How to spot SEO spam emails about your website.

How to spot one in ten seconds

Most SEO spam follows the same pattern. One or two of these signs prove nothing. Four or five together mean spam:

• You never contacted them, and the email opens with "Hi Team", "Dear Website Owner" or your domain name instead of your name.
• It comes from a free email account, or from a company you cannot find anywhere else.
• It says they were "checking your website" or "came across it" and found problems.
• It quotes exact-looking numbers, such as 37 errors or page 9, with no screenshot, no page addresses and no source.
• It promises results by a date: page one, top three, more traffic, more calls.
• It asks you to reply YES, send your budget or book a call before it tells you anything specific.
• It ends with "If you are not interested, just reply NO".

Google's own page on hiring an SEO tells you to be wary of firms and consultants that email out of the blue. That is the right default. A real problem with your site rarely arrives as a cold email from a stranger.

A typical email, taken apart

This one is made up, but every line in it is common. The claim first, then what it means:

• "I was checking your website and found several errors that are stopping it from ranking on the first page of Google." Nobody checked by hand. An automated tool scanned thousands of sites and filled in your domain, and "errors" is never defined.
• "Your site has 37 broken links and 112 missing meta tags." Crawl tools count everything they can, including links to other sites that have moved and tags Google does not use. Google says, for example, that it ignores the keywords meta tag entirely. Some items may be worth fixing. None is urgent because a stranger counted it.
• "Several of your pages are not indexed by Google." Some pages should not be, such as thank-you pages and ad landing pages. We keep landing pages for ads out of search on purpose, so they do not compete with your main pages.
• "Your website is not mobile friendly and loads too slowly." Check it yourself, on your own phone and in PageSpeed Insights, as below.
• "You are not on page one for your main keywords." Which keywords? Search Console shows the searches you really appear for, and where.
• "We promise first-page rankings within 30 days." Google says nobody can promise a number one ranking, and that it does not accept payment to rank a site higher. This is the clearest sign of all.
• "Google recommends our services." Google says it does not evaluate third-party SEO services, and its page on hiring an SEO warns against anyone who claims a special relationship with Google.
• "Reply YES for a free audit." The audit is the same automated report, sent to start a sales conversation.
• "Our affordable packages include link building and directory submissions." Google warns against SEOs who talk about link popularity schemes or submitting your site to thousands of search engines.

Check the claims in Search Console

Search Console is free and shows what Google itself sees. If you do not have it yet, set it up first, in the business's own Google account. Then look at five reports:

• Pages, under Indexing: are your main pages indexed? If some are not, the report gives a reason for each, and why your website is not on Google explains what the reasons mean.
• Performance: the searches you appear for, your clicks and your average position. This answers "you are not on page one" with real numbers.
• Manual actions: this should say no issues detected. If a person at Google had found spam on your site, it would be listed here.
• Security issues: this should say no issues detected too. Hacked content or harmful software would show here.
• Core Web Vitals: how fast your pages are for real visitors using Chrome. A small site may show no data at all, because there are too few visits to measure.

If all five look normal, the email was wrong about the things that matter, and you can delete it.

Google sends real warnings about manual actions and security issues to the site's verified owners, through Search Console. If an email claims to be one of those, do not click its links. Open Search Console yourself and look.

Check the speed and mobile claims

Open PageSpeed Insights, paste your home page address and run it. Two parts of the result matter:

• The top part shows what real visitors experienced over the previous 28 days, where Google has enough data from Chrome users. This is the part that reflects your customers. A small site may have none.
• The score below comes from a test on a simulated phone over a fixed network. Google notes that these results vary from run to run, so a mobile score in orange or red does not by itself mean customers are kept waiting.

Then do the test that matters most. Open your site on your own phone, on mobile data, away from the office wifi, and tap the phone number and the main button. If the page loads quickly and both work, "slow and not mobile friendly" was noise.

PageSpeed Insights explained goes through the rest of the report. Speed is still worth fixing where it is truly poor. Our Care plan includes checking that the site is up and fast, and fixing it if not; the prices page has the details.

