Before You Call It a Google Penalty Check These Three Screens

A manual action is not Google being mysteriously displeased with your website. It is a specific finding, issued after human review, and reported inside Google Search Console. An algorithmic decline has no equivalent notice and no reconsideration button. That distinction sounds basic. It is also where expensive recovery projects go wrong.

My rule is simple: do not buy a cure until somebody has proved which class of problem you have. Open the Manual Actions report, the Security Issues report and Search Console messages before an agency starts rewriting the site, disavowing links or selling you a six-month “penalty recovery” programme.

The word “penalty” can sabotage the investigation

“Penalty” is often used as an emotional description rather than a diagnosis. Traffic fell. The graph looks violent. Somebody remembers an algorithm update. The board wants a cause before Friday. Calling it a penalty makes the uncertainty feel contained. It does something more dangerous too: it quietly chooses the treatment.

Once the decline has been labelled a penalty, every ugly backlink becomes evidence. Every page becomes a candidate for rewriting. Every Google update becomes a suspect. The team can spend weeks repairing an imagined offence while a noindex directive, broken canonical, deleted navigation link, tracking change or collapse in market demand remains untouched.

Google says manual actions appear in Search Console when a human reviewer determines that pages or a site fail to comply with its spam policies. Affected owners can see the issue and, after fixing it, request reconsideration (Google’s Manual Actions report). Google’s guidance on traffic drops separately lists technical problems, security issues, site moves, algorithmic changes and seasonality among the possible causes of declining Search traffic (Google’s traffic-drop guidance). One label cannot responsibly cover all those mechanisms.

Start with three screens, not a theory

The first diagnostic pass should take minutes. It should separate three lanes before anybody proposes a major intervention.

The third lane matters most. A clear report does not prove the website is healthy. It proves that one dramatic explanation has not been confirmed. That is useful progress. Diagnosis improves when we remove unsupported stories, not only when we discover a definitive cause.

Google’s Security Issues report covers findings such as hacked content, malware, harmful downloads and social engineering (Google’s Security Issues report). A security incident may damage search performance, but its first remedy is security response: contain access, identify the compromise, remove harmful material, close the entry point and request a review when appropriate. Calling that a content-quality problem sends the wrong people towards the wrong work.

Describe the loss before explaining it

I would not accept “organic traffic dropped” as a sufficient incident description. It combines too many possible observations. Write down what changed in terms another person could reproduce:

• the first date on which the change becomes visible;
• whether impressions, clicks, average position, sessions or recorded conversions moved first;
• which countries, devices and search appearances were affected;
• which queries, directories, templates and page types lost visibility;
• whether brand and non-brand demand behaved differently;
• whether other acquisition channels moved at the same time;
• which deployments, migrations, analytics changes or campaigns occurred near the boundary.

“Google penalised us” is a mood wearing a lab coat. “Non-brand impressions to service pages fell after the 14 August template release while article impressions remained stable” is an investigation. The second statement gives us a boundary, an affected cohort, a control group and a nearby event. It does not prove causation. It does tell us where to look first.

Build an incident map with controls

The most useful artefact in an unexplained decline is not a 70-page audit. It is a one-page incident map that forces the evidence into comparable rows.

Use daily data to locate a sudden boundary, then widen the comparison enough to see weekly and seasonal variation. Compare affected directories with stable ones. Compare changed templates with unchanged templates. If every channel appears to collapse on the same analytics date, inspect measurement. If only URLs using one template disappear, inspect that template before commissioning a sitewide backlink audit.

My standard is not “can we tell a plausible story?” SEO can generate plausible stories all day. The standard is “what observation would make this story less likely?” A hypothesis that cannot lose is not a diagnosis. It is branding for uncertainty.

A manual action gives you a remediation contract

When a manual action exists, the notice changes the job. Read the exact issue, affected scope and any example URLs. Examples are samples, not necessarily an exhaustive list of every affected page. I would use this sequence:

1. Preserve the original notice and its stated scope.
2. Read the current policy governing the named issue.
3. Identify how the violating pattern entered the website.
4. Map the complete set of affected pages, links or behaviours.
5. Remove or correct the problem across that complete set.
6. Confirm Google can access the repaired version.
7. Record what changed and how it was checked.
8. Submit one clear reconsideration request.

The request should explain the issue, the actions taken and the resulting state. It is not a courtroom speech. Blaming a previous agency does not remove a link scheme. Promising never to do it again does not prove doorway pages are gone. The useful question is: could a reviewer follow the evidence from the named violation to the completed repair?

Even a successful reconsideration does not guarantee that old rankings return. Revocation resolves the manual-action status. The repaired pages still have to compete under current ranking systems, against current results, for current demand. Keep that qualification attached to every recovery promise.

An algorithmic decline needs ranked hypotheses

Without a manual action, there is no reconsideration request to submit. The site has to be crawled, processed and reassessed through normal systems after useful changes are made. That makes restraint commercially valuable. If a team rewrites every service page, changes URLs, modifies navigation and disavows links simultaneously, it may create movement without learning anything. A recovery that cannot explain its own mechanism is difficult to repeat and easy to reverse accidentally. Build a hypothesis queue instead:

• Eligibility noindex directives, robots controls, server responses, rendering or crawl access.
• Canonicalisation canonical tags, redirects, duplicate handling and URL consolidation.
• Discovery navigation changes, orphaning, internal-link loss or sitemap discrepancies.
• Content removed information, weak differentiation, stale evidence or poorer satisfaction of the query.
• Intent a changed result set, audience need or query meaning.
• Demand seasonality, market contraction or altered brand interest.
• Competition stronger alternatives or a different mix of result types.
• Spam risk deliberately manipulative content, links or reputation practices.
• Measurement analytics, consent, attribution or conversion-recording defects.

Score each hypothesis by evidence, affected commercial value, reversibility and cost to test. Start with the plausible, high-impact explanation that can be checked safely. This is not timid SEO. It is how you preserve information while acting.

A toxic-link score is not a diagnosis

Backlink tools can be useful for discovering patterns. Their proprietary toxicity scores do not establish that Google has applied a manual action, and an alarming percentage does not prove why traffic declined. The open web produces scraper links, copied pages, abandoned domains and irrelevant mentions without the website owner arranging them. Investigate links more aggressively when Search Console names unnatural links, the business knows manipulative links were created, an old supplier used networks, or campaign records connect an artificial pattern to the affected area.

Google’s spam policies describe link spam as links created primarily to manipulate rankings and include paid ranking links, automated link creation, excessive exchanges and low-quality placements among the examples (Google’s spam policies). The mechanism and provenance matter. The dashboard colour does not. I would not recommend disavowal as a ritual response to volatility. It is a consequential intervention that needs a demonstrated problem, a defined set of links and a reason the action is preferable to doing nothing.

Separate what is confirmed from what merely fits

A clean investigation keeps three evidence states visible:

For every proposed fix, record the hypothesis, affected cohort, owner, release date, expected observation, review point and rollback route. This prevents the diagnosis changing every time somebody reads another algorithm-update post. It also gives leadership an honest answer. “We have reduced the field to two testable causes” is more useful than false certainty wrapped in a confident slide deck.

The five-line test before you buy recovery work

Before anybody touches the site, require five written answers:

If a manual action exists, repair the complete named violation and document it. If a security issue exists, treat it as a security incident. If neither exists, stop pretending the word “penalty” has completed the diagnosis. Panic wants one villain and one dramatic cure. I want a smaller claim, a test that can prove us wrong and a change we can defend. That is less theatrical. It is also how a business gets its website back without damaging it twice.