When you start learning SEO, you soon hear two strange labels: white-hat SEO and black-hat SEO. Someone in a forum promises "page one in 30 days" with a secret trick, and someone else warns that the same trick will get your site banned. Who is right? And who decides what is allowed in the first place?
Let me explain it in plain words. Google publishes its own rules for websites, and almost everything about "white hat" and "black hat" comes down to whether you follow those rules or try to trick the system. By the end of this lesson, you will know what Google's rules are, what spam looks like, what a manual action is, and how to check whether your own site is in trouble.
What do white-hat and black-hat SEO mean?
The names come from old Western movies, where the hero wore a white hat and the villain wore a black one. In SEO, the labels describe how you try to rank, not whether you try.
- White-hat SEO means improving your site for real people and following Google's published rules. You make pages that are useful, easy to find and easy to use, and you earn attention honestly.
- Black-hat SEO means trying to trick search engines into ranking a page higher than it deserves. Hidden text, bought links and pages full of repeated keywords are classic examples.
- Grey-hat SEO is an informal name people use for tactics that sit close to the line. In practice, I suggest you treat "grey" as "risky" and ask one question: am I doing this for my visitors, or only to fool Google?
Here is a simple analogy. Think of a busy market. A white-hat shopkeeper wins customers with fresh stock, fair prices and a clean stall. A black-hat shopkeeper pays people to stand in front of the stall and pretend to be customers. It may work for a day, but once the market inspector notices, the stall gets moved to the back corner, or shut down.
If you are brand new, it helps to first read what SEO is and its three pillars. Everything in this lesson builds on that idea: SEO is about helping search engines find, understand and trust good pages.
What are Google's rules, and where are they written?
Google's rules for websites are called Google Search Essentials. They were previously known as the Webmaster Guidelines, so you may still see that older name in blog posts. Search Essentials has three parts:
- Technical requirements – the minimum Google needs before it can show a page at all.
- Spam policies – the behaviors that can make a page or a whole site rank lower or disappear from results.
- Key best practices – the things that have the most impact on how your site ranks and looks in search.
The technical requirements
These are short, and most sites meet them without trying. Google lists three:
- Googlebot (Google's crawler, the program that visits pages) is not blocked, so it can find and access the page.
- The page works. It returns a successful status code, not an error page.
- The page has indexable content, in a file type Google supports, and that content does not break the spam policies.
Meeting these makes a page eligible to be indexed. It does not guarantee it will be. You will learn how crawling and indexing work in how search engines work, and later in the lesson on getting your pages indexed.
The key best practices
In brief, Google asks you to create helpful, reliable, people-first content; use the words people would search for in prominent places such as the title, main heading, alt text and link text; make your links crawlable; tell people about your site in communities where it would interest them; follow the specific guidance for images, video, structured data and JavaScript; turn on the search features that fit your site; and use the right methods when you want to keep something out of Google.
That list is basically the white-hat playbook, written by Google itself. Most of this course is a deeper look at each of those points.
What counts as spam? Black-hat tactics with examples
Google's spam policies name the specific tactics it treats as spam. Here are the main ones, explained in simple words with small invented examples.
| Spam policy | What it means | Example (invented) |
|---|---|---|
| Cloaking | Showing search engines different content from what visitors see | Googlebot sees an article about travel insurance; visitors see a casino page |
| Doorway abuse | Many near-identical pages made only to catch searches and push people elsewhere | "Plumber in Town A", "Plumber in Town B" and 200 more pages with only the town name changed |
| Expired domain abuse | Buying an old domain to ride on its past reputation with low-value content | A former charity's domain now hosting thin product reviews |
| Hidden text and link abuse | Text or links hidden from people but visible to search engines | White keywords on a white background |
| Keyword stuffing | Filling a page with keywords or numbers to manipulate rankings | "Cheap shoes. Buy cheap shoes. Cheap shoes online cheap." |
| Link spam | Creating or buying links mainly to manipulate rankings | Paying for 500 links from unrelated blogs |
| Scaled content abuse | Mass-producing many low-value pages to manipulate rankings, whether made by AI, scraping or stitching | Publishing 10,000 auto-written pages nobody checked |
| Scraping | Republishing other sites' content without adding value | Copying news articles and swapping a few words |
| Site reputation abuse | Hosting third-party content mainly to borrow a strong site's ranking signals | A news site renting a folder to an unrelated coupon seller |
| Sneaky redirects | Sending people somewhere other than what they expected, to deceive | Search result shows a recipe; the click lands on a pills shop |
| Thin affiliation | Affiliate pages with copied product text and nothing added | A "review" site that only pastes the seller's descriptions |
| User-generated spam | Spam left by users in comments, forums or profiles | Hundreds of spam links in your blog comments |
The full list also includes hacked content, machine-generated traffic (for example, automated scraping of Google's results), malicious practices such as malware and back button hijacking, and misleading functionality, where a site promises a tool or service it doesn't deliver. Google also says it may act against other types of spam that are not on the list.
Notice one thing. Some items, like hacked content or user-generated spam, can happen to an honest site without the owner doing anything wrong. That is why white-hat SEO also includes keeping your site secure and moderating comments.
