A Google traffic recovery checklist for small business websites

The traffic chart drops off a cliff in the third week of August. Somebody in the business says the word “penalty.” It’s usually the wrong word. A manual action, a security issue, and an algorithmic drop can all produce that chart, but they call for different responses. The first two have review processes. An algorithmic drop does not. Treat them the same way, and you lose weeks.

This blog already covers the mistakes that get a site into trouble. This article covers the recovery side. Which problem do you have, what gets fixed in what order, and what should you document along the way? Start with a dated record of what you changed.

Find out which problem you have

Two Search Console reports are the first checks. Each problem has a different recovery process, so start with diagnosis.

A manual action means a person at Google reviewed your pages and decided they violate the spam policies. The Manual Actions report shows the reason and the scope of the action, sometimes with examples of affected pages. Read the details to establish whether it affects a section or the whole site. A green tick means no manual action. Whatever the chart looks like.

A security issue lives in a separate report with its own review button. The Security Issues report covers hacked content, malware, and social engineering. Its consequence can be visible to your customers: a warning label in results or a full-page interstitial in the browser. If Google has flagged your site as hacked, this report is where the work starts.

An algorithmic drop shows up in neither report. Google lists announced ranking updates on its Search Status Dashboard with dates. In 2026, those include a spam update on March 24, core updates on March 27 and May 21, a spam update on June 24, and a spam update that rolled from August 18 to August 21. A further spam update began on September 24. If both reports are clear, an announced update may help explain the drop, but matching dates alone won’t confirm the cause. Technical problems, changing search demand, and other causes still need checking.

Google’s own method for debugging a traffic drop fills in the rest. Open the Performance report with a 16-month range, compare the period before the drop with the period after, and sort the Pages table by clicks difference. A drop across every page points at a site-wide problem. A drop in one section points to that section. Check the Page indexing and Crawl stats reports for technical problems, and consider whether demand for your main search terms has changed.

If the Manual Actions report shows a problem, fix the affected pages and submit a reconsideration request. If the Security Issues report shows a problem, complete the cleanup and request a review there. If both reports are clear, investigate the traffic drop through the Performance report and Search Status Dashboard. There is no reconsideration request for an algorithmic ranking change.

If it’s a manual action, read the scope first

The notice tells you more than most people read. The action types a small business site might encounter include unnatural links to your site, unnatural links from your site, thin content, user-generated spam, and the site reputation policy for sites hosting third-party content. Check the separate Security Issues report for hacked content too.

Two things changed in 2026. Google added an explicit back button hijacking policy in April, with enforcement beginning June 15. From August 30, manual actions under the site reputation policy directly affect search results outside the European Economic Area. Inside the EEA, Google may instead separate affected sections in its systems so they rank independently of the rest of the site.

Scope matters to whether your request succeeds. A partial action affects part of a site, and you must fix every affected page. Google’s wording is blunt: fixing the issue on just some pages “will not earn you a partial return.” The reviewer also has to see what you did. For pages you have corrected and want returned to Search, follow Google’s accessibility instructions: remove login requirements, paywalls, robots.txt blocks, or noindex directives that prevent the review or return to Search. If you removed a page or deliberately excluded it from Search as part of the cleanup, document that action instead.

One more rule surprises people who bought a site with baggage. If the problem predates you, fix it anyway. Then say so in the request.

Audit the links without nuking them

Link-related reviews can take longer than usual, and two habits can get requests rejected. The first is disavowing everything. The second is disavowing without making a good-faith effort to remove the links. Google’s order runs like this:

1. Export your backlinks from the Links report in Search Console, including top linking sites and latest links.
2. Mark the ones that violate Google’s link spam policies, such as paid links that pass ranking credit, excessive link exchanges, automated links, or links dropped into forums and directories in bulk. If you inherited an agency’s work, check its records too.
3. Email the site owners and ask them to remove the links or qualify them so they no longer pass ranking credit. Keep every message and reply, and record unanswered requests.
4. Disavow problematic links you can’t get removed, and only when warranted. The disavow tool’s own page says most sites will never need it. Google recommends it for sites with a considerable number of artificial or low-quality backlinks that have caused, or are likely to cause, a manual action. The tool requires a URL-prefix property, accepts one list per property, and can take a few weeks to process.

Blanket disavows fail on their own terms. Google says blindly adding all backlinks to the file “is not considered a good-faith effort,” and it can reject the request. Reviewers want documentation of the links you removed and an explanation of the ones you couldn’t.

Search Engine Roundtable reported John Mueller’s response to disavow questions on September 2. Responding to a site owner who reported a drop after disavowing links, Mueller advised reviewing the file and investigating other possible causes, including a spam update or a major technical problem. A drop after an upload does not, by itself, establish that the file caused it. For how legitimate links get built in the first place, the blog’s beginner’s guide to link building still holds up.

