White Hat SEO: What Google Allows and What It Penalizes

White hat SEO means improving your rankings only with methods that follow the search engines' rules. For Google, those rules are the Google Search Essentials, called the Webmaster Guidelines until 2022, and its spam policies draw the line between allowed and forbidden. Black hat SEO is the opposite: unlabeled paid links, hidden text, pages mass-produced to rank. Below: all 16 spam policies in one table, ten everyday cases, what happens after a violation, why Europe and the US now differ, and how we follow the rules on our own site.

Where "white hat" and "black hat" come from

The hats come from computer security. The Jargon File, a well-known dictionary of hacker slang, calls a black hat an intruder trying to get into the systems you defend and a white hat a security expert on your side; a gray hat has an attacker's skills but stays within the law. All three terms, it says, go back to the dress code of old Westerns, where villains wore black hats and heroes wore white.

Google used the term itself in April 2012, in a post announcing a ranking update against webspam: it called ethical search engine optimization "white hat SEO" and its opposite "black hat webspam". None of the current Google documentation pages we read uses hat colors anymore. The spam policies only ask whether a practice violates a policy.

White hat, gray hat and black hat compared

• White hat: content that answers a question better than the alternatives, a technically clean site, links others give you freely, and paid links labeled as paid.
• Black hat: methods Google explicitly forbids, such as cloaking, hidden text, unlabeled paid links, mass-produced pages or links planted on hacked sites.
• Gray hat: what SEO practitioners call methods that aren't forbidden as such but easily become a violation: link swaps, guest posts with links, or buying an expired domain that still has many backlinks.

In that gray zone, Google looks at purpose and scale rather than the method. Its link spam list names "excessive" link exchanges, not two companies that link to each other because they really work together. In a 2017 post, Google said it doesn't discourage guest articles that inform readers; they become a violation when the main intent is building links at scale. And buying an expired domain is fine; repurposing it mainly to rank content of little value is abuse.

Unlabeled paid links and article spinning (rewriting someone else's text with synonyms) are not gray hat, whatever some guides say. Under Google's policies, the first is link spam and the second is scraping.

The rulebook: Google Search Essentials

Google's Search Essentials have three parts:

1. Technical requirements: the bare minimum a page needs to appear in Search. Google says most sites pass without even realizing it.
2. Spam policies: behaviors and tactics that can get a page or a whole site ranked lower or removed.
3. Key best practices: helpful, reliable content made for people; the words people search with in prominent places such as the title and main heading; crawlable links; and telling people about your site.

Appearing in Google's results costs nothing, "no matter what anyone tries to tell you," and even a page that meets every requirement isn't guaranteed to be indexed or shown. If these terms are new to you, start with what SEO is; where the search words belong is covered in our guide to keyword placement. White hat SEO means following those best practices. The spam policies only mark the boundary.

What Google forbids: the 16 spam policies

Google defines spam as techniques that deceive users or manipulate its Search systems into featuring content prominently, now explicitly including attempts to manipulate generative AI responses in Google Search. Violations are found by automated systems, one of which Google names as SpamBrain, and, where needed, by human reviewers. Sites that break the policies may rank lower or disappear from results, and Google may act against any spam practice it detects, listed or not.

New this year: since June 15, 2026, back button hijacking is an explicit violation. A site may not stop visitors from using the back button to return to the page they came from. Google notes that this can come from included libraries or an ad platform, so check the third-party scripts you embed.

Two policies are easy to break without bad intent. Doorways: a plumber who builds forty pages, "Plumber in Austin", "Plumber in Dallas" and so on, with the same text and a swapped city name, fits Google's description of pages targeted at cities that funnel users to one place; one page per real location with its own address and staff is a different matter, as our local SEO guide shows. Scaled content: it covers pages made mainly to rank however they were created, including through automated translation. Machine-translating every page into ten languages and publishing it unchecked is exactly this territory; our guide to website translation and SEO covers the alternative.

