Google penalty: manual action, or just a traffic drop?

Traffic halved. Nobody changed anything. Someone says "penalty" and the room tenses.

Almost always, it is not one. Proving that takes half a minute in one Search Console report — our guide to Google Search Console covers the tool itself, inside the wider SEO guides hub. This page is the diagnosis: which of the eight things that look identical on a graph is actually happening to you.

Google does not use the word "penalty"

This is not pedantry — the vocabulary is the diagnosis. Google's spam policies, updated 28 August 2026, describe enforcement like this:

"We detect policy-violating practices both through automated systems and, as needed, human review that can result in a manual action."

Two machines. Only one issues anything you can see or appeal.

When people say "we got penalised by an update", they mean the right-hand column. Nothing was issued against them — their pages were re-sorted. A real problem, but a different one, and the fixes do not overlap.

One branch of eight.

Check the Manual actions report first — it takes thirty seconds

Do this before anything else. It is the one check that gives a definite yes or no.

1. Open Search Console and pick the property matching your live site — right protocol, right www variant.
2. In the left menu, under Security & Manual Actions, click Manual actions.
3. Read it. "If your site has no manual actions, you'll see a green check mark and an appropriate message."
4. Open Security issues too. Malware and phishing warnings suppress traffic identically on a graph.

A green tick is the common result. No human at Google has acted against your site, so penalty theories are off the table.

If something is listed, Google is blunt: "If a site has a manual action, some or all of that site will not be shown in Google search results." Skip to the manual action section below.

One trap. Google names property mismatch as the top cause of traffic that only looks missing: "Mixing up http and https is probably the most common reason for 'missing' search traffic." If every report looks empty, check which property you are in (Search Console Help).

The differential: eight things that look like a penalty

With the report clear, you diagnose by symptom. Where the drop shows up narrows it faster than any tool.

Google's traffic-drop debugging guide, updated 10 December 2025, groups the same causes by the shape of the line, and gives logging errors their own category. That log is real: Google recorded an error reducing impressions between 13 and 17 August 2026, restored days later (Data anomalies).

Some rows have their own pages. Clicks falling while impressions hold is the zero-click search pattern. A launch-shaped collapse sits in website redesign SEO and 404 errors. For the technical row, robots.txt and crawl budget are where a folder vanishes quietly; technical SEO is the full picture.

The order we check things in

First-hand, from our own client work. When a client messages us about a traffic drop, we do not start with rankings. We start with whether the drop exists. This is the sequence, in order, and we rarely get past step three.

1. Is it a real drop, or did the tracking break? We put GSC clicks next to analytics sessions for the same dates. If one line fell and the other did not, the problem is measurement. This is the most common answer, and almost nobody checks it first.
2. Manual actions and Security issues. Thirty seconds. Clears the scariest possibility or defines the whole project.
3. Whole site or one section? Page indexing report, filtered by folder. Site-wide points at updates, migrations or tracking. One folder points at something a developer shipped.
4. What changed on our side, and when? Deploy log, plugins, theme, CDN rules — matched against the first day the line moved. Dates do most of the work.
5. What changed on Google's side? A confirmed update in that window means we stop guessing at technical causes.
6. Only then, content and competitors. Read the pages that lost most, next to whoever replaced them.

Steps one to four take under an hour. A dated change log is what makes step four possible — the real reason rank tracking and honest SEO reporting earn their keep. If the drop is real and site-wide, the structured version is the SEO audit checklist.

If the report is not empty: the manual action types

Google documents these in the Manual actions report. Yours will name one or more.

Two notes for Indian site owners. The site reputation policy is live here: Google's spam policies state that "the relevant pages may be subject to a manual action when they appear in Search results shown to users outside the EEA." India is outside the EEA, so a rented-out subfolder is enforceable against you. And a links action needs real cleanup, not a disavow file dropped in and forgotten — see toxic links and disavow, and link building.

Note what is absent: there is no manual action for AI-written content. Google's policy targets scaled, low-value output however it was made — see does Google penalise AI content.

The reconsideration request, described honestly

A reconsideration request only applies with a manual action or security issue. With a clean report there is nothing to file.

1. Expand the action to see the patterns of affected pages. Google warns that not every matching page is necessarily affected.
2. Fix it everywhere. Google is explicit: "Fixing the issue on just some pages will not earn you a partial return to search results."
3. Confirm Google can reach the fixed pages with URL Inspection. A fix behind a block cannot be verified.
4. Write the request. Google asks you to explain the quality issue, the steps you took and the outcome. Sample URLs and dates. No padding.
5. Wait. "Most reconsideration reviews can take several days or weeks." Link-related requests may take longer. Do not resubmit before you get a final decision.

The part nobody enjoys hearing: a request without real remediation behind it fails, and costs you the waiting time twice. It is a report of work completed, not a plea. Google publishes no timeline for traffic returning after an action is lifted, and neither should anyone else.

Core updates: there may be nothing to fix

Google's traffic-drop guidance says it directly: "it's important to understand that there might not be anything fundamentally wrong with your content." Core updates are "broad in nature, and don't target specific sites or individual web pages."

On recovery, Google's core updates documentation says: "there's no guarantee that changes you make to your website will result in noticeable impact in search results." Where they do help, "some changes can take effect in a few days, but it could take several months for our systems to learn and confirm."

Size decides whether to act. Google separates a small move — its example is position 2 to 4 — from a large one, dropping from the top 10 to position 29. For the small case it says there is no need to take drastic action. For the large case, assess the site as a whole, and avoid quick fixes.

Anyone selling a guaranteed core-update recovery is selling something Google does not offer. Update behaviour and a considered response are a subject of their own — see Google core updates.

What a clean diagnosis buys you

The expensive mistake after a traffic drop is not slow recovery. It is confident action on the wrong cause.

Teams rewrite a hundred pages when a consent banner broke the analytics tag. They buy a disavow service with no links action. They chase a seasonal dip that reverses next month.

Thirty seconds in one report, then an hour with a differential, stops all of that. You get a named cause and a decision you can defend — or the useful finding that nothing is wrong and the market moved.