Fix thin and duplicated pages 

The thin content action covers pages that add little or no value, including thin affiliate pages, scraped content, and doorway pages built for closely related search phrases. A guest post does not violate the policies simply because it is a guest post; the content and its purpose matter.

Google’s spam policies include scaled content abuse, a policy Google introduced in March 2024. It explicitly covers using generative AI to produce many pages without adding value. The policy applies regardless of how someone creates the content, so pages a person writes for the same manipulative purpose can fail the same test.

Fixing means removing or rewriting, and the reviewer will want evidence of your work. Keep before-and-after examples. Google asks for exactly that in a thin-content review: examples of bad content you removed and good content you added. The audit steps in my content overhaul guide still apply here, with one addition. Date everything.

Duplicates are a different animal. Ordinary duplicate content does not violate Google’s spam policies. Google generally selects a canonical version to show in results, sometimes a different one from the version you prefer. Duplicates can also complicate tracking and waste crawling resources.

Google’s consolidation guidance ranks the signals by strength: redirects first, rel=canonical annotations second, sitemap inclusion third. Redirect duplicate pages you no longer need. If duplicates must remain accessible, point their canonical annotations to the preferred version. Add self-referential canonicals to the pages you want to keep, link internally to the canonical version, and use URL Inspection to check which canonical Google selected.

Keep a change log that supports your reconsideration request

Here is the omission I see most. A site owner does all of the above and then writes a two-line request that says “we fixed it.” The reviewer needs evidence of what changed. A log helps provide it.

Log every URL you touched, with the date and the action: removed, redirected, rewritten, noindexed. Log every link-removal email and its reply. Log the disavow file version and the date you uploaded it. Keep the before-and-after examples in a folder you can link to. Then check that the reviewer can access the evidence, because the log is useless if they hit a login wall.

Google describes a good request in three parts: the exact quality issue, the steps you took, and the outcome. Use the log to document all three.

Build the request around the manual action and its scope, using Google’s wording. Include the URL list or pattern and a count, summarize what you changed and when, and explain the outcome. For link-related actions, include a summary of your outreach and, if you used the tool, the disavow file version and upload date. Link to the full log and accessible before-and-after examples so the reviewer can verify the work.

Then wait. Most reviews take days to weeks, and link cases can run longer. Do not send a second request before the first decision arrives. For security issues, finish the cleanup before requesting review, because Google warns that premature requests can slow subsequent reviews or get a site marked as a repeat offender. Could a stranger understand what you changed from the request and its evidence? If not, the request is not ready.

If it was an algorithmic drop, the checklist changes

There is no form. Google’s core updates page says updates do not target specific sites, that pages which drop “aren’t necessarily bad,” and that deleting content is a last resort. Its advice is procedural. Wait at least a full week after the rollout ends, then compare the following week’s performance with a week before the update began. Avoid drastic changes in response to a small ranking drop. A sustained, large drop is the cue for a whole-site self-assessment against Google’s helpful-content questions.

Improvements can take effect in days or months. Some sites may need to wait for a later core update to see a change, but a major update isn’t always necessary, and Google doesn’t guarantee recovery.

Spam updates call for checking the spam policies. The spam updates page says a site that fixes its problems may improve as Google’s systems learn, over months, that it now complies. In a link spam update, a site cannot regain the ranking benefits those spammy links previously generated.

The August 2026 update is a useful case. Google called it a normal spam update with nothing new to announce. Glenn Gabe’s case studies identified affected sites with programmatic and AI-generated pages at scale, thin affiliate content, and misleading redirects. Those examples do not establish every practice the update addressed, or the cause of any individual site’s decline. A site that responded by disavowing its backlinks without finding a link problem risked fixing the wrong thing.

SE Ranking’s tracking, reported by Search Engine Land, found roughly 17 percent of sampled top-ten URLs dropped out of the top 100 for the same keyword, against a 9 percent baseline. That shows substantial movement in the tracked results, but it doesn’t explain why each URL fell or whether any affected site also had a manual action.

Send the request only when the evidence is ready

Before a reconsideration request goes to Google, run down this list:

• Open and read the Manual Actions and Security Issues reports.
• Read the scope of the action and fix every affected page.
• Check that corrected pages you want returned to Search meet Google’s accessibility requirements. Document pages you removed or deliberately excluded.
• For an unnatural-links action, make a good-faith effort to remove or qualify violating backlinks before disavowing those you can’t remove.
• Save before-and-after examples of removed and added content and provide accessible links to them.
• Explain the issue, the steps you took, and the outcome in your request, and link to the dated change log as supporting evidence.

Keep a dated record from the first day of cleanup. For a manual action, it gives the reviewer evidence of what you fixed. For an algorithmic drop, it helps you track your changes and assess their effect over time.