Is a competitor sabotaging my SEO, and what do I do about it right now?

What negative SEO is, and why it cannot wait

Negative SEO is a competitor trying to push your business down the results instead of pulling their own up. The best-known form is link spam aimed at you: someone buys a few thousand junk links pointing at your site, with anchor text like “cheap roofing” or worse, so that Google reads them as yours. The rest of the family goes after the things Google trusts you to keep true — your profile, your reviews, your own pages, your ad account — and for a local business those are the ones that bite first.

None of it is expensive to do, and all of it compounds. A link burst is built to make your profile read like a campaign you paid for, and Google’s own guidance for the disavow tool names that as the case to act on: a considerable number of spammy, artificial or low-quality links that have caused a manual action or are likely to. A manufactured burst aimed at your site is that case, and a manual action, once issued, is lifted in weeks to months, not days — so the removals and the file go out the week the burst appears. An edit that marks you closed stops the phone the afternoon it goes live. A fake review sits at the top of your profile for every customer comparing two contractors tonight. A hacked page earns a warning label that empties your traffic before you have noticed the page exists.

So the job has two halves: a watch that sees each of these within days, and a set response for each that you run the same week — not after the next ranking report.

The seven ways a competitor plays dirty

These are the ones that turn up for home service businesses, roughly in the order you will meet them.

1. The link blast. Hundreds or thousands of links from sites you would not open at work, all in a week, all with the same anchor text, built to look like a scheme you paid for. Google’s spam policies define link spam as links created primarily to manipulate rankings, and the bet is that its systems will pin them on you. It shows in a backlink tool as a spike in new referring domains — which is why the tool’s alert has to be on.
2. The fake removal request. The quieter cousin: an email to the sites that genuinely link to you — the supplier, the association, the local paper — in your name, asking for the link to come down. Good links removed hurt more than bad links added, and they do not come back on their own. The tell is a link you earned appearing in the lost-links report.
3. Fake reviews. One-star reviews from accounts with no other activity, describing a job you never did, often three or four in a week. They cost you the average and, worse, the click: a customer comparing two roofers in the map pack reads the newest reviews first. Google removes reviews that break its policies — fake engagement is one — not reviews that are merely unfair, so the report has to name the rule.
4. Edits to your Business Profile. Anyone signed in to Google can suggest an edit to any place on Maps. A malicious one marks you permanently closed, moves your pin, swaps your phone number for theirs, or changes your primary category to something you do not do. The profile shows accepted suggestions as updates for you to review, and an update nobody reviews stands — the phone simply goes quiet. The same tool builds a second listing with your name and a stranger’s number.
5. Your pages, copied. Your service pages scraped and republished on another domain, sometimes with the business name swapped. Google’s policies call it scraping, and a copy on a stronger domain can outrank a newer site for its own words until someone makes it stop.
6. The break-in. Often not a competitor — an automated attack on an unpatched plugin — but the result is the same: pages you never wrote, selling pills or handbags, under your domain, and a warning label in the results. Google calls it hacked content and reports it in Search Console’s Security issues report. It is the one item on this list that can take a site out of the results altogether.
7. Draining the ads. Clicking your ads until the daily budget is gone by nine, so the real customers at ten see the competitor’s ad instead. Google filters invalid clicks automatically and does not bill for what it catches; what slips through shows as a run of clicks from one place with no calls behind them, and it repeats every morning until you act.

Only one of the seven is about links, and only one is about the site’s code. Five are about the places outside your site where Google learns who you are — which is where most owners never look.

The watch: what to monitor, and how often

You cannot stop a stranger from trying any of the seven. You can make sure every one is seen within days instead of months, and the setup takes an afternoon.

• Links — on alert, and monthly. One backlink tool (Ahrefs, Semrush, Moz, or the DataForSEO data behind our own audit) with its new-links alert on, so a burst lands in your inbox the week it starts, and its lost-links view read at the same time, so a good link that vanishes is noticed. Search Console’s Links report exported once a month so you have a dated history, and its email alerts on, so a manual action or a security issue reaches you the day it is issued.
• The profile — weekly. Notifications on in the Business Profile, and a five-minute look every week regardless: name, category, hours, phone, address, the closed flag. Then your business name searched on Maps, for a second listing.
• Reviews — the day they land. Every new review read and answered the day it arrives. A fake one is easiest to spot next to the real ones, and hardest to leave sitting.
• The site — always, and monthly. Uptime monitoring, so a defaced or offline site pages someone within minutes. Once a month, a site:yourdomain.com search on Google, scrolled to the end, for a page title you do not recognize, and a distinctive sentence from your main service page searched in quotes, for a copy.
• The ads — every morning the budget is gone early. The Invalid clicks column added to the campaign table, and the click log read the first day the money runs out before lunch.

Add a Google Alert on your business name in quotes, which catches a fake listing, a copied page and a forum thread about you in one feed. And keep the log from the first odd link: a folder with the monthly exports, screenshots of anything wrong, and every report you file with what came back. It is the evidence for every step that follows.

