How a bad SEO agency can damage your site

Six ways an agency actually damages a site

Nearly every horror story we're handed by a founder fits one of six shapes. Recovery time varies enormously between them, which is the part nobody tells you when they promise to "fix your SEO".

Treat the times below as realistic ranges, not schedules. Algorithmic recoveries depend on when Google next re-evaluates your site, and that isn't on a calendar you control.

Toxic links, and the disavow file that probably isn't the answer

Buying links violates Google's link spam policy. That part isn't controversial. What has changed is the consequence: Google's systems increasingly neutralise spammy links — ignoring them rather than punishing the site they point at — and Google's own guidance is that most sites never need the disavow tool at all.

That matters, because the standard panic response is to disavow thousands of domains, and disavowing links that were actually helping is a far more common self-inflicted wound than the original spam. The disavow file is a loaded gun aimed at your own link profile.

So work through it in order, and stop as soon as the evidence runs out.

1. Check for a manual action first. Search Console, Security & Manual Actions. If there's nothing there, you almost certainly don't have a link penalty, whatever a sales email told you.
2. Ask the agency for the placement list. Every URL, every month, with invoices. An agency that built real links can produce this in an afternoon. "Our private network" is a confession.
3. Look for the footprint, not the volume. Sudden spikes of hundreds of referring domains, identical anchor text, the same six footer templates, unrelated foreign-language sites. Pattern beats count.
4. Try removal before disavow on anything you or the agency actually paid for and can get taken down.
5. Disavow at domain level, only with cause — a live manual action, or a documented paid campaign. Not a tool's "toxicity score", which is a vendor's opinion dressed as a metric.
6. File a reconsideration request with the evidence attached: what happened, who did it, what you removed, what changed in your process. Reviewers are people, and honest requests get resolved faster than defensive ones.

Scaled content: the fastest route to a sitewide problem

This is now the most common way an agency damages a client, and it accelerated the moment content became cheap to generate. Google's spam policies explicitly cover scaled content abuse — producing many pages primarily to manipulate rankings — and the policy is deliberately indifferent to whether a human or a model wrote them. Volume plus low value is the offence. The tooling is irrelevant.

The tell is a publishing chart that looks like a cliff face: 40 pages in a month on a site that had 30 pages total, all following one template, all thin, most never picking up a single impression. Indexing usually breaks first — Google crawls the new URLs, decides they aren't worth storing, and quietly stops.

The damage isn't confined to the bad pages either. Enough low-value URLs and the assessment applies to the site, which is why a founder's good, hand-written service pages start slipping for no visible reason.

Fixing it is unglamorous: audit every URL published under the agency, then prune, consolidate or rewrite. Pages with no impressions and no links get removed or noindexed. Near-duplicates get merged into one genuinely useful page with the redirects wired correctly. Then you wait, because sitewide quality assessments typically refresh with core updates, and those arrive a few times a year rather than on request.

The migration that quietly deleted your traffic

A replatform or redesign is the single highest-risk event in a site's life, and it's where agencies do the most damage in the shortest time. The failure is almost never exotic. It's one of six boring things.

The good news: this is the most reversible category on the list. If you can identify what broke, fixing it restores rankings faster than any other kind of recovery, because the pages themselves never lost their standing — Google just lost the thread to them.

• Everything redirected to the homepage. Google treats a mass redirect to an irrelevant page as a soft 404, and none of the equity carries. Redirects must be page-to-equivalent-page.
• Redirect chains and loops. Old URL to interim URL to new URL. Each hop is a chance to lose the trail. Collapse them to a single 301.
• The staging `robots.txt` shipped to production. A single Disallow: / line has deindexed more sites than every penalty combined.
• Canonicals pointing at the old domain, or at staging, or at nothing.
• URL structure changed with no mapping file. If nobody exported the old URL list before launch, nobody can build the redirect map afterwards.
• Content dropped in the rebuild. New design, shorter pages, half the copy gone — and with it the reason the page ranked.

The damage Google never sees: access and ownership

Algorithmic damage is recoverable. Ownership damage frequently isn't, and it's the category founders discover at the worst possible moment — the week they decide to leave.

None of this requires bad intent, incidentally. Most of it happens because an account got created in a hurry on whichever Google login was open at the time. It's still your problem to unwind.

Here is what must be in your name, on your login, before any work starts.

• Google Business Profile — you're the Owner, the agency is a Manager. Getting ownership back from an unresponsive holder runs through Google's request process, takes weeks, and can be refused.
• Google Analytics 4 — the property lives in *your* account with the agency granted access. If the property is theirs, you lose every year of historical data when you leave, and it cannot be recreated.
• Search Console — your verification, your property. Same reasoning, plus your entire query history.
• The domain — registered to your company, at a registrar you can log into. A domain in an agency's name is leverage, whether or not they ever use it.
• The CMS and hosting — your account, billed to your card. "We host it for you" means "we can switch it off".
• The content itself — copyright assigns to you on payment, in writing. Otherwise you're renting the words on your own site.

How to check whether it already happened to you

Ninety minutes and no budget. Run these in order — the early ones rule out the expensive diagnoses.

1. Search Console → Security & Manual Actions. Nothing there means no manual penalty. This takes ten seconds and eliminates the scariest possibility.
2. Overlay your traffic chart with dates. Agency start, every launch, every known core update. The alignment usually names the culprit on its own.
3. Compare published pages to indexed pages. Coverage report versus your sitemap. Publish 60, index 12, and you have a quality problem, not a volume problem.
4. Chart referring domains by month. Healthy is a gentle climb. A vertical spike in one month, from domains you don't recognise, is a bought batch.
5. Crawl your own site. Any crawler, free tier, one run. Look for redirect chains, 404s from internal links, duplicate titles and cannibalisation.
6. Check who owns what. Business Profile owner, analytics property owner, WHOIS on your domain, admin on your CMS. Four logins, four answers.

The contract terms that prevent all six

Damage is easier to prevent in a contract than to unwind in Search Console. These clauses cost nothing to ask for, and an agency's reaction to them tells you more than the pitch did.

For what it's worth, this is how we run our own engagements: month-to-month after the first quarter, 30 days' notice, and the client keeps every asset — accounts, content, data, all of it. That's not generosity. It's the only structure that makes our guarantee mean anything, because a client who can leave any month is a client we have to keep earning. See how the SEO engagement is structured, or read what a bad agency actually costs you for the full arithmetic.

• All accounts created in the client's name from day one, agency granted access, never the reverse.
• Monthly link report listing every live placement URL. An explicit written ban on paid links and private networks.
• Content ownership and copyright assign to the client on payment.
• No migration without a pre-launch crawl, a redirect map and a rollback plan, signed off by both sides.
• A published-page cap or a quality gate, so nobody hits a volume target by shipping filler.
• Exit on 30 days' notice with a documented handover. Long lock-ins protect the agency's revenue, not your site.