I second the other commenter's opinion on disavow-ing links. It did have a positive impact on one of my online properties.

Reference: https://support.google.com/webmasters/answer/2648487?hl=en

If one would be a target of automated spammy link attack - let's say a competitor would order 100 spammy links a month for example 3 a day - how could one defend against this kind of attack? (I'm not in such situation, just speculating)

What I'm wondering is how easy it is really to get to top at some more obscure search term by just using nasty black hat tactics. I'm also wondering if this is actually the easiest way to get top of search results. If that is the case than it's really alarming IMHO.

automated disavowing, maybe? Sucks, but may be necessary.

But how could you know what links are real and what are not if not even google knows it? If you are trying to get legin backlinks at the same time then this would be almost impossible.

Nah, if there's money on the line there's a lot of reason to target you for a penalty. Scammy sites can't get attention if there's a legitimate site in the search results.

SEO is a big industry and taking down competitors is a part of being the top N results.

So how do I combat against this? We're a small, honest company providing great products and services for the companies that need them but we're getting killed online because no one can find us.

I've forked out a lot (for us) on adwords and the return has been negligible to say the least.

Does this mean that the democratizing power of the internet has been swallowed up for small, lean companies like us who cant afford a mega adwords budget?

You have to disavow the bad links. https://support.google.com/webmasters/answer/2648487?hl=en

Why is it that someone else gaming Google's algorithm becomes my problem and requires me to solve it rather than Google?

For the same reason when some fellow citizen acts against you, you may need to sue them yourself - Google provides a platform with some set of rules, but they can't proactively ensure nobody is doing something malicious to other parties (especially if the malicious act is allowed by the rules), nor they can codify and enforce "don't be an asshole" rule.

Your analogy doesn't really hold up. This isn't another person coming after you directly, it's the other person manipulating a third party to cause the third party to come after you, and the third party saying "not my problem that I'm easy to manipulate like that".

For a criminal-justice-system analogy, it's similar in concept (though not in extremity) to SWATting. And I don't think we want governments to wash their hands of that and say "not our fault our system is abusable that way, it's all on you to do something about it after the fact".

Identity theft is a perfectly reasonable analogy. If someone steals my identity and ruins my credit rating, the onus is on me to inform the credit reference agency. It'd be nice if Equifax could telepathically divine whether a credit transaction was legitimate or not, but it simply isn't possible. Google are similarly unable to distinguish between a blackhat SEO scheme and this sort of weird SEO DDoS.

>but it simply isn't possible

The credit rating agencies could establish reasonably secure channels directly to consumers (passwords would be a start, dedicated tokens would be best), and require explicit authorization through the secure channel for new lines of credit. No account system is perfect, but it'd be a hell of a lot harder to break than "prove your knowledge of full name, address, DOB, and SSN" which are shared and stored all over the place, and bound to leak.

The financial industry or the government (probably at the financial industry's behest) could sign/distribute cryptographic identities along with plastic ones. Opening a new account could require a signature from a signed certificate.

Banks could send prompts to your smartphone asking you to approve/reject ACH and even credit card transactions, ala Venmo. Or you could sign them from a device you control, as with Bitcoin. (Instead, when we get cryptographic signing for payments at all, we get cards which sign all transactions presented to them by devices the consumer doesn't control, without verifying the cardholder's intent except through the merchant's terminal, whose UI could be lying. And we're still stuck with shared secrets for online payments).

A lot is possible, the financial industry has simply chosen to put consumers (and itself) through the hassle and expense of cleaning up after fraud because it's cheaper than a serious attempt at an authentication system.

Except there are a lot of people (myself included) who see the handling of "identity theft" as banks and credit agencies trying to pass the buck for their own poor approaches to security and verification.

Exactly - In my opinion there is no "identity theft". There is criminal fraud, which the banks are a victim of. However, instead of dealing with that fraud they just pass the costs on to an unrelated individual and then shrug and say "you deal with it".

Google does something much like this - but without regulation or clear appeal process.

