Manual actions and security issues in Search Console: reading and fixing them

Most ranking problems are algorithmic: search systems re-evaluate pages and some lose. Two kinds of problems are different, because Google tells you about them explicitly. The Manual actions report lists penalties applied by human reviewers for violations of Google's spam policies. The Security issues report lists hacked content, malware and social engineering detected on your site. Both live under "Security & Manual Actions" in Search Console, and both deserve a check whenever traffic falls sharply.

The good news is that both reports usually say, at least roughly, what is wrong. The bad news is that the fix must be thorough. Half-cleaned sites are the main reason reconsideration requests fail.

Reading the Manual actions report

If no action exists, the report says "No issues detected". If there is one, it shows:

• The type of action, such as "Unnatural links to your site", "Thin content with little or no added value" or "Pure spam".
• The scope: site-wide, or partial (affecting specific sections or URL patterns). Partial actions often list example URLs.
• A description and a link to the relevant policy, plus a button to request review once you have fixed the problem.

Manual actions apply to the property and its domain. If you verified only one URL-prefix property, check that you are looking at the right one; a Domain property covers everything. See the properties guide.

Common manual actions and what fixing them means

Action	Typical cause	What a real fix looks like
Unnatural links to your site	Bought links, link exchanges, paid guest posts with followed links, PBNs	Remove as many as possible by contacting site owners; disavow the rest; document the effort. See anchor text and disavow
Unnatural links from your site	Selling followed links, or followed links in sponsored posts	Add rel="sponsored" or "nofollow" to paid links, or remove them
Thin content with little or no added value	Scraped, auto-generated, doorway or thin affiliate pages	Remove or substantially improve the pages; not just noindex a few
User-generated spam	Spam in comments, forums, profiles	Delete spam, add moderation and anti-spam measures, nofollow user links
Spammy free host	Your hosting service hosts lots of spam	Usually a matter for the host; consider moving
Structured data issue	Markup that misrepresents content, such as fake reviews	Remove or correct the markup to match visible content
Cloaking or sneaky redirects	Different content for users and Googlebot, often from hacks or ad scripts	Remove the code serving different content; check for hacks
Site reputation abuse	Third-party content published to exploit the host site's rankings	Remove the offending content or keep it out of search
Pure spam	Aggressive spam techniques across the site	Usually requires rebuilding the site honestly

Writing a reconsideration request

After fixing, click "Request review". The request is read by a person. What helps:

1. Explain the problem honestly. "An agency we hired in 2024 bought links on article directories and blog networks."
2. Describe what you did, specifically. "We identified 1,240 linking domains, contacted 380 site owners, had links removed from 110, and disavowed the remaining domains we could not get removed."
3. Show evidence: a link to a shared spreadsheet listing affected URLs or domains, actions taken and outreach dates.
4. Say how you will prevent it recurring: a new policy, a removed plugin, moderation in place.

Avoid blaming Google, arguing the policy, or promising to fix things later. Requests that describe partial fixes are typically rejected, and each rejection adds weeks.

Partial actions, site-wide actions and what to expect

A partial action affects only the listed pages or patterns. The rest of the site ranks normally, which makes partial actions easy to miss: the overall traffic graph may barely move while one section disappears from results. A site-wide action affects every page and usually shows as a cliff in the Performance report.

For link-related actions, Google sometimes chooses to ignore the unnatural links rather than demote the site, and says so in the description. In that case the "penalty" is simply that those links no longer help, and rankings settle at the level the site earns without them. Cleaning up is still worthwhile, because the action stays on record until a review succeeds, but expectations should be realistic: a revoked action does not restore rankings that the bought links were holding up.

If you inherited the problem

Manual actions frequently arrive with history: a domain bought second-hand, a site taken over from a previous agency, or a company that acquired another business's website. The action applies to the domain regardless of who owns it now. Two practical steps help.

• Before buying an expired or second-hand domain, check its history in a web archive and a backlink tool. A domain whose past life was a casino link farm can carry problems that take months to clear.
• When taking over a site, ask for Search Console access on day one and read both reports before anything else. If an action exists, documenting that it predates your involvement makes the reconsideration request clearer and protects your own reputation.

Reading the Security issues report

Security issues are not penalties for behaviour; they are warnings that your site has been compromised or is harming visitors. Google may show warnings in search results ("This site may be hacked") or in Chrome (a red interstitial), which destroys traffic and trust far faster than any ranking drop. The main categories:

• Hacked: content injection — spam pages or links added to your site, often pharma, gambling or counterfeit goods, sometimes visible only to Googlebot.
• Hacked: code injection — malicious JavaScript or iframes inserted into pages.
• Hacked: URL injection — new pages created on your domain by attackers.
• Malware and unwanted software — files or pages that try to install harmful software.
• Social engineering — deceptive pages, such as fake login forms or misleading download buttons, sometimes from ad networks.

Cleaning up a hacked site

1. Take stock without panicking. Use URL Inspection on example URLs from the report to see what Googlebot sees; hacks often hide spam from logged-in users and normal browsers.
2. Find the entry point. Outdated CMS cores, plugins and themes are the most common route, followed by stolen passwords and insecure file permissions. If you do not close the hole, the hack returns.
3. Remove the injected content. Compare files with a clean copy, check the database for injected posts and options, look for unfamiliar users with admin rights, and check .htaccess and server configuration for cloaking rules.
4. Restore from a clean backup if you have one, then update everything before going live.
5. Change all credentials: hosting, database, CMS admins, FTP, API keys.
6. Remove spam URLs from the index: make them return 404 or 410. For urgent cases, the Removals tool hides them temporarily while they drop out.
7. Request a review in the Security issues report, describing what you found and fixed.

Spam pages created by a hack often appear in Search Console as a sudden jump in indexed pages or impressions for unrelated queries in other languages. Watching the Page indexing report and the query list for strange terms is an early warning system.

Prevention

• Keep the CMS, themes and plugins updated; remove the ones you do not use.
• Use strong, unique passwords and two-factor authentication for every admin account.
• Limit who has admin access; remove old staff and agency accounts.
• Monitor for unexpected changes: new pages in the sitemap, new outbound links, changes in robots.txt, sudden score drops. A scheduled DeskSEO check flags redirects, noindex and robots changes on the home page between runs.
• Vet sponsored content and link sales against Google's policies before publishing them.

When there is nothing in either report

Most traffic drops are not manual actions or security issues. If both reports are clean, the cause is elsewhere: an algorithm update, a technical fault, a tracking change or seasonality. The traffic drop guide walks through those possibilities in order.