Allowed or not? 10 everyday cases

1. You pay a blog for an article that links to your shop. Without a label, it's link spam. With rel="sponsored", it's fine for Google, and US readers must also be told about the payment.
2. You send a blogger a free product so she reviews it and links to you. For Google, that's a paid link too.
3. You write a guest post for an industry magazine. Fine if it informs readers. Link with your name or company name rather than keywords.
4. Your FAQ sits in an accordion. Fine; Google names accordions and tabs as allowed.
5. Thirty city names sit in white text on a white background. Two violations at once: hidden text and keyword stuffing.
6. Your articles are behind a paywall. Not cloaking, as long as Google can see the full content like any subscriber.
7. You move to a new domain and redirect every old URL. Fine; Google names moving a site as a legitimate reason to redirect. Our site migration checklist shows how.
8. Mobile visitors land on another domain, desktop visitors don't. A sneaky redirect. Google notes that these can come from an ad script or from code added by hackers.
9. AI drafts your texts, and you check and expand them. Not a violation: Google says appropriate use of AI or automation is not against its guidelines. Hundreds of unchecked AI pages made mainly to rank are.
10. A tool checks your Google rankings automatically every day. Google counts scraping its results for rank checks as machine-generated traffic, which violates its spam policies and Terms of Service. Search Console shows how your own site ranks.

Paid and affiliate links: one label for Google, one for readers

Google reads three rel values. Use rel="sponsored" for ads and paid placements (nofollow is still accepted there, but sponsored is preferred), rel="ugc" for links in comments and forum posts, and rel="nofollow" when you don't want Google to associate your site with the linked page. Values can be combined, as in rel="ugc nofollow". Ordinary editorial links need none.

Only search engines read that attribute. For readers in the US, the Federal Trade Commission's Endorsement Guides apply. In its FAQ, updated in June 2023, the FTC says an affiliate marketer should disclose the relationship to the retailer clearly and conspicuously; "affiliate link" alone may not be understood, while "Paid link" right next to the link should be enough. So a paid link on a US site typically needs two labels: rel="sponsored" for Google and a visible disclosure for people. Other countries have their own rules, and this is not legal advice.

AI content: allowed, but not at scale

In February 2023, Google said that appropriate use of AI or automation is not against its guidelines; automation has long produced useful content such as sports scores, weather forecasts and transcripts. Using it mainly to manipulate rankings violates the spam policies.

Google suggests checking content with three questions:

• Who made it? Readers should see who wrote a page, ideally through a byline that leads to information about the author. Google calls fabricated creator profiles, such as AI-generated headshots, made-up names or false credentials, a form of deception.
• How was it made? In product reviews, saying how many products were tested and how, with evidence such as photos, builds trust.
• Why does it exist? Perhaps the most important question, according to Google. Content should mainly help people, not mainly attract search visits.

The same guidance dismisses two myths: Google has no preferred word count, and changing a page's date to make it look fresh without substantial changes is a warning sign.

What happens when you break the rules

According to Search Console Help, Google's algorithms detect most spam automatically and remove it from results. After a spam update, Google says to review your site against the policies; if its systems learn over a period of months that the site complies, rankings can improve. Link spam is the exception: any ranking benefit from spammy links is lost for good once Google neutralizes them.

On top of that come manual actions: a human reviewer at Google has found that pages violate the spam policies, and you get a notice in the Manual actions report and the Search Console message center. Listed types include unnatural links, thin content with little or no added value, user-generated spam, cloaking and/or sneaky redirects, hidden text and/or keyword stuffing, major spam problems and back button hijacking. An action can affect part of a site or all of it.

To lift one, fix the issue on every affected page (fixing only some won't earn a partial return), make sure Google can reach those pages without a login, paywall, robots.txt block or noindex, then select Request Review and explain the issue, your fixes and the outcome. Most reviews take several days or weeks; link-related ones can take longer. If you recently bought the site and the violations predate you, say so.

