- BMW Germany, 2006. bmw.de used doorway pages with JavaScript redirects, and Google removed the whole site from its index. BMW took the pages down, and Matt Cutts, then head of Google’s webspam team, confirmed it was back a few days later.
- Google Chrome, 2012. A sponsored post campaign for Chrome included a paid link to google.com/chrome. Google demoted its own page for at least 60 days, and it fell from #2 to around #50 for “browser.” Google said it should be held to a higher standard than a typical site.
- Rap Genius, 2013. The lyrics site offered bloggers promotion in exchange for links to its lyrics pages, including links to Justin Bieber songs dropped into unrelated posts. Google buried it for about 10 days, and its traffic reportedly fell from around 700,000 to 100,000 daily visitors. The founders’ own verdict: “We overstepped, and we deserved to get smacked.”
- Causal, 2023. A marketer used AI to publish about 1,800 articles built from a competitor’s site and called it an “SEO heist.” He claimed 3.6 million visits from it, then its traffic fell from about 610,000 in early October to 190,000 by mid-December, below where it started.
- News sites’ coupon pages, 2024. When Google started enforcing its site reputation policy in May 2024, the coupon sections on CNN, USA Today, the LA Times and Fortune dropped out of results. They were third-party content borrowing the news sites’ rankings, which is exactly what the policy targets.
Size didn’t protect any of them.
What white hat SEO looks like
White hat SEO is just SEO done inside Google’s rules. There’s no special white hat technique. It’s what Google’s key best practices describe, so creating helpful pages, having a site Google can crawl easily, and building links people chose to give you.
In practice, that means:
- Researching the types of keywords people search and building the page that best answers each one
- Fixing technical problems like crawling, indexing, speed, broken pages and redirects
- Clear titles, headings and internal links, so Google and people can find their way around
- Structured data that matches what’s actually on the page
- Earning links with things worth linking to, like original data, useful tools, PR, partners and outreach
- Keeping the site secure and updated, so nobody can plant spam on it
White hat doesn’t mean waiting around for links to happen though. Emailing a journalist, pitching a guest post to a site your customers read, or asking a partner to link to you are all fine, because someone chooses to link when it helps their page. I went through the methods that work in my guide on how to get backlinks.
Plenty of agencies sell “white hat SEO services,” and the label means nothing on its own. A white hat agency can show you exactly what it did, like which pages it changed, which links it earned and where they came from.
White hat is slower. That’s the honest trade, and it’s the only reason the other two hats exist.
What grey hat SEO looks like
Grey hat SEO lives in three places:
- Rules with fuzzy words. Google bans “excessive” link exchanges without saying how many is too many, and scaled content abuse is about “large amounts” of low-value pages without a number attached.
- Tactics Google hasn’t named at all.
- Tactics Google has named, but plenty of sites use anyway and haven’t been caught.
Most grey hat tactics are normal things done for a ranking reason. That’s why the same tactic shows up on both sides of the line:
| Tactic | Usually fine when | Crosses into black hat when |
| Guest posting | You write for a site your customers read, and the link makes sense where it sits | The links use optimized anchor text, or you pay for posts with links that pass ranking credit |
| Link exchanges | Two related businesses link to each other because it helps their visitors | It’s “excessive,” or you keep partner pages that exist only for cross-linking |
| Paid placements | Sponsored posts and ads are marked rel=”sponsored” or rel=”nofollow” | The paid link passes ranking credit |
| AI-written content | It’s edited, accurate and adds something a searcher needs | You publish pages in bulk mainly to rank |
| Buying expired domains | You build a real site on a domain that fits what you do | You buy it for its old links and fill it with low-value pages |
| Publishing on other sites | You contribute to a site that’s closely involved in what it publishes | Your pages ride a strong site’s rankings (site reputation) |
| Location pages | Each page has real information about a real location | Near-identical pages that only swap the city name (doorway abuse) |
| Redirecting sites you bought | You merge a real business and its content into yours | You buy domains just to 301 their links into your site |
That last row isn’t named anywhere in the spam policies. It’s the purest grey there is because nothing written says no, but nobody would do it if search engines didn’t exist.
Grey hat keeps turning into black hat
In March 2024, Google added three spam policies at once:
- scaled content abuse
- site reputation abuse
- expired domain abuse.
All three described tactics that had sat in the grey zone for years. After the rollout, Google said people were seeing 45% less low-quality, unoriginal content in results.
It kept tightening from there:
- In November 2024, Google updated its site reputation policy so that a host site’s involvement or oversight no longer makes third-party content okay.
- On May 15, 2026, the spam policies were updated to cover AI Overviews and AI Mode.
- On August 30, 2026, after the European Commission required changes, Google stopped applying site reputation manual actions for people searching from the European Economic Area. Everywhere else, they still apply.
So a page with a site reputation manual action can vanish for searchers in the US and still show up for searchers in Germany. Whether that stays a European exception or starts wearing the policy down elsewhere, nobody knows yet.
