White hat and black hat SEO (and grey hat): differences, examples and risks

SEO splits into three families of practices. White hat follows Google’s guidelines to the letter: useful content, natural link building, clean technical work. Black hat openly breaks them, with methods Google explicitly names and penalises in its spam policies. Grey hat sits in between, in the space of choices the guidelines do not settle in black and white, which each consultant takes on at their own level of risk. This article covers all three, with concrete techniques, how Google detects them, and brands that got burned.

White hat, black hat and grey hat SEO: the three approaches at a glance

The line between the three categories has nothing to do with how effective a technique is, and everything to do with whether it complies with the rules Google itself publishes in its spam policies. A white hat technique can be slow and still be legitimate. A black hat technique can work for six months and still be a violation. The table below sets out the landmarks before going into each category in detail.

Approach	Principle	Risk
White hat	Compliant with Google’s spam policies: quality content, earned links, clean technical work	None, apart from an unintentional technical error
Grey hat	An area not explicitly named: expired domains, paid topical links, reworked AI content	Variable, never zero, depends on the scale
Black hat	A violation named in the spam policies: cloaking, PBNs, comment spam, mass-generated content	Demotion, deindexing, manual action

What is black hat SEO? The techniques Google explicitly bans

Black hat SEO covers the practices Google names explicitly in its spam policies, published and updated on Search Central. These are not areas open to interpretation: each of these techniques appears on a list Google has been communicating to webmasters for years.

Cloaking, doorway pages and sneaky redirects

Cloaking means showing one version of a page to Googlebot and a different version to human visitors, in order to get content indexed that nobody will ever actually see. Doorway pages work on a similar principle: near-identical pages, created in bulk to capture every variation of a query, all of which send visitors to the same destination once the click is won. Sneaky redirects send a visitor to a page other than the one shown in the results, often at the moment they click. All three techniques deceive either the search engine or the user, which puts them at the top of the list of the most severely penalised violations.

Buying links, PBNs and comment spam

Link spam covers anything that manufactures links for the sole purpose of manipulating rankings: buying links in bulk, private blog networks (PBNs) set up to link to one another, excessive link exchanges, or automated links dropped in unrelated comments and forums. Google says so plainly in its guidelines: a link should exist because it brings something to the reader, not because it pushes a page up. Before starting any link building, it is better to begin with a link audit to find out what the current profile is really worth, rather than piling links on top of an already fragile history.

Mass-generated content and hidden keywords

Scaled content abuse targets the mass production of low-value pages, written by people or generated by AI, whose only purpose is to capture traffic without genuinely meeting search intent. Keyword stuffing means repeating a term until a sentence no longer makes sense. Hidden text and links use white on white, zero-height areas or off-screen positioning to slip in content that Googlebot reads and nobody sees. These three practices have one thing in common: they speak to the algorithm rather than to the reader.

What is white hat SEO? The clean line of Google’s guidelines

White hat SEO is not one technique among others: it is the absence of any violation of the spam policies, combined with work built for the reader before the search engine. Content that genuinely answers the query, a technical structure that lets Google crawl and understand the site without obstacles, links earned because other sites find the page useful. Nothing spectacular, but it is the only approach that carries no risk of a penalty, with one exception: an unintentional technical error, such as a misconfigured redirect or a forgotten canonical tag, can hurt rankings without any intent to manipulate.

What Search Central’s spam policies cover

Search Central lists sixteen named policies: cloaking, doorway abuse, expired domain abuse, hacked content, hidden text and link abuse, keyword stuffing, link spam, machine-generated traffic, malicious practices, misleading functionality, scaled content abuse, scraping, site reputation abuse, sneaky redirects, thin affiliation and user-generated spam. A page that breaks none of them, and that also meets search intent, is automatically on the white hat side. It is a simple test to apply before launching any technique.

What is grey hat SEO? The blurred zone between the two

Grey hat SEO brings together practices the spam policies do not name explicitly, or name without banning every form of them. They do not deceive the user the way cloaking does, but they still try to influence rankings beyond what Google would naturally recommend. Most experienced consultants know this ground, and they approach it with a level of risk they choose knowingly.

Expired domains and buying sites to redirect them

Expired domain abuse is now named in the spam policies: Google penalises buying an expired domain for the sole purpose of recovering its authority and publishing content unrelated to the site’s history. The grey hat line sits one notch lower, when the purchased domain serves a genuinely new project in the same topic as the old one, or when an entire site changes hands purely for its inbound links. None of this is as clear-cut as cloaking, but none of it is free of consequences either if Google sees an intent to manipulate.

Reviewed AI content and rare topical links

The spam policies do not condemn AI-generated content as such; they condemn producing it at scale without human input. A text drafted by AI, then checked, corrected and enriched by someone who knows the subject, stays outside the scope of scaled content abuse. In the same way, buying a rare link on a site in the same sector, with content genuinely written around it, does not have the texture of a mass-produced PBN. It is precisely because these practices look like legitimate work, while still being driven by ranking manipulation, that they define grey hat rather than black or white.

How does Google detect black hat SEO techniques?

Google combines two mechanisms to spot violations: an algorithmic system running continuously, and human Quality Raters who assess samples of pages against public guidelines. Both serve the same goal: triggering penalties that range from a simple algorithmic demotion to removing the domain from the index altogether.

SpamBrain, the algorithm that neutralises links

SpamBrain is the AI-based anti-spam system Google has used internally since 2018, and whose existence was only made public in 2022. It continuously learns to recognise new forms of spam, including variants of known techniques, and it now acts at crawl time rather than after indexing. On links in particular, its approach changed the game: rather than punishing an entire domain, SpamBrain neutralises the link itself, simply by no longer letting it pass any weight, without any alert appearing in Search Console. It is a direct evolution of the logic set out by the Penguin algorithm, the first to target manipulative links rather than content.

Brands penalised for black hat SEO

Three public cases show how manipulated link building ends up being seen, even for big brands with substantial marketing budgets.

JC Penney, Interflora, Rap Genius: three ways to get caught

In February 2011, the New York Times revealed that thousands of unrelated sites were linking to jcpenney.com with highly descriptive commercial anchors, a bulk link-buying scheme that Google confirmed and penalised by demoting the site for its most competitive queries. Two years later, in February 2013, it was Interflora’s turn to vanish from the results after Google detected dozens of paid advertorials on more than 150 British regional news sites, each linking to the florist’s site. The penalty followed a post by Matt Cutts, then head of Google’s webspam team, reminding everyone that selling links that pass PageRank violates the guidelines. At the end of December 2013, Rap Genius was pushed back to the second page of results after publicly offering bloggers promotion of their posts on social media in exchange for links to its lyrics pages, an explicit link exchange exposed online before Google even stepped in. What the three cases share is neither the size of the site nor its sector: it is link building designed to fool the algorithm, publicly exposed, then penalised.

An SEO consultant’s honest position on grey hat

My recommendation is always white hat at the core, for a simple reason: the techniques Google names explicitly in its spam policies almost always end up being detected, and the penalty wipes out in a few days what months of work have built. Grey hat, on the other hand, exists, and I address it openly. An expired domain bought with discernment, a rare topical link paid at a fair price, AI content that has genuinely been reworked: these are choices I can make with a client, provided they know exactly what level of risk they are accepting and the scale stays reasonable for the size of the site. What is non-negotiable is transparency about that risk before taking it on, not after.

The same logic applies to service providers: a guaranteed ranking in an SEO quote is a red flag, because no serious consultant can deliver on it.