And the disavow links tool? Google says most sites don't need it. It only makes sense if a considerable number of spammy or artificial links point to your site and have caused, or likely will cause, a manual action, and only after you've tried to get them removed. The English help page also calls it an advanced feature that can harm your site if used incorrectly.

Site reputation abuse: why Europe and the US now differ

The site reputation policy, often called "parasite SEO" in the industry, targets third-party content published on an established site mainly to borrow its ranking signals. Google's examples: sponsored payday-loan reviews on an educational site, or a low-quality "best casinos" page on a medical site. Advertorials aimed at the publication's own readers and properly treated affiliate links are not affected.

Since August 30, 2026, the effect of a manual action under this policy depends on where the searcher is. Google announced the change on August 28 after discussions with the European Commission, which had opened proceedings under the Digital Markets Act (DMA) about this very policy on November 13, 2025:

• Outside the European Economic Area (EEA), the manual action directly affects results for the affected part of the site.
• Inside the EEA, it has no effect. The section may be separated from the rest of the site and, over time, rank on its own. Google lifted earlier actions under this policy for EEA results and offers EEA sites a new reconsideration process, with mediation for eligible sites.

The EEA consists of the EU member states plus Iceland, Liechtenstein and Norway; the US, Canada, the UK and Switzerland are not part of it. So searchers in Chicago or London can see different results for the same page than searchers in Dublin or Berlin. The policy itself hasn't changed: parasite SEO isn't white hat anywhere, and Search Console still sends the notice.

How we apply white hat SEO on our own site

We built the main rules into our site's code:

• Affiliate links can only go through our /go/ route and carry rel="sponsored". The route sends "noindex, nofollow", and robots.txt blocks /go/. That matches a fix Google lists for unnatural outgoing links: redirecting them through a page blocked by robots.txt.
• Results such as times, prices and error rates come only from our own measurements; our publishing system warns when a number with a unit is typed in by hand.
• No draft goes live automatically. On approval, the server checks that sources are listed and no placeholders remain.
• No redirect by browser language. Google advises against such redirects, partly because Googlebot usually crawls from the US without an Accept-Language header.
• No page without text in its own language. A missing language version returns 404, and hreflang only lists live versions, as our hreflang guide explains.

On October 17, 2026, we checked the live site against these rules. We requested every address in our four sitemaps, 159 pages in all, and counted every link:

The 535 links from our English pages to other sites carry no rel value, and that's correct: they are sources nobody pays for, most often Google's help and developer pages. There are no affiliate links yet because no affiliate program is active. Once one is, the rule in the code applies.

Why black hat shortcuts don't pay off

• The gains disappear: whatever bought links did for your rankings is gone once Google neutralizes them.
• Workarounds make it worse: carrying on through new subdomains or sites counts as policy circumvention, and Google may then restrict features such as Top Stories or Discover or remove more of the site.
• Criminal law: hacking someone else's site to plant links isn't just spam. In the US, the Computer Fraud and Abuse Act (18 U.S.C. 1030) covers intentionally accessing a computer without authorization. This is not legal advice.
• False promises: Google warns that no one can guarantee a #1 ranking and that you should be wary of SEOs claiming a "special relationship" with Google. You are responsible for what the companies you hire do.

Checklist: is your SEO white hat?

1. Paid, sponsored and affiliate links carry rel="sponsored" and are visibly disclosed to readers.
2. Links in comments and forums carry rel="ugc" or are moderated.
3. No pages differ only by a city name, and no text is meant to stay invisible.
4. Automatically generated or translated pages go live only after review and with real added value.
5. Third-party scripts, ads included, leave the back button alone.
6. Author details are real, and dates change only when the content changes substantially.
7. You check the Manual actions and Security Issues reports in Search Console regularly.
8. Your SEO provider promises no rankings and no "special relationship" with Google.