If the links pile up: act the week it starts

A manufactured burst is not a wait-and-see. Google’s own guidance for the disavow tool draws the line at a considerable number of spammy, artificial or low-quality links that have caused a manual action or are likely to — and thousands of exact-match links from link networks, pointed at a business that never bought one, are the kind of burst that clause exists for. The time to build the file is when the burst is fresh and the dates prove it was not yours, not after a manual action has already cost you a season.

The order, in one week: export the burst from the tool with first-seen dates into the log. Check Security & Manual Actions so you know where you stand. Sort the new domains: the networks and the sites that exist only to link go on the disavow list by domain (domain:example.com), because a network that linked from one page will link from another; a real site that was tricked into linking gets an email asking for removal, with the date kept. Upload the file in Search Console — it replaces whatever was there, so keep a copy — and put the manual actions report on the calendar for every month after. If a manual action does arrive, you file the reconsideration request with the dated burst as your evidence and the work already done. The mechanics, line by line, are in the backlinks post.

Be precise, not broad: a real link disavowed in the rush stops counting, and the local paper, the supplier and the chamber are worth more than the whole burst could cost you. That is why the list is read by hand, domain by domain, and not exported straight from a tool’s red column.

The fake removal request is handled by phone, today. Tell the handful of sites whose links you actually care about — you know them, and there are rarely more than ten — that you never ask for a link to be removed by email, and that they should call you if they get one. A lost link that mattered can usually be put back by the same person who took it down, once they know they were lied to.

If it is the profile or the reviews: the same day

An edit you did not make: reject it from the profile’s updates the day you see it, put the correct value back, and if the profile is asked to re-verify, do it before you close the laptop — a profile that sits unverified is one Google stops trusting, and one your customers cannot call. A second listing with your name and someone else’s number, or a listing renamed to keyword soup to outrank you: Google’s Business Redressal Complaint Form exists for exactly that — misleading information or fraudulent activity on Maps involving a business’s name, phone number or URL — and it takes screenshots and the listing’s link.

A fake review: report it from the profile’s review management tool the day it lands, choosing the policy it breaks — fake engagement, off-topic, conflict of interest. The tool shows the status; if Google finds no violation you get one appeal, so make it with facts, not feelings. While that runs, reply in public, once, calmly: no record of this job, glad to make it right if it is real, here is the number. The customers reading the exchange are deciding about you, not the reviewer. The reviews post covers what Google will and will not remove.

Then the defense that outlasts any report: keep asking every finished job for a review, so a fake sits under a week of real ones instead of on top of a profile that has not moved since spring. Pace beats the average, and the pace is the one thing a competitor cannot fake for you.

If it is the site itself: pull it now, then fix it

A hacked site is an emergency the moment the first spam page is indexed: pull it to a backup taken before the hole was used, change every password and key, close the plugin or account that let them in, and check for a second door before it goes back up. Then, in Search Console, the Security issues report: fix everything it lists, on every page, and select Request Review with a plain description of what was wrong, what you did and how you checked — Google’s guidance is that a good request explains the issue, the steps and the outcome, and that the review takes time, which is one more reason not to lose a day at the start. A site on managed hosting with daily backups, an edge in front of it and nothing to patch is the site this does not happen to; a site on a shared server with eleven plugins is the one it does.

A copied page: Google’s Report Content for Legal Reasons form takes a copyright removal request against the copy, and the copier’s hosting company has a copyright address that usually acts faster than Google does. Keep your own page unmistakably the original in the meantime — a canonical tag, a publish date in the schema, an author strip. Someone crawling your site hard enough to slow it is a hosting question, answered by rate limits at the edge the same day.

When it stops being an SEO problem

A review that states a false fact about a named person or a specific job, a listing built to impersonate you, an email sent in your name to your partners — those are not ranking questions, and the forms above may not be the end of them. That is a lawyer’s letter, and the lawyer will ask for the log: dates, screenshots, the reports filed and their outcomes. Which is why the log starts with the first odd link, not the day you decide to call.

One caution. Handle each event by its own report, keep the log, and let a pattern accuse someone — never a hunch, and never in public. The link blast is sometimes an untargeted spam network hitting every site in a category; the fake review is sometimes a customer of a similarly named business. Act on the event immediately; name a competitor only with proof. Naming one without it is the one move here that can cost you more than anything they did.

What we do about it for clients

For the businesses on our SEO layer — and for anyone who buys the backlink audit on its own — the watch above is the work, not an add-on: every referring domain read by written rules and the ones that need action listed with the reason, in tiers; a burst of manufactured links documented by the month it appeared and checked against the manual actions report, so the evidence exists the day it is needed; the removal requests sent with a dated log, the disavow file by domain for what stays up — written while the dates still show what happened and uploaded on your decision — and the reconsideration request when Google has already acted. The weekly digest reads the Business Profile and the new reviews and drafts the replies for the owner to post, so a change or a fake is caught the same week it lands. Hosting and care is the other half: edge hosting with nothing to patch, daily backups with a one-click restore, uptime monitoring that finds out before you do, and a traffic dashboard on your own domain where a burst of crawler traffic or paid clicks shows the day it starts. If your rankings have already dropped and you do not yet know why, the rankings post is the diagnosis, and this one is what to do when the answer turns out to be someone else.