8 Signs Your Link Building Is Not Actually White-Hat

Why this question matters right now

Two days ago we published a post arguing that guest posting still works in 2026. It does, when real people write real articles for real publications. This post is the flip side of that argument. Most agencies selling "white-hat link building" have never read the policy page that defines the term. We have, and we briefed our own clients on the latest changes, so let us save you the reading.

Here is the timing. Google's September 2026 spam update finished rolling out on October 8, 2026. That makes 4 spam updates this year, the busiest spam-fighting year since 2021. Now the detail most providers get wrong: the August 2026 update did not touch link spam at all. Google handles links continuously through SpamBrain, its machine learning system, rather than waiting for a named update. A provider telling you "no link spam update this year, so links are safe" does not understand how this works.

So what does "white-hat" actually mean? Google's link spam policy says it plainly. Link spam is creating links to or from a site primarily to manipulate search rankings. White-hat is everything on the other side of that sentence: links earned because an editor wanted your content, because a resource page genuinely recommends you, because a real site found your article worth citing.

You do not need to be an SEO to spot the fakes. Here is how to tell if link building is white hat: 8 signs.

What Google's policy page actually lists

Before the signs, the source. Google's spam policies page enumerates the link practices it treats as violations. Paraphrased in plain language, the list covers buying or selling links for ranking purposes, excessive reciprocal link exchanges, automated programs creating links at scale, paid articles (including guest posts and press releases) whose links pass ranking credit or use optimized anchor text, low-quality directory and bookmark-site links, keyword-rich links embedded in widely distributed widgets, forum comments and signatures carrying optimized links, and low-value content created mainly to manipulate linking signals. That last one is the policy description of a private blog network.

There is also a safe harbor, and it matters for everything below. Paid, sponsored, and advertising links are not a violation when they carry rel="nofollow" or rel="sponsored". That one line is the difference between a legitimate paid placement and a scheme. Remember it.

Sign 1: They sell links by the dozen with fixed per-link pricing

Real links are not inventory. Each placement requires prospecting a site, pitching an editor, writing or placing content, and following up, and the cost of that work varies with the site's authority and the effort involved. A price list that reads like a restaurant menu, 10 links for this much, 50 for that much, tells you the provider is buying or selling links as commodities. Google's policy names buying or selling links for ranking purposes as a violation, and it explicitly includes money paid for links or for posts that carry links, goods or services traded for links, and products given in exchange for a write-up with a link.

Ask one question: "What happens if an editor rejects the pitch?" A white-hat provider has an answer, because editors reject pitches all the time. A link seller will look confused, because in their model there is no editor. When we review a prospect's backlink profile before starting work, over-optimized anchors are the single most common red flag we find, and the most common reason sites stall after a cheap campaign.

Sign 2: Every placement carries exact-match keyword anchors

Look at a sample report. If every link uses your money keyword as anchor text, "best plumber in Leeds," "cheap car insurance quote," repeated across dozens of sites, you are looking at optimized anchor text inside paid placements. Google's policy singles this out: advertorials and paid articles whose links pass ranking credit or carry optimized anchors are a violation, and it explicitly names guest posts and press releases distributed on other sites in that category.

A natural link profile is messy. Editors link with brand names, bare URLs, generic phrases like "this guide," and occasionally a descriptive phrase.

Sign 3: They cannot show you the actual sites beforehand

Ask for the list of sites where your links will appear. A legitimate provider shows you. A shady one deflects: "our network is confidential," "we reveal after placement," "proprietary publishers." There is a reason for the secrecy. Google's policy covers low-value content created primarily to manipulate linking and ranking signals. That is the policy description of a private blog network, sites built to host paid links, dressed up with stock photos and generic content.

The secrecy test is simple. Real publications want to be seen; their traffic, their readership, and their editorial standards are their selling points. Sites built to sell links cannot afford that scrutiny, because anyone looking closely would see thin content, no real audience, and outbound links to hundreds of unrelated businesses.

