Here is how to check Google penalty status in two minutes. Open Google Search Console, go to Security & Manual Actions, and read two reports: Manual actions and Security issues. A green check mark in both means Google has not applied a manual action and has found no security problem on your site. If either report lists an issue, that’s your answer, and the report tells you which pages are affected and what to fix.
If both are clean but traffic still fell, you don’t have a penalty in Google’s sense of the word. You may have an algorithmic drop, which needs a different check and a different fix. I’ll show you both below.
A quick boundary: this post covers penalties only. For every other reason traffic falls, from broken tracking to seasonality, use my guide to why your website traffic is dropping.
What Does Google Actually Mean by a “Penalty”?
Here’s the part most “penalty checker” articles skip. Google’s own spam policies page doesn’t call anything a penalty. It says Google detects policy-violating content through “automated systems and, as needed, human review that can result in a manual action.” Sites that violate the policies may “rank lower in results or not appear in results at all.”
So there are really two different things people call a penalty:
- A manual action. A human reviewer at Google decided some or all of your pages break a spam policy. It shows up in Search Console. You fix it and ask for a review.
- An algorithmic drop. Google’s automated systems, including core updates and spam updates, re-ranked your pages. Nothing shows in Search Console. There’s no request to file.
In my experience, most owners who ask me to “remove a penalty” have the second kind. That matters, because the playbook for one does nothing for the other.
The Condition Map: Three Things Decide Your Path
Before you change anything, answer these three questions. They decide which branch below applies to you.
- Does the Manual actions report show an issue? Yes sends you to Branch 1. No rules out a human penalty.
- Does the Security issues report show an issue? Yes means hacked content or malware, and that comes first, before any ranking question.
- Does your drop date line up with a Google update? If both reports are clean, the timing is your best clue for an algorithmic hit.
Step 1: How to Check Google Penalty Status in the Manual Actions Report
In Search Console, pick your property, then look in the left sidebar under Security & Manual Actions and select Manual actions. Google’s Manual actions report help page says that if your site has no manual actions, you’ll see a green check mark and a message saying so.
If you see a count of one or more actions, then expand each one. The report lists patterns of affected pages, and Google says those can be “a subset of your site, or the entire site.” Write down the action type and the page patterns before you do anything else.
Google also says it notifies you in the report itself and in the Search Console message center. If you never verified the site in Search Console, then you may have missed the message entirely. Verifying now still shows any active action.
Step 2: Open the Security Issues Report
Same sidebar section, second item: Security issues. Google’s Security issues report page lists hacked content (malware, code injection, content injection, URL injection), deceptive pages, harmful downloads and unclear mobile billing as errors, plus a few warning-level issues.
A security issue isn’t a spam penalty, but it can hurt just as much. Google says affected pages can carry a warning label in search results or an interstitial warning in the browser. Few visitors click past that.
If this report flags hacked content, then clean the site before thinking about rankings. Google’s hacked-site guides now live on web.dev. For the WordPress version I see most, my WordPress SEO spam guide walks through finding the injected pages, and my WordPress hack recovery steps cover the full cleanup.
Which Manual Action Types Can Google Apply?
This is the current list from Google’s Manual actions report page, which I checked on October 4, 2026. The descriptions are my short summaries of Google’s wording.
| Manual action type | What it means in plain English |
|---|---|
| Back button hijacking | The site manipulates browser history so the back button doesn’t return users where they came from |
| Site abused with third-party spam | Visitors or outsiders posted spam on your site (forums, comments, profiles) |
| User-generated spam | Spammy content submitted by users on forums, guestbooks or profiles |
| Spammy free host | A large share of sites on your free hosting service are spam |
| Structured data issue | Your markup breaks Google’s structured data guidelines |
| Unnatural links to your site | Artificial or manipulative links pointing to you, such as bought links |
| Unnatural links from your site | Your site links out in a manipulative pattern, such as selling links |
| Thin content with little or no added value | Low-quality or shallow pages |
| Cloaking and/or sneaky redirects | Users and Google see different content, or get sent somewhere else |
| Major spam problems | Aggressive spam, such as scaled content abuse or cloaking |
| Cloaked images | Images shown to Google differ from what users see |
| Hidden text and/or keyword stuffing | Text hidden from users or pages stuffed with keywords |
| AMP content mismatch | The AMP page differs from its canonical page |
| Sneaky mobile redirects | Mobile users get redirected to content Google didn’t see |
| News and Discover policy violations | Content breaks Google News or Discover policies |
| Site reputation policy | Part of the site breaks the site reputation abuse policy |
Back button hijacking is the newest entry. Google added it to its malicious practices policy in 2026, with enforcement from June 15, 2026, and older penalty lists online don’t include it yet. For site reputation actions, Google’s page notes the impact doesn’t apply to results shown to users in the European Economic Area.
