White hat SEO refers to tactics that comply with search engine guidelines — earning rankings through genuine content quality, legitimate link building, and sound technical practices. Black hat SEO refers to tactics that try to manipulate rankings by exploiting loopholes or violating those guidelines. The practical difference: white hat builds something that lasts, black hat builds something that works until it does not, and when it stops working, the fallout can be severe.

Common White Hat Practices

  • Creating content that genuinely answers what your audience is searching for.
  • Earning backlinks by producing resources other sites want to reference.
  • Ensuring your site is technically sound — fast load times, mobile-friendly, clean code, no crawl errors.
  • Optimizing title tags, meta descriptions, and headers to reflect the actual content of each page.
  • Building a real online reputation through reviews, citations, and brand mentions.

None of this is glamorous. It is methodical work that compounds over time.

Common Black Hat Tactics to Recognize

  • Keyword stuffing — cramming keywords into a page at unnatural density to try to signal relevance to Google. It does not work and makes the page unreadable.
  • Purchased link schemes — paying for backlinks from low-quality directories or link farms. Google has been targeting these for over a decade and continues to penalize sites caught doing it.
  • Cloaking — showing different content to search engines than to human visitors. This is a direct violation of Google guidelines and can result in manual removal from the index.
  • Private blog networks (PBNs) — networks of websites created solely to pass link authority to a target site. A common upsell from cheap SEO vendors, and a significant penalty risk.
  • Spun or AI-mass-generated content — low-quality content produced at scale with no editorial review, designed to create keyword coverage rather than inform readers.

Why Businesses Fall for Black Hat Vendors

Black hat tactics are still being sold because they can produce fast early results. A site that buys 500 links might see rankings jump in 60 days. That makes the vendor look effective right up until Google updates its algorithm or a manual reviewer flags the site. I have worked with clients who inherited black hat penalties from previous agencies and it took twelve to eighteen months of remediation work to recover. The short-term gain rarely justifies that risk.

How to Protect Yourself

Ask any prospective SEO vendor to explain their link building process in plain language. If they are vague, or if they promise a specific number of links per month without explaining how they acquire them, treat that as a warning sign. Legitimate SEO work is explainable and auditable.

Gray Hat: The Middle Ground Worth Knowing About

There is a category of tactics that sit between clearly compliant and clearly manipulative. Guest posting at scale, aggressively pursuing link exchanges, or publishing content primarily to capture keyword traffic rather than serve readers can all drift into gray territory depending on how they are executed. I am not going to tell you these tactics are never used — they are, including by firms that charge substantial fees. But the risk-reward calculus changes every time Google updates its guidelines, and businesses that built their rankings on gray hat foundations often get caught in the crossfire. I default to white hat because I want my clients to have rankings that hold.

What an Actual Google Penalty Looks Like

There are two types of Google penalties, and they feel very different. The first is a manual action — a human reviewer at Google has flagged your site. You will see a notification in Google Search Console under Security and Manual Actions. Rankings drop fast, sometimes overnight, and the specific issue is named: unnatural inbound links, thin content, cloaking. The second type is an algorithmic penalty, which hits when Google rolls a core update or the link spam algorithm runs. There is no notification. You just watch traffic fall in Search Console and try to correlate the timing to a confirmed update.

Recovery from a manual action requires submitting a reconsideration request after fixing the underlying issues. For a link penalty, that typically means building a disavow file — a text file you upload to Search Console listing domains you want Google to ignore when evaluating your site — and documenting the cleanup work you did. Expect 60 to 90 days before the reconsideration request gets reviewed. Algorithmic recovery takes longer, often 3 to 6 months, because you have to wait for the next algorithm refresh to see improvement.

How to Audit for Black Hat Damage Left by a Previous Agency

This is a situation I run into more than I would like. A client comes to me after parting ways with an SEO vendor, and the previous work left a mess in the link profile. Here is the process I use to assess the damage.

Start in Google Search Console. Check the Manual Actions tab for any existing penalties. Then look at the links report and filter by external links — you can see which domains are linking to your site. Export that list. Next, pull the same data from Ahrefs using the Referring Domains report. Ahrefs shows you Ahrefs Rank for each linking domain, which gives a quick signal of domain quality. Filter for domains with very low DR (under 10), check the actual sites, and look for patterns: link directories, spun content sites, footprints of PBN networks (similar hosting, identical site structures across domains).

Once you have identified toxic-looking domains, add them to a disavow file. The format is simple — one domain per line prefixed with domain: — and you upload it through Google Search Console. Disavowing is not a magic fix; it is a signal to Google that you want those links ignored, not a guarantee. For severe cases with a manual action already applied, the disavow file is step one of your reconsideration request documentation.

How to Evaluate a Link Profile Before You Sign a Contract

If you are taking over a domain or inheriting someone else’s SEO work, spend an hour in Ahrefs or Semrush before you commit to anything. Look at the referring domains graph over time — a sudden spike of 200 new linking domains in a single month is a red flag. Natural link growth is gradual. Look at anchor text distribution: if 40% of anchors are exact-match keyword phrases, that is another signal of a manipulative link campaign. Diverse, natural anchor text skews toward branded terms, URLs, and generic phrases like this article or the source.

Also look at the quality of the content that is linking to the site. Click through to a sample of 20 referring pages. If the majority are thin, low-quality sites that appear to exist solely to publish links, document that carefully. That information shapes the scope of any remediation work and the timeline you set for recovery expectations.

Knowing what to avoid is one part of hiring well. Read How to Hire an SEO Consultant for a complete framework for evaluating vendors. If you want to talk through a specific situation, my SEO consulting page explains how I work with clients.