Black hat SEO is not a mystery, and it is not magic. It is a defined list of techniques that Google names, documents, and actively penalises. And in 2026, most of them have a shorter half-life than the time it takes to build the site you’d be risking.
This is the operator’s view — the risk-adjusted trade that nobody selling these tactics wants to talk about. Six of the most common black hat techniques, in plain terms: what each one actually is, why it works for a while, how Google detects it, and what happens on the way down. No tutorials. No tooling. Just the honest map, so you can recognise these whether you’re being pitched one or you’ve inherited a site that’s already been through it.
The short version: The white hat / grey hat / black hat line isn’t a moral scale — it’s a risk-and-recoverability scale. Some of these techniques still move rankings. All of them carry detection risk. And one of them — link spam — is, by Google’s own documentation, effectively unrecoverable. That single fact should reframe how you think about the whole category.
What “black hat” actually means
Black hat SEO is any practice that tries to manipulate a search engine’s rankings in violation of that engine’s stated guidelines. The defining line is not how hard you push — it’s whether you’re deceiving the search engine or the user to get there.
That distinction matters because the useful way to think about these tactics isn’t “good vs evil.” It’s risk vs reward vs recoverability. A technique that nudges rankings for three months and then costs you the domain is a bad trade, however clever it looks on a slide. We’ve operated across the full spectrum of this industry, so this isn’t theory — it’s the calculation behind every decision we make for a client, and the reason we steer people away from most of what follows.
One thing that makes this a 2026 conversation rather than a rehash of 2019 advice: on 15 May 2026, Google updated its spam policies to state explicitly that they apply to generative AI responses in Search — AI Overviews and AI Mode included. The updated definition now names “attempting to manipulate generative AI responses in Google Search” as spam. In plain terms, cloaking, scaled content abuse, link spam, site reputation abuse and doorway abuse now formally govern the AI answer layer too, not just the ten blue links. Every technique below just had its blast radius extended.
1. AI-washing and scaled content abuse
The most common one now. Mass-generated pages that add nothing — hundreds or thousands of them, built to blanket keywords rather than help anyone.
Why it works for a while: raw coverage can capture rankings before the thinness is noticed.
How Google detects it and what happens: its spam systems read the flood of near-identical pages, the absence of first-hand experience, and users who arrive and leave. The critical point, in Google’s own framing, is that it penalises this no matter how the content is created — a human writing 200 thin posts a year is the same violation as a model generating 200 a week. The March 2026 core update proved it: programmatic and AI content farms commonly lost 60–80% of their traffic, while sites with genuine expertise were largely untouched.
The fix isn’t “avoid AI.” It’s depth over volume — which is a whole discipline in itself, and the foundation of a real content strategy.
2. Cloaking
One of the most heavily penalised techniques, because it breaks the core promise search is built on. A cloaked page shows one thing to Googlebot and something different to the human who clicks.
Why it works for a while: the crawler is handed a clean, keyword-rich, relevant page; the real visitor gets something else — aggressive ads, an unrelated offer, sometimes a malware or phishing payload.
How Google detects it and what happens: because the indexed result and the served result differ, cloaking frequently draws a manual action from a human reviewer rather than a quiet algorithmic nudge — and manual actions can remove a page, or an entire site, from results. Recovery means removing the deception entirely, then filing a reconsideration request to prove it. A slow road back from a fast trick.
3. Private blog networks — and the one hit you can’t recover from
Private Blog Networks (PBNs) attack the backbone of ranking: links. A PBN is a set of sites built for one purpose — to link to a single money site and fake the appearance of earned authority, often assembled on expired domains that still carry residual trust.
Why it works for a while: the money site can look like it’s earning links from across the web.
How Google detects it and what happens: the footprints are hard to hide — shared hosting, overlapping registrations, unnatural link timing — and Google’s systems are built to find them. When a PBN is caught, the links are devalued (whatever you paid evaporates) and the money site can take a manual penalty for participating in a link scheme.
Here is the part that should end the conversation, and it’s the single most important fact in this whole post. Google’s own documentation states that the ranking boost gained through link spam is permanently withdrawn. Not suspended. Not recoverable on cleanup. Withdrawn. Even after you disavow and clean up, you don’t get to keep the gains and drop the risk. Of the six techniques here, this is the one Google explicitly documents as unrecoverable — which is exactly why the legitimate side of link acquisition matters so much, whether that’s earned guest posts or carefully vetted niche edits on genuinely relevant sites.
4. Site reputation abuse (parasite SEO)
Common enough that Google named a policy after it. Site reputation abuse — parasite SEO — is renting a trusted host’s ranking signals to rank content that could never rank on its own: publishing your pages on a major news outlet, university, or well-known publication and borrowing its authority.
Why it works for a while: the content inherits the host’s credibility and can rank for competitive terms almost immediately. It’s why you’ll occasionally see a respected news domain suddenly ranking a page on online casinos.
How Google detects it and what happens: this is the technique with the most important recent clarification, and it matters if you work in a regulated space. In November 2024, Google removed the “we oversee the content” defence. Its updated language states that using third-party content to exploit a site’s ranking signals is a violation regardless of whether there is first-party involvement or oversight. In plain terms: it no longer matters if the publisher agreed, got paid, or reviewed it. No commercial arrangement launders it. The policy is still enforced through manual actions, and the sting is that the host domain — the trusted site being borrowed — can take the hit against its own hard-won rankings, which is why serious publishers now police what runs under their name.