If you want to go deeper, our blog has a full guide to Google's spam policies explained and a comparison of the difference between white-hat and black-hat SEO companies.
How does Google catch black-hat SEO?
Google says it detects policy violations in two ways: with automated systems, and, when needed, with human review. The result is one of two very different situations.
Algorithmic demotion
Most of the time, Google's automated systems simply stop rewarding the trick. Spam links may be ignored, or a spammy page may rank lower. You get no message about it. You just see traffic fall, often around a spam update. You will learn how to read those updates in the lesson on Google algorithm updates.
Manual actions
A manual action is what most people call a "Google penalty." It happens when a human reviewer at Google looks at a site and confirms that pages break the spam policies. When that happens, some or all of the site may not be shown in Google results.
The good news is that a manual action is not a secret. Google tells you about it in the Manual actions report in Google Search Console and in the Search Console message center. The report lists the type of problem and the URL patterns affected. A manual action can cover a few pages or the whole site.
Some of the manual action types you may see are: unnatural links to or from your site, thin content with little or no added value, user-generated spam, cloaking and/or sneaky redirects, hidden text and/or keyword stuffing, structured data issues, and major spam problems.
How do you fix a manual action?
If you ever find one, don't panic. Here is how I would do it, step by step:
- Open the Manual actions report in Search Console and read the exact issue and the example URLs.
- Fix the problem on every affected page, not just a few. Google is clear that partial fixes will not bring back visibility.
- Make sure Google can reach the fixed pages. They should not sit behind a login or paywall, or be blocked by robots.txt or a noindex tag. You can check a page with the URL Inspection tool.
- Write a clear reconsideration request. Explain the exact problem, what you did to fix it and the result. Be honest and specific.
- Click "Request review" and wait. Google says reviews usually take several days or weeks, and link-related requests can take longer. Don't send another request while one is pending.
Our blog covers this process in more depth in how to find and fix Google manual actions, and explains the difference between a manual action and an algorithmic demotion. For link problems specifically, the later lesson on toxic links and the disavow tool walks you through the cleanup.
Why black-hat shortcuts are a bad deal for a business
Black-hat tactics are tempting because they promise speed. But let me put it from a business owner's point of view.
- The gains are short. Google keeps improving its systems, so a trick that works today often stops working after the next update.
- The losses can be big. Google says sites that violate its policies may rank lower or not appear in results at all. If your leads come from search, that is real money.
- Cleanup costs time. Removing bought links or rewriting thousands of thin pages takes far longer than doing it properly at the start.
- Your brand is on the line. Visitors who land on spammy pages don't come back, and they don't recommend you.
Google itself warns business owners about this when hiring help. In its guide on whether you need an SEO, Google says that no one can guarantee a #1 ranking, and that if someone guarantees first place, you should find someone else. It also suggests asking any SEO whether they follow Google Search Essentials. That is a great question to ask. You will find more questions in the lesson on hiring an SEO.
Try it: check your own site against Google's rules
Here is a short, practical check you can do in about 30 minutes. If you haven't set up Search Console yet, the lesson on Google Search Console shows you how.
- In Search Console, open the Manual actions report. A green check mark means no manual actions apply.
- Open the Security issues report too. This covers hacking and malware, which is separate from manual actions.
- Pick your three most important pages. Read them out loud. If any sentence sounds like it was written for a robot ("best plumber London best plumber London"), rewrite it for a person.
- Look at your blog comments, forum or review sections. Delete spam and turn on moderation if it isn't on.
- Ask whoever has worked on your SEO: "Have we ever bought links, used private blog networks or published auto-generated pages?" Write down the answer.
If everything looks clean, great. If something worries you, note it down. You will learn how to deal with each issue later in the course.
Questions beginners ask about white-hat and black-hat SEO
Is buying links always black hat?
Buying links to manipulate rankings is link spam under Google's policies. Paid placements such as ads and sponsorships are fine when the links are marked properly, so they don't pass ranking credit. You will learn how in the lesson on link quality.
Is AI-written content black hat?
Not by itself. Google's spam policy targets scaled content made mainly to manipulate rankings, however it is produced. Helpful content made with AI help is not the problem. Mass-produced, unchecked pages are.
Will Google tell me if my site is penalized?
For a manual action, yes. You will see it in the Manual actions report and the Search Console message center. For algorithmic demotions, there is no message. You only see the drop in your data.
Can a competitor hurt my site with spam?
Some problems, like hacked content or comment spam, can be caused by others, but you can fix them on your side. Keep your site secure, moderate user content and check Search Console regularly. If you notice a flood of strange links, the lesson on toxic links explains what to do.
White hat is the only plan that lasts
In brief: Google Search Essentials is the rulebook. White-hat SEO follows it and builds pages that deserve to rank. Black-hat SEO tries to trick the system with tactics Google lists in its spam policies, and the result can be lower rankings, removal from results or a manual action you have to fix by hand.
The next lesson answers the question every beginner asks after learning the rules: how long does SEO take to show results when you do it the right way? And if you're worried your site may have an old penalty or bad links, our team can take a look. You can ask us for a free quote whenever you're ready.