Sign 4: "Guest posts" appear on sites that have nothing to do with your industry

A dental clinic featured on a site about cryptocurrency. A law firm on a pet blog. A roofing company on a fashion magazine. This is the relevance gap, and buyers underestimate how much it matters. Google's 2024 site reputation abuse policy penalized major publishers like Forbes Advisor, CNN Underscored, and WSJ Buy Side for hosting third-party content that exploited the host site's ranking signals. The logic applies down the food chain: a link from an irrelevant site is a signal that the placement exists for rankings, not readers.

This does not mean every link must come from your exact niche. A business article can legitimately appear on a general news site. The test is whether a human reader would find the article normal. If the site's topic and your business would never appear in the same conversation, the link is there for one reason, and Google's systems are built to notice exactly that.

Sign 5: They promise a set number of links per month, like clockwork

Twenty links a month, every month, guaranteed. Real outreach does not work on a production schedule. Editors reply when they reply. Some months produce 8 placements, some produce 3, and some pitches die in inboxes. A fixed monthly quota means the provider is either buying placements outright or running automated programs that create links at scale, another practice Google's policy names directly.

The quota model also warps incentives. When a provider must hit 20 links, links 17 through 20 come from wherever is easiest, which is how campaigns end up with directory profiles and forum signatures padding the report. If your provider guarantees volume instead of effort, the volume is the product, and you are paying for the appearance of link building.

Sign 6: Their reports show directories, bookmarks, and forum profiles as "link building"

Open the monthly report. If it is padded with directory submissions, social bookmarking sites, and forum profile links, you are looking at two more items from Google's violation list: low-quality directory and bookmark-site links, and forum comments with optimized links in the post or signature. These are the techniques that stopped working over a decade ago and never came back.

To be fair, foundational links have a place. Profiles, directories, comments, and forums are legitimate when they are real: an actual business listing, a genuine community profile, a comment that adds something. The difference is intent and quality. A hundred auto-submitted directory links with identical descriptions is not a foundation; it is the exact pattern Google's policy describes.

Sign 7: They offer "link exchanges" or three-way swaps as a core tactic

"You link to us, we link to you" is one of the oldest schemes in SEO, and Google's policy names excessive reciprocal link exchanges directly. The three-way swap, where site A links to site B, B links to C, and C links back to A, is the same scheme with one extra step, designed to hide the pattern from simple detection. It does not hide it from SpamBrain.

Natural reciprocal links exist. Two businesses in the same industry sometimes link to each other because both resources are genuinely useful. The policy targets the excessive, systematic version: partner pages that exist solely for cross-linking and exchange programs run as a service. If "link exchange" appears in the sales pitch as a feature rather than an occasional accident, the provider is selling you a named violation.

Sign 8: No mention of nofollow or sponsored on anything paid

This is the simplest test in the post, and the most revealing. Remember the safe harbor: paid, sponsored, and advertising links are fine when qualified with rel="nofollow" or rel="sponsored". A legitimate provider knows this line and applies it. Ask your provider: "Which of these placements were paid, and how are the links qualified?" If the answer is a blank stare, or "we don't need to do that," you have your answer.

The qualification question separates professionals from amateurs more cleanly than any other. A white hat link building provider has a link policy and can state it. They know which placements were earned editorially (followed, because the editor chose to link) and which involved payment (qualified, because the rules require it). A provider with no such distinction is either ignorant of the policy or hoping you are. Neither is someone you want building your link profile.

What the white-hat version actually looks like

Here is what legitimate link building looks like in practice, because we do it every day. It starts with manual outreach: real people prospecting real sites, pitching editors with article ideas tailored to their readers, and writing content the publication would accept even without a link in it. The core tactics are the ones Google's guidelines leave untouched: guest posts on relevant publications, niche edits placing links into existing articles where they genuinely add value, and resource-page links earned by having a resource worth listing.