Broken links and missing tags, in order

Crawl reports list hundreds of small items. Sort them by what a customer would notice:

• Fix now: a broken link in your menu, a link to one of your own pages that no longer exists, a form that does not send.
• Fix when you next edit the page: a missing description on a main page, images with no text description, one page title used on several pages.
• Ignore: links from an old blog post to sites that have moved, and tags Google says it does not use.

For search, the list that matters is the one Google keeps. Search Console's Page indexing report shows the pages Google tried to fetch and found missing or broken.

One check, start to finish

A practice manager at a dental clinic gets the email above. Here is what checking it looks like:

• Pages: the home page, the treatment pages and the contact page are all indexed. The pages not indexed are a thank-you page and two old addresses that now redirect.
• Performance: the practice appears for its own name and for searches like "dentist" plus the town, in the top few positions, with clicks every day.
• Manual actions and Security issues: no issues detected.
• PageSpeed Insights: not enough real-visitor data, and on the manager's own phone the site opens quickly on mobile data.
• One real find: the menu still links to an old team page that now shows an error.

The verdict: delete the email, and fix the menu link.

When the spam is right by accident

A cold email can be right now and then, because the scanner behind it looks for real things. A noindex left on after a launch, an expired security certificate or a contact form that has stopped sending are all things a tool can spot.

So run the checks above once, then fix what is real, yourself or with whoever looks after your site. Being right about one thing does not make the sender the right person to hire.

Other emails that look like they are about your website

• Domain renewal notices from a company you do not use. They look like a bill for your domain and are really an offer to move it to them. Check the renewal date in your own registrar account and ignore the rest.
• Calls or emails saying your Google Business Profile will be removed or stay unverified unless you pay. Google says a Business Profile costs nothing to create or manage. Sign in yourself and look at its status.
• Copyright complaints about an image on your site, with a link or an attachment as proof. Open neither. If you are not sure where an image came from, ask whoever built the site.
• Guest post and link swap requests. Google warns that link schemes can break its spam policies. Delete them.
• Audits saying your business is invisible in AI search. Google says no third-party tool has access to its internal ranking or AI systems, and how a local business shows up in Google's AI answers covers what does matter.
• Threats to post bad reviews unless you pay. That is extortion: do not pay, and report it to Google, as our guide to replying to reviews explains.
• Warnings that your site is down or its security certificate has expired, from someone who is not your host. Open the site in a browser. Your host or website platform sends the real alerts.

What a real warning looks like

Real warnings come from companies you already pay and tools you already use: Search Console, your hosting company, your domain registrar, your website platform. They name the page or the service, they never ask you to reply YES, and you can confirm them by signing in to your own account instead of clicking a link.

That one habit protects you from everything above. When an email worries you, close it, open the service yourself and look.

What to do with them

• Do not reply, not even to say no. A reply tells the sender that someone reads that address.
• Mark the email as spam, so your email provider filters the next one.
• Do not open attachments or click links in it.
• If a claim worries you, check it in Search Console, or forward it to whoever looks after your site with one line: is this true?
• Keep your domain, hosting and Search Console logins in the business's own name, so you can check any claim without asking anyone.

Every site we build has its domain, hosting and accounts in the client's name, as the websites page says, so you can check a claim like this yourself in a few clicks.

If you do want help with search

Some businesses do need help, for example after a botched redesign, a hacked site or a move to a new domain. Google's page on hiring an SEO suggests asking for examples of previous work, whether they follow Google Search Essentials, and what results they expect and by when. It also warns against firms that are secretive or will not explain what they intend to do. Add these questions of your own:

• What exactly will you change on my site and my Google profile?
• Where will the numbers in your reports come from? Search Console is the answer you want.
• Who will own the accounts, and anything you create for us?
• What happens if we stop paying?

Be wary of anyone who promises rankings, claims a special relationship with Google or offers to submit your site to Google for a fee. And if the site needs rebuilding rather than tuning, start by checking what already brings visitors, as a website redesign should.

A note for your team

Whoever reads the shared inbox needs the same rules. A short version to pin up:

• We never pay an invoice for a domain, a listing or SEO from a company we have not hired.
• We never give a login or a code to someone who calls or emails about the website.
• Anything about the website goes to the person who looks after it, and nobody replies to the sender.
• A message saying the website or the Google profile will be removed today is a scam until someone checks.