I personally read all of this as a pattern. Once a grey tactic gets popular enough to fill search results, Google tends to name it.
How I’d decide on a grey hat tactic
Grey hat is a risk call. Google’s policies aren’t laws, and plenty of sites use grey tactics and rank fine. I’d ask three questions:
- Does it pass the two old tests? If it only exists because Google exists, treat it as borrowed time.
- Whose site carries the risk? A side project you’d happily burn is your call. A client’s site, or the site your income depends on, needs a clear yes from the person who’d lose it.
- What happens when it stops working? A tactic you can switch off cleanly is a much safer bet than one that leaves hundreds of links you can’t remove.
What happens if you get caught
Google finds spam two ways. The first one is automated systems, and the second one is human review when needed. The automated side, mainly a system called SpamBrain, has gotten a lot better. In its 2022 webspam report, Google said SpamBrain found five times more spam sites than in 2021, 200 times more than when it launched in 2018, and 50 times more link spam after its December 2022 update.
Those are Google’s own numbers, so take the exact multiples loosely. The direction is hard to argue with because tactics that slipped through ten years ago are far more likely to get caught now, and anyone with daily experience of doing SEO can confirm.
What getting caught looks like depends on which way you’re caught:
- If it’s algorithmic, then no message, no warning. Your rankings drop, often around a spam update, or your spammy links stop counting.
- If it’s a manual action, that means a person at Google has reviewed your site. It shows up in Search Console under Security & Manual Actions.
Recovery works differently for each. For a manual action, you fix everything and send a reconsideration request from that same report, and Google says most reviews take several days or weeks, with link-related ones taking longer. However, and this is just a personal experience, a recovery from a manual action is near damn impossible. Once Google has you in their sights, you can likely say goodbye to that domain.
For algorithmic problems, there’s no request to send. A site can improve once Google’s systems learn “over a period of months” that it complies.
Links are the exception though. Once Google neutralizes spammy links, the ranking benefit they gave you “cannot be regained,” even after you clean up.
Is black hat SEO illegal?
Mostly, no. Google’s spam policies are one company’s rules for its own search engine, so breaking them costs you rankings and that’s usually the end of it.
Some black hat tactics do break real laws:
- Hacking other sites to plant links or pages is unauthorized computer access, which is a crime in most countries.
- Fake reviews are illegal in more places than people think. In the US, the FTC’s final rule on fake reviews from August 2024 bans fake reviews and testimonials, including AI-generated ones, and lets the FTC seek civil penalties.
- Scraping and republishing someone’s content can be copyright infringement, and the owner can file a DMCA takedown to get your copy removed from Google.
- Spreading malware or running phishing pages is a crime almost everywhere.
Does black hat SEO still work?
Sometimes, for a while, at least.
Black hat works best for people who expect their sites to die. It’s called churn and burn and it usually involves spinning up a domain, spamming it to the top, making what you can for a few weeks or months, and starting over when it gets caught. The math can work when the site is disposable, but it falls apart for a business whose name is on the domain.
What nobody can tell you is how long a given tactic will last. Nobody outside Google knows exactly what SpamBrain catches, and the people getting away with it don’t generally publish their numbers.
How to report black hat SEO to Google
Google has a spam report form for this. You give it the URL and describe what the page is doing wrong.
However, don’t expect a reply. Google says spam reports help it improve its spam detection systems, and that it may use a report to take manual action. If your report does lead to a manual action, Google sends the text of your report to the site owner, so leave your name and anything that identifies you out of it.
A few other routes, depending on the problem:
- Malware and phishing – Google has separate report forms for both, on the same help page.
- Your content copied onto another site – file a DMCA takedown request with Google.
- Fake or spammy Google Business Profile listings – use “Suggest an edit” on the listing in Google Maps.
If a competitor points spammy links at your site, that’s called negative SEO, and you generally don’t need to do anything because Google mostly ignores these patterns of backlinks.
How to check your own site for a black hat past
This matters most if you bought a site, took one over from an agency, or have no idea what the last SEO did. Five checks:
- Manual actions. Open Search Console, go to Security & Manual Actions, then Manual actions. You want to see “No issues detected.”
- Security issues. It’s in the same menu. Hacked content counts as spam on your site even though someone else put it there. On WordPress, keeping plugins and themes updated is the easiest way to stay off that report.
- A site: search. Google site:yourdomain.com and scroll through the results. Pages you never made, like pharma ads, casino pages or text in a language you don’t use, mean the site has been hacked.
- Your backlinks. In Ahrefs, Semrush or Search Console’s Links report, look for sudden spikes, lots of links with the same keyword-rich anchor text, and links from unrelated sites that seem to exist only to link out.
- The agency’s list. If someone built links for you, ask for every link and every page they placed. A good agency has that list ready. One that won’t share it is telling you something.
For anything else you’re unsure about, Google’s old rule of thumb still works best. If you wouldn’t be comfortable explaining it to a competitor, you already know which hat it is.