Branch 1: When You Have a Manual Action
Good news, in a strange way. A manual action is the one kind of “penalty” with a clear exit.
Google’s instructions are specific. Fix the issue on all affected pages, not just a sample, then select Request Review in the Manual actions report. Google says a good request does three things: explains the exact quality issue, describes the steps you took to fix it, and documents the outcome of your efforts.
Then wait. Google says most reconsideration reviews “can take several days or weeks,” and link-related requests can take longer. You’ll get a message when the review is done.
If the action is “Unnatural links to your site,” then your path runs through link removal and a disavow file. My guide on how to disavow backlinks covers the file format, the upload and what to write in the request. Google warns that blindly disavowing every backlink isn’t a good-faith effort, so do the removal outreach first.
Branch 2: When Both Reports Are Clean but Traffic Fell
No manual action, no security issue, but the line still dropped. This is the algorithmic case, and there’s nothing to submit. Here’s how I check whether an update is the likely cause.
First, find the exact date your clicks started falling in the Search Console Performance report. Use a long date range so you can see the shape clearly. Then open the Google Search Status Dashboard, which lists every core update and spam update with its start date and rollout length.
If your drop begins inside a rollout window, and many pages fell together, then an algorithmic update is a likely cause. As I write this, the latest entry is the September 2026 spam update, which started on September 24, 2026. Before that came the August and June 2026 spam updates and the May 2026 core update.
If the dates don’t match any update, then stop thinking about penalties. Go back to the full traffic-drop checklist and look at tracking, technical problems and your own site changes.
If the timing matches a spam update and you can see pages that break a spam policy, such as mass-produced pages or someone else’s content hosted on your domain, then read my breakdown of the Google spam update. It covers what each update targets and how recovery works when there’s no manual action to lift.
Do Third-Party Google Penalty Checker Tools Work?
Partly. They can’t see what Google sees. No outside tool has access to your Manual actions report, so no tool can tell you whether you have a manual action. Only Search Console can.
What these tools can do is overlay your traffic with a timeline of known Google updates, or show how volatile rankings were across many sites on a given day. Semrush Sensor is one example of a volatility tracker. That’s useful for spotting a correlation, but it’s the same comparison you can make yourself with the Status Dashboard and your own Performance report.
Be most careful with “toxic link” scores sold as penalty detectors. A high score is a vendor’s prediction, not a Google finding. My post on toxic backlinks explains why I rarely act on those reports alone.
Edge Cases That Change the Answer
- The manual action was revoked but traffic didn’t return. Lifting an action removes the restriction. It doesn’t restore links you disavowed or pages you deleted, so rankings can settle lower than before.
- You bought a used domain. If the Manual actions report shows an old action from a previous owner, then you still need to fix and request review. The history comes with the domain.
- Only Google News or Discover traffic fell. Check for a News and Discover policy action. Regular web search can look fine at the same time.
- Pages vanished, but the reports are clean. Check the Page indexing report before blaming a penalty. A stray noindex looks exactly like a penalty from the outside.
Decision Matrix: Penalty or Not?
| Manual actions report | Security issues report | Drop matches an update? | What you have | Next step |
|---|---|---|---|---|
| Shows an issue | Any | Any | Manual action | Fix all pages, Request Review |
| Clean | Shows an issue | Any | Security problem | Clean the hack, request a review there |
| Clean | Clean | Yes | Likely algorithmic drop | Improve the site, wait for recrawl or the next update |
| Clean | Clean | No | Not a penalty | Run the full traffic-drop checks |
When Should You Get Help With a Google Penalty?
A single, clear manual action on a small site is something many owners can fix alone. I’d bring in help when the action covers the whole site, when a reconsideration request has already been rejected, or when you can’t tell whether you’re dealing with an update or a self-inflicted technical problem.
That’s the work my team handles through SEO recovery, quoted after a free audit because every case is different. If you’re not sure which branch you’re on, start with a free SEO audit.
Frequently Asked Questions
How Do I Know If Google Penalized My Website?
Open Search Console and check the Manual actions report under Security & Manual Actions. A green check means no manual action. If it’s clean and traffic still fell, compare your drop date with the Google Search Status Dashboard to see whether an algorithmic update is the more likely cause.
Is There a Free Google Penalty Checker?
Search Console is the only free tool that shows real manual actions, because the data comes from Google itself. Third-party checkers can only compare your traffic with known update dates. Treat them as a timeline aid, not a diagnosis.
Can You Recover From an Algorithmic Penalty?
Yes, but there’s no request to file. You improve or remove the content that likely caused the drop, then wait for Google to re-evaluate the site. Google’s core updates page says this can take several months, sometimes until the next core update.
How Long Does a Google Reconsideration Request Take?
Google says most reviews take several days or weeks, and link-related requests can take longer. Use the wait to keep cleaning, and check the Search Console message center for the result.
Last updated: October 2026 by Mizanur Rahman
