How to Protect Your Website from Black Hat SEO

James Dooley: How do you defend against black hat SEO? A lot of people in the SEO community are talking about black hat strategies and a lot of sites are getting hit hard. Today I am joined by Brian Kato, who is speaking at SEO Mastery Summit. He has a full talk on this at the Mad Singer event and I am looking forward to hearing it. Before that, I wanted to dig a bit deeper into what you will be covering. First, for anyone who does not know who Brian Kato is, can you give a quick background on your cyber security experience and why you know how to defend against black hat SEO?

Brian Kato: When I first got into marketing, I was a full stack developer. I was doing a lot of online reputation management, so I understood that you could move things up in the SERP and also move things down. At the time, that was framed as reputation management, but really it is search manipulation. Over the years in SEO, I got more involved in the overlap between marketing and cyber security. What I kept seeing was that you could rank a business, but if they did not have the right foundation, someone could come along and trash their brand or trash their site. Ranking number one today does not mean much if you are de-indexed tomorrow. That is really how I got into this area.

James Dooley: With defending against black hat strategies, is there anything specific you are seeing right now that is common and that people may not know about? What should they be looking out for and how can they identify it before they even try to defend against it?

Brian Kato: The first thing I want to make clear is that a lot of what people call negative SEO is self-inflicted. They hired a poor link builder, used a bad link strategy, or their site was just not properly optimised. A lot of it is self-sabotage. In the cases where I see real attacks, they often come through an entity poisoning vector. Someone tries to undermine who you are and what your brand stands for. They try to decouple your brand from its real identity. The reality is that anything you can do to move a business up in rankings can also be used to move a business down. It all comes down to implementation.

James Dooley: Entity recognition is so important now. Brand is everything. If someone is trying to disambiguate your brand and make it look like you are someone else, I can see why that would hurt rankings. Everyone is trying to reinforce who they are, what they do and why they are credible. If someone is doing the opposite, it damages clarity and weakens confidence signals. So what can people do about that? If I have built a strong brand over ten years with a positive brand SERP, reviews, testimonials and case studies, and then someone comes after me, how do I defend myself?

Brian Kato: The first thing we usually recommend is understanding your baseline. You need to know what normal looks like. A real attack is usually coordinated and calculated. It is not just someone throwing bad links at a site. Google generally ignores that. Where it gets more serious is when someone attacks the entity, the knowledge panel, or starts creating ambiguity around your brand. Those are real attack vectors. Another issue I see is with reviews. False reviews and review bombing are a big problem right now. I also see canonical issues a lot. That often falls into self-sabotage, but missing or incorrect canonicals can open a site up to attacks.

James Dooley: We have seen bad cases where people leave one-star reviews on brands we work on, then contact us and say they will change them to five-star reviews if they are paid. It is ridiculous. At the same time, genuine reviews often get removed while fake one-star reviews stick. What can people do about that? Do you just report it and hope Google removes it? Or should you respond and say you have no record of that customer and it is a fake review?

Brian Kato: That is actually the most common response I see. People say they have no record of working with the reviewer. The problem is that this does not always work. Someone can leave a one-star review based on a real interaction, even if they never became a customer. For example, if they came into your business, had a bad experience and chose not to buy from you, that still counts as a genuine engagement. That is why Google often does not remove those reviews. The rules around reviews are quite loose. If someone had a genuine interaction with the business, they can often leave a review. The reviews that tend to stick the most are the ones with only a star rating and no written explanation, because Google has very little to work with. Usually, we recommend responding positively. We say something along the lines of, “We always appreciate detailed feedback so we can understand what led to this one-star review.” Then we report it.

James Dooley: That makes sense. What about self-sabotage and poor quality links? Google is generally good now at ignoring obvious spam like mass blog comments or automated junk. But what about links on toxic PBNs using exact match anchors to money pages? That can look like something an SEO would do to boost rankings, even though it is toxic. What should people do there? Does the disavow still help?

Brian Kato: Honestly, I have very rarely used disavow. In all my years in SEO, I have probably only used it three or four times. It is not something I rely on. Usually, what we do instead is build better links. We look at topical relevance, the semantic context around the link and the anchor, and then strengthen the site with better signals. Even when a link is de-indexed or ignored, it may still pass a little value. So our approach is usually to outweigh it rather than obsess over disavowing it. The one exception is anything involving child exploitation material or similarly extreme categories. Those get disavowed immediately.

James Dooley: So anything highly toxic or illegal gets handled straight away. Is there anything else we can talk about without giving away too much from your full talk in Vietnam on defending against black hat spam?

Brian Kato: The one thing I will say is that the worst negative SEO often comes from within and comes from within Google itself. I will leave it there, because people need to watch the full presentation for the rest. Some of the worst cases I have seen involve weaponising the very system that is supposed to protect you.

James Dooley: I will leave it there then. Brian, it has been a pleasure. Anyone who wants to understand how they may be self-sabotaging without even realising it, or how certain actions inside Google may be hurting their site, should make sure they get over to SEO Mastery Summit. If anyone has questions about black hat strategies, virality, CTR manipulation, short clicks, Navboost or related issues, leave a comment. Brian and I will both respond. There are a lot of black hat strategies around right now, which is frustrating because people should be winning on merit. But it is part of the game now. Brian clearly knows how to defend against a lot of it because of his cyber security background. Brian, it has been a pleasure and I will see you again soon.

Brian Kato: Sounds great. Thanks, James.