"Swatting is the act of deceiving an emergency service (via such means as hoaxing an emergency services dispatcher) into sending a police and 9-1-1 response team to another person's address, based on the false reporting of a serious law enforcement emergency, such as a bomb threat, murder, hostage-taking or other alleged incident."

https://en.wikipedia.org/wiki/Swatting

TIL

I strongly agree with this sentiment; the fact that "competitors" can penalize you, the back link component should be removed from the ranking algorithm all together.

Uh, maybe I'm missing something, but aren't backlinks the entire concept Google is based on?

You are the most motivated party.

I would like to see this change.

If Google's approach is encouraging or enabling fraud, I'd like to see to it they're the ones who are motivated to change their approach. Making them legally responsible for the actions of their algorithms, preferably with penalties steep enough that even they can't ignore the resulting fines, might not be a bad start.

It doesn't sound like they're encouraging it per se, and they do enable legit actors to take countermeasures. But there's no incentive for them to be proactive like you want, especially given that they are part of an effective duopoly in the space. I agree it's not a great situation, but the legal incentives you propose are basically delusional - if Google can't easily detect what spam is maliciously anti-competitive, how do you reckon a court is going to prove it thus and enforce a fine on Google for failing to do so?

Why is it that if someone steals my wallet in the street I have to describe them to the police?

Your analogy is incorrect.

If the police simply refused to respond until you'd done the full investigation yourself and handed in the proof, and then the only thing they'd do was acknowledge "yup, that guy stole your wallet, we won't assume he legitimately possesses that wallet anymore but we also won't do anything to get it back or prosecute him", then you'd have an analogy.

That's not a valid description of what Google does. The link up the thread describes what they do.

Also, have you tried reporting a minor crime in a major city recently? Me: "My (nice road racing) bike was stolen. Here's the video tape from the security camera showing the crime and the thief's face." Cops: "That's nice for you. Come back in a week and see if your bike is in our shed if you like. Cheerio".

Try finding influencers with high pagerank (page 1-2 for your business type) and paying them to review/feature your products and link to your site.

you can definitely rank as a small business as well in the organic search results, without any adwords budgets, but SEO is not as easy as it was 6-8 years ago - that´s for sure. if you are interested, i can have a look at your company´s site and provide some ideas / feedback, if you want to.

I manage SEO for a company in a very competitive and spammy SEO space (payday loans). (A good guy trying to fix the space.)

I spend an average of 10-15 hours/week disavowing bad links our competitors build. I've automated most of it now so it's going faster, but it's out of control.

It's a sad situation but I can pay $5 on Fiverr to attack you that way. Google should really handle it better.

they actually have, and have taken more steps to prevent this happening as of lately. (they also deny Negative SEO is a thing).

Their latest update of the Penguin algorithm states it is more "granular" and also stated it will really only penalize the pages that have the bad links pointing to it, rather than the whole site.

Small steps, I know but at least they are doing something it seems.

1) Update your Disavow file properly, which I am sure you've done

2) Email Google directly. It is sometimes difficult to find a way to email, but once you do they'll take care of it.

Any suggestions on where to search for such an email address?

Frankly I do not remember, but if you look into the webmaster console help section hard enough you will end up finding a place, or you can also try reporting an issue via the Maps since it is a local business. What is certain is you can contact someone there and they are usually helpful once you do.

Talk to one of their sales reps.

I dunno how much it has evolved, but Google got started by weighting search results based on how many other pages linked to that page. More links and your pages was found closer to the top of the results page.

So a easy way to game that was to set up "link farms" that pointed to each other, but not really offering anything worthwhile except a bunch of words people were likely to search for.

Goodhart's law: "When a measure becomes a target, it ceases to be a good measure."

https://en.wikipedia.org/wiki/Goodhart%27s_law

Supposedly Google now doesn't count these as negatives, they just disregard them. Specifically because of this vulnerability.

I wonder why google doesn't count spammy links as zero rather than negative.