To tell if you have a Google penalty, open the Manual actions report in Search Console. If it is clear, your drop is algorithmic, technical, seasonal or a reporting quirk, and the date of the fall usually tells you which.
By Kristijan GjorgjioskiIndependent SEO consultantPublished 18 October 2026 · 6 min read
People ask me "have I been penalised?" most weeks. The honest answer is usually no.
A real penalty leaves a paper trail. Everything else is a drop with a different cause, and you find it by checking things in the right order.
Here are the seven checks I run, from the five-minute ones to the slower detective work.
This is the only place Google confirms a penalty, so check it first.
In Search Console, go to Security & Manual Actions → Manual actions.
You'll see one of two things:
According to Google's help page on the report, a manual action is issued when "a human reviewer at Google has determined" that pages break its spam policies. Google also flags it in the Search Console message centre and by email.
The report shows the scope. Some actions list URL patterns. Others say they affect all pages.
Important: Check the right property. A domain property covers every subdomain and protocol. A URL-prefix property for
https://www.won't show you everything.
No action listed? Then you don't have a penalty in Google's sense. Keep going, because something still caused your drop.
Right below Manual actions sits Security issues. Check it next.
Hacked content, malware and phishing aren't manual actions. But Google may warn users before they reach a site it thinks is dangerous, and those warnings kill clicks fast.
The symptoms look like a penalty:
If this report flags anything, fix the hack first. Rankings come second.
Pro tip: Search Google for
site:yourdomain.comand scroll a few pages. Odd titles about pharmacy, casinos or replica goods are a classic sign of injected spam.
The date is your best clue. Get it exact.
Open the Performance report and set the range to the last 16 months. Google's guide to debugging traffic drops recommends this range so seasonal patterns show up.
Then look at the shape of the line:
Next, check impressions and clicks separately. If impressions held but clicks fell, your titles or the layout of results may have changed, not your rankings.
Write down the date. You'll need it for the next three steps.
Now compare your date with Google's list of ranking updates, which is linked from the Search Status Dashboard.
Core updates roll out over days or weeks. If your drop started inside a rollout window, that's a strong lead.
Google's own core updates page is clear that these updates "don't target specific sites or individual web pages". A drop isn't a punishment. Other pages were judged more useful for those queries.
The same page says to wait at least a week after a rollout finishes before comparing data. Judging mid-rollout leads to panic edits.
Spam updates are different. They target practices covered by Google's spam policies. If your drop lines up with one, review your site honestly against those policies: bought links, scaled thin pages, doorway pages, hidden text.
Note: "Algorithmic penalty" is an SEO phrase, not a Google one. I explain the difference properly in manual action vs algorithmic penalty.
This is where most "penalties" turn out to be self-inflicted.
Check these, in order:
A noindex tag pushed from staging, a robots.txt that blocks the whole site, or redirects that broke in a redesign all produce penalty-shaped drops. These are technical SEO problems, and they need fixing before anything else.
If you changed platform or URLs near your date, check the redirects first against your redirect map. My technical SEO checklist covers the full list of things to test.
Sometimes your site didn't change. The world did.
Check demand. Put your main queries into Google Trends and compare with last year. If interest fell for everyone, your traffic fell with it.
Compare year on year. A summer dip that happens every summer isn't a penalty. That's why the 16-month view matters.
Check your data. Google's debugging guide points to the Search Console data anomalies page for known reporting issues. In GA4, check whether a consent banner, tag change or new domain started dropping sessions. My guide on why GA4 data does not match covers the usual suspects.
Here's a quick test I use:
If Search Console clicks are steady but GA4 organic sessions fell, it's a tracking problem. Search Console doesn't depend on your tags.
Last step. Work out exactly what you lost.
In the Performance report, compare the period after the drop with the period before. Sort pages by click difference, then queries.
Ask three questions:
Here's how the evidence usually lines up:
| What you see | Likely cause |
|---|---|
| Action listed in Manual actions | Manual action (a true penalty) |
| Security issue flagged | Hacked site or malware |
| Drop starts inside a core update rollout | Core update reassessment |
| Drop starts inside a spam update rollout | Spam systems demoting a practice |
| Noindex or robots errors spike | Technical fault |
| Clicks steady in Search Console, sessions down in GA4 | Tracking issue |
| Same dip every year | Seasonality |
For a structured version of this, an SEO audit works through the same evidence across the whole site.
Start with the Manual actions report today. It takes two minutes and gives you a definite answer on the only true penalty.
If it's clear, date the drop and work down the list. The fix for a core update, a hacked site and a broken robots.txt are completely different, and guessing wastes months.
If you do find a manual action, or the evidence points to a spam update, my Google penalty recovery work starts with exactly this diagnosis. If backlinks look like the problem, you can first check your backlink quality yourself, and then talk to me about cleaning up after a penalty.
Google tells you about manual actions. They appear in the Manual actions report and the Search Console message centre, and Google emails verified owners. Algorithmic changes such as core updates come with no individual notice, so a site can lose rankings with nothing in Search Console saying why.
Yes. Google's help page on the Manual actions report says some manual actions cover a pattern of pages while others are labelled as affecting all pages. Algorithmic drops can also hit one section, such as a blog or a set of thin location pages, while the rest of the site holds steady.
For a manual action, Google says most reconsideration reviews take several days or weeks once you have fixed the issue and asked for review. For algorithmic drops after a core update, Google says it can take several months for its systems to recognise improvements, and sometimes until the next core update.
No. A sudden drop is often a technical fault, such as a noindex tag pushed live, a robots.txt mistake or a broken redirect after a redesign. It can also be a tracking problem, a seasonal dip or a Google update. Rule those out before assuming anything was done to the site on purpose.
About the author
Kristijan Gjorgjioski
Independent SEO consultant · 6+ years in SEO · 60+ client websites worked on
I'm an independent SEO consultant with 6+ years in SEO. I run audits, migrations and content programmes for businesses in Europe, the UK and the USA, and I build the automation behind my own research.
Book a free 30-minute call. I look at your site first and tell you plainly what I would fix, and in what order.