The process is transparent. Outreach goes from the client's own brand email, which gets better response rates and means the client can see every pitch and every reply. Reports show the actual sites, the actual articles, and the actual links. Authority has a bar: placements target sites at DR 70+, DA 50+, and solid TF/CF metrics, not the highest number of links for the lowest price. And there is accountability: our authority packages carry a 3-month replacement guarantee, because links occasionally drop and a provider should stand behind the work.

We have been in SEO since 2013, follow Google's policies as a matter of practice, and refuse adult niches outright. The track record: 300+ Upwork jobs, a 100% Job Success Score, $200k+ earned on the platform, 500+ clients, 2,200+ websites worked on, and a team of 15.

The next frontier: paid mentions in AI search

One more thing, because the policy page keeps moving. In May 2026, Google rewrote its spam policies to cover attempts to manipulate generative AI responses in search, meaning AI Overviews and AI Mode. SEO analyst Lily Ray has flagged the open question that follows: paid brand mentions and reciprocal mention schemes designed to get brands cited by AI answers, the way manipulative links once targeted classic rankings.

Treat that as an emerging debate, not settled policy. Nobody knows what enforcement will look like, or when. But the pattern is familiar. Every time Google closes a manipulation channel, the market invents a new one, and the providers who read the policy page stay on the right side while the ones who sell shortcuts scramble. The 8 signs above will age better than any tactic, because they are about the provider's relationship with the rules, not the rules' current wording.

FAQ

Is all paid link building against Google's guidelines?

No. Google's policy prohibits buying or selling links for ranking purposes. Paid, sponsored, and advertising links are explicitly allowed when qualified with rel="nofollow" or rel="sponsored". The white hat vs black hat link building question always comes down to the deal, not the tactic: the violation is the unmarked deal, money changing hands for ranking credit. A provider who qualifies paid links is operating inside the rules.

Can Google actually detect paid links?

Yes. SpamBrain, Google's machine-learning spam system, evaluates link patterns continuously, not just during named updates, and manual reviewers investigate as well. The signals include unnatural anchor patterns, irrelevant source sites, footprint patterns across networks, and sudden unnatural link velocity.

What should I do if my site already has bad links?

First, stop the campaign creating them. Then audit the link profile: identify paid, irrelevant, and network links. For links you can get removed, request removal. Google's disavow tool exists for the rest, but it is a last resort, not a first step. Stop adding bad links before cleaning old ones, because a disavow filed while a scheme continues is wasted effort.

How many links per month is safe?

There is no safe number. Google does not publish a quota, and anyone selling you one is guessing. What matters is how the links were earned. Three editorial links from relevant, authoritative sites in a month is a strong month. Thirty bought links is a liability. Judge the method, not the count.

Does Google penalize the site buying links or the site selling them?

Both can be affected. The policy covers creating links to or from a site to manipulate rankings, which catches both sides of the transaction. Sites selling links can lose the ability to pass ranking credit or face manual actions; sites buying them can see the links neutralized or face penalties. The safest position is to be neither.

Is guest posting itself white-hat or black-hat?

Neither, inherently. It is a tactic, and the method decides. A genuine article written for a relevant publication that accepts it on merit is white-hat. A paid placement on an irrelevant site with keyword-stuffed anchors, published at scale, is link spam. That distinction is exactly what our earlier post on whether guest posting still works in 2026 explores in detail.

How long does it take to recover from a link penalty?

It depends on the penalty type. Algorithmic devaluation can lift as bad links are removed or disavowed and good links accumulate, which takes months. Manual actions require a reconsideration request after cleanup, and Google's reviewers decide the timeline. There is no fixed schedule, which is why avoiding the penalty is worth far more than recovering from one.

The bottom line

White-hat is not a marketing label. It is a specific, published standard: links earned for their merit, not manufactured for rankings. Every provider in this market claims the label. Now you have 8 ways to check the claim against the policy that defines it.

If your current provider fails more than a couple of these tests, get a second opinion on your link profile before the next spam update makes the decision for you. We audit backlink profiles against these exact policies, and we do link building the way the policy page describes: manual outreach, real publications, transparent reporting. Get a free SEO audit and we will show you which of your links would survive a manual review.