5. Expired domain abuse
Buying a domain that built genuine authority under a previous owner, then repurposing it for something unrelated purely to inherit its ranking signals.
Why it works for a while: Google may keep crediting the old authority to the new content, at least initially. You’ve seen the outcome — a domain that was once a local institution or a defunct nonprofit quietly reappears as a casino affiliate or loan-comparison page. Google’s own example is vivid: casino content on a former elementary-school site.
How Google detects it and what happens: its guidance explicitly names buying expired domains chiefly to exploit their history as a spam tactic. When detected, the inherited authority is discounted and the site is left standing on what it actually is now — usually very little. This one deserves particular care, because it has a legitimate cousin: rebuilding a genuinely relevant aged domain, in the same niche as its history, is defensible. Topical alignment is the qualifying line. The difference between the grey version and the black version is intent and relevance — and knowing exactly where that line sits is the whole job.
6. Sneaky redirects and doorway pages
A straight bait-and-switch. A sneaky redirect sends the user somewhere other than the page they clicked. Doorway pages are clusters of thin, near-identical pages built only to catch keyword traffic and funnel it elsewhere.
Why it works for a while: a page optimised for something reasonable — “best budget laptops” — gets indexed, and the moment a real person clicks, hidden code fires them to something unrelated. The doorway version scales it sideways: hundreds of near-duplicate pages (“plumbers in New York,” “plumbers in Boston”) all funnelling to one destination.
How Google detects it and what happens: both are explicit guideline violations because both waste the user’s click. Penalties come fast — sneaky redirects can get pages pulled, doorway pages get de-indexed, and the wider site can take a spam action. The tactic doesn’t just gamble your rankings; it spends your users’ trust to do it.
The real lesson: it’s a risk scale, not a moral one
Line the six up and the pattern is clear. These aren’t ranked by how “bad” they are — they’re ranked by detection risk and recoverability, and that’s the only framing that helps you make a decision.
- Some still move rankings. Nobody serious pretends none of these ever work. Cloaking, PBNs, and parasite SEO can all shift positions — for a while.
- All carry detection risk. Google names, documents, and actively hunts every one of them, and as of May 2026 that enforcement formally covers the AI answer layer too.
- One is explicitly unrecoverable. Link spam. Google’s own documentation says the gains are permanently withdrawn. That’s not a risk you’re taking — it’s a cost you’re pre-committing to.
The white hat / grey hat / black hat spectrum isn’t about ambition. Genuinely white hat sits at one end, defensible grey in the middle, and you can compete hard across both and still build something that survives an update. Black hat is defined by deception — and by a trade where the upside is a loan that always gets called in.
The practical takeaway, especially if you’re evaluating an agency: if you hear “guaranteed number-one rankings,” or you get a vague non-answer when you ask how the results are produced, treat both as warnings. Durable visibility is earned, evidence-led, and slow. It’s a marathon, not a sprint — and it’s the only version that’s still standing after the next core update.
Watch the video
This post accompanies our full video breakdown of the six techniques and the risk-and-recovery framing behind them.
Where to go next
Black hat SEO isn’t a dark art — it’s a documented list of trades, most of them bad ones, and all of them now governed across Google’s AI surfaces as well as its classic results. Recognising them is the first line of defence, whether you’re vetting an agency or auditing a site you’ve taken over.
That defensive work is core to what we do. If you’re worried a site has already been through one of these — or you want to know where your own sits on the risk scale — a detailed site audit is the honest first read, and recognising these tactics in the wild is central to brand protection. The durable alternative to all six — depth, genuine authority, and the same signals that increasingly drive AI search visibility — runs through the whole GrowifyLabs solutions catalogue. Start at growifylabs.com if you want the overview.
Been pitched one of these — or inherited a site that was? Tell us which one. That’s the conversation worth having.
FAQ
What is black hat SEO?
Black hat SEO is any practice that tries to manipulate search rankings in violation of a search engine’s stated guidelines. The defining line is deception — deceiving the search engine or the user — not how aggressive the tactic is. Google names and actively penalises a specific list of these techniques.
Does black hat SEO still work in 2026?
Some techniques still move rankings temporarily, but all carry detection risk, and Google names, documents, and hunts each one. As of 15 May 2026, that enforcement formally extends to generative AI responses (AI Overviews and AI Mode) as well as classic search results. The realistic framing is risk versus recoverability, not “does it work.”
Which black hat technique is hardest to recover from?
Link spam, including private blog networks. Google’s own documentation states that the ranking boost gained through link spam is permanently withdrawn — even after you disavow and clean up. Of the common black hat techniques, it’s the one Google explicitly documents as unrecoverable.
Is parasite SEO (site reputation abuse) still against the rules if the publisher oversees the content?
Yes. In November 2024 Google clarified that using third-party content to exploit a host site’s ranking signals is a violation regardless of whether there is first-party involvement or oversight. Editorial oversight is no longer a defence. The policy is currently enforced through manual actions.
Is buying an expired domain always black hat?
No. Repurposing an expired domain primarily to exploit its unrelated ranking history is a documented spam tactic. But rebuilding a genuinely relevant aged domain, in the same niche as its history, is defensible. The qualifying line is topical alignment and intent.