How to Check if a Website Has a Google Penalty Before You Buy It

A penalised site looks exactly like a healthy site from the outside. The design is fine, the articles read well, the backlink profile might even look strong. The only difference is that Google has decided not to rank it — and that decision transfers to you along with the domain.

Worse, sellers routinely list sites because they've been hit. A site that lost 70% of its traffic six months ago is a liability the current owner would very much like to convert into cash. This article shows you how to find out before you wire the money.

Two Very Different Problems

People say "penalty" to mean two completely different things, and the distinction matters enormously for what you're buying.

Manual actions are a human reviewer at Google deciding your site violates the spam policies. They are explicit: there's a report in Search Console naming the violation. They're also, in principle, fixable — you clean up the problem and file a reconsideration request.

Algorithmic suppression is a core update or spam system deciding the site is low quality. Nobody tells you. There's no report, no notification, no reconsideration request to file. The site just stops ranking, and it may never come back. Since Google folded its helpful-content system into the core ranking algorithm, these hits have become both more common and harder to recover from.

Here's the uncomfortable part: algorithmic hits are more dangerous to a buyer than manual actions. A manual action for unnatural links is a known problem with a known remediation path. A site that quietly lost 60% of its traffic to the March 2026 core update is a site Google has classified as not worth ranking, and you have no ticket to appeal.

You need to check for both.

Step 1: Get Read-Only Search Console Access

There is no substitute for this, and no legitimate reason to refuse it.

Ask the seller to add your Google account as a restricted user in Search Console. Restricted access is read-only — the seller keeps full control, and you can't change a single setting. It takes them about 20 seconds:

1. Search Console → Settings → Users and permissions
2. Add user → your email → permission level Restricted

If the seller offers screenshots instead, decline. A Search Console screenshot is a PNG; a PNG is an image file; an image file can say anything. The same logic applies here as with revenue dashboards — you verify inside the live account or you don't verify at all.

If the seller says they never set up Search Console, treat that as a finding in itself. A site earning real money from organic search whose owner never opened Search Console is either being managed by someone else, or the owner is not who they claim to be, or the property was deliberately removed to hide something. Ask them to add the property now and wait a few days for data to populate — Search Console backfills roughly 16 months of history once verified, so you will still see the past.

Step 2: Read the Manual Actions Report

Once you have access, go to Security & Manual Actions → Manual actions.

You want to see: "No issues detected."

If there is an issue, it will be named. The ones you'll actually encounter when buying content sites:

A manual action does not automatically kill a deal, but it must be priced in. Recovery from an unnatural-links action typically takes three to six months of link auditing, disavowing, and reconsideration requests — and the reconsideration may fail on the first attempt. If the seller knew about the action and didn't disclose it, that's a much bigger problem than the action itself.

Check the partial vs. site-wide scope. Manual actions can apply to the whole site or to specific URLs. A partial match affecting 12 low-traffic pages is a very different asset from a site-wide demotion.

Step 3: Check the Security Issues Report

Still under Security & Manual Actions, open Security issues.

This catches hacked content, malware, and social engineering flags. A site that was hacked and cleaned up will often show a resolved issue here, which is useful history: it tells you the site has had security incidents, and it gives you a specific date to cross-reference against the traffic graph.

An active security issue on a site being sold is a red flag about the seller's competence at minimum. Never complete a purchase while one is open.

Step 4: Overlay Traffic History on Google Update Dates

This is where algorithmic hits show up, and it's the most important step in this whole process.

In Search Console, open Performance → Search results, set the date range to Last 16 months, and switch on both Total clicks and Total impressions. Export to CSV if you want to work in a spreadsheet.

Now compare the shape of that graph against the dates of Google's confirmed updates:

Always confirm current dates against the Google Search Status Dashboard, which is the authoritative source and lists every confirmed ranking update with its start and end times.

What you're looking for:

• A cliff that starts inside a rollout window and never recovers. This is an algorithmic hit. The site was reassessed and downgraded. Treat the post-drop traffic level as the real baseline — not the pre-drop peak the seller is pricing from.
• A staircase down across multiple updates. Worse than a single cliff. It means the site is being progressively devalued, and the next core update will likely take another slice.
• A drop that does not align with any update. This is often more mundane and sometimes better news: a site migration, a lost backlink, a technical failure, or seasonality. Ask the seller what happened on that date and verify their explanation against the other evidence.
• Recovery after a drop. A site that fell in one update and regained ground in a later one is genuinely reassuring — it shows the underlying quality signals are acceptable.

The specific scam to watch for: a site gets hit in, say, the December 2025 core update. Traffic is down 65%. The seller waits until the graph flattens out at the new low level, then lists the site showing "6 months of stable traffic." Stable, yes — stable at a third of what it was. If the seller only shows you a 6-month window, that is why they only showed you 6 months. Always pull the full 16 months.

Step 5: Look for Silent Suppression in Indexing

Go to Indexing → Pages.

You're checking whether Google is actively choosing not to index the site's content. Pay attention to these statuses:

• Crawled – currently not indexed — Google fetched the page and decided it wasn't worth including. A handful is normal. Hundreds of pages, on a site whose content is supposedly the asset you're buying, is a quality verdict.
• Discovered – currently not indexed — Google knows the URL exists and hasn't bothered to crawl it. At scale, this signals low site-level trust.
• Duplicate without user-selected canonical — often points to the content problems covered in how to evaluate content quality.

Compare the number of indexed pages against the total number of published articles the seller claims. If they say 400 articles and Search Console reports 160 indexed, you are buying 160 articles, and you need to understand what's wrong with the other 240.

Cross-check with a site:domain.com search on Google. The result count is a rough estimate, not a precise figure, but a dramatic mismatch is informative.

Step 6: Check the Domain's Penalty History

A clean Manual Actions report today doesn't prove the domain has always been clean, and past penalties leave traces that affect how quickly the site can grow under your ownership.

• Search Console message history — in the property, check the notifications/messages area for previous manual actions that were resolved. This is the single clearest record of whether the site has been penalised before.
• Ahrefs or SEMrush organic history, maximum date range — drops predating your 16-month Search Console window will show up here. A site with three separate collapses over five years has a pattern, and the pattern will continue.
• Wayback Machine — if you find an unexplained historical drop, look at what the site looked like immediately before it. Often you'll find the period when it was stuffed with doorway pages or a link-selling footer.

This step pairs directly with the domain's broader history: see how to verify a domain's real age and how to check if a domain was used for spam. A domain with a spam past and a penalty history is the same story told twice.

What to Do With What You Find

Quick Reference Checklist

Before you move past this item:

• Read-only Search Console access granted and verified in the live account
• Manual actions report reads "No issues detected" — or the action is named, scoped, and priced in
• Security issues report clean, with any historical incidents dated
• Full 16-month Performance graph exported, not a seller-chosen window
• Every significant drop matched against the Search Status Dashboard
• Indexed page count reconciled against the seller's claimed article count
• Search Console message history reviewed for past manual actions
• Long-range Ahrefs/SEMrush organic curve checked for drops older than 16 months

This takes about 30 minutes once you have access. It is the single highest-value half hour in the entire due diligence process, because it is the one check that tells you what Google thinks of the asset — and Google's opinion is the only one that pays.