---
title: "Parasite SEO"
description: "What parasite SEO is, why Google's site reputation abuse policy now penalises it, and the involuntary version where attackers exploit your domain's authority."
tldr: "Parasite SEO is publishing content on a high-authority third-party domain to borrow its ranking signals rather than earning them on your own site, classically an affiliate or coupon section hosted on a major news brand. Google named it site reputation abuse in March 2024 and began manual actions that May. An August 2026 rewrite made editorial integration the test, judged on four factors that apply globally, and stopped manual actions affecting searchers inside the EEA, where the offending section is separated to rank on its own merits instead. There is also an involuntary version: attackers who hijack a subdomain to ride its authority, a security problem rather than a tactic you choose."
publishDate: 2026-07-02
updatedDate: 2026-09-07
author: "Liam Hayward"
---
Parasite SEO is the practice of publishing content on someone else's high-authority domain to borrow its ranking signals, rather than building that authority on your own site. The host domain is the "host"; the content that feeds on its reputation is the "parasite". The tactic works because of a presumption Google says it "generally appl[ies] globally", that "individual pages (including new pages) match the overall quality of other pages on the domain",[^5] so a mediocre page on a domain Google already trusts can outrank a better page on an unknown one.

The classic form is a "best [product]" affiliate roundup or a coupon section published under a major news brand, often through a commercial arrangement where a third party rents the subdomain or subfolder and keeps the revenue. For years this was a reliable way to rank commercial content quickly. Google has now made it a reliable way to lose visibility.

## What is Google's site reputation abuse policy?

Site reputation abuse was Google's name for the spam policy that targets parasite SEO. The documentation now calls it the **site reputation policy**, and states that it "applies where third-party content is published on a host site mainly because of that host's already-established ranking signals, which it has earned primarily from its first-party content".[^5] Third-party content on its own is not the violation. Google says hosting it "isn't inconsistent with the site reputation policy; it's only inconsistent if the third-party content is published on a host site mainly because of that host site's already-established ranking signals", and its list of things that are **not** covered is long: wire services, syndicated news, forums and comment sections, opinion and editorial work, and affiliate links used with the right attributes.[^5]

The policy has tightened in stages:

- **March 2024.** Announced alongside the expired-domain-abuse and scaled-content-abuse policies as part of Google's spam update.[^2]
- **May 2024.** Manual actions began landing on major publishers hosting third-party commercial sections.
- **19 November 2024.** Google expanded the policy to apply regardless of first-party involvement or oversight, a position it has since stepped back from. This closed the loophole publishers had used, arguing that because their own staff edited or commissioned the content, it was not "third-party". Google's position is that white-label arrangements, licensing deals, and partial ownership do not change the third-party nature of content whose primary purpose is exploiting the host's ranking signals.[^1]
- **Since 2025.** Detection is automated; the response is not. Google's documentation says that where it detects a portion of a site out of line with the policy, "a site will be subject to human review", and describes those as happening "on the rare occasions where we perform a human review".[^5]
- **30 August 2026.** Google split the effect of a manual action by the searcher's location, "following discussion with the European Commission". Outside the EEA nothing changed. Inside it, "the impact of the manual action won't apply", and the affected section "may be categorized as separate from the main domain" so that it comes to rank on its own merits instead.[^6] The same update rewrote the policy documentation for every region, which is the half that matters to most readers.[^5]

The named casualties were significant. Forbes Advisor, CNN Underscored, WSJ Buy Side, USA Today's Reviewed, and US News 360 Reviews all had commercial sections deindexed or heavily suppressed, in several cases entire folders removed from search.[^3]

## How does Google detect it?

Google's systems can identify when a section of a site is independent of, or starkly different from, its main content. What happens next is now documented, and the mechanism is a presumption being switched off rather than a penalty being applied. Google "generally applies a presumption that individual pages (including new pages) match the overall quality of other pages on the domain"; where a section is categorised as separate, that presumption no longer holds there and "the different parts of the site" rank "independently of each other, on their own merits".[^5] In effect, the parasite is severed from its host: the subfolder ranks on its own thin merits, which is usually not enough.

This is why the tactic no longer offers a shortcut. The whole value of parasite SEO was inheriting authority the content did not earn. Once Google stops passing that authority, the arrangement collapses.

The human review that decides it turns on four factors, and Google says this part "applies globally": how the content is presented, whether its design, formatting and typography match the host domain; the quality of the content, whether it carries problems that do not appear on the main domain; its stated or implied authorship, whether ownership of it is explicitly acknowledged; and whether the same content appears on other sites in identical or near-identical form. Google adds that no factor is "either necessary or sufficient on its own".[^5]

## Parasite SEO and manufactured authority

Parasite SEO sits alongside a family of tactics that try to acquire authority a site has not earned. The distinction worth keeping clear:

- **Parasite SEO** exploits authority you do not own, by publishing on someone else's trusted domain.
- **Manufactured-authority link schemes** try to fabricate authority on platforms you do control. The [entity stacking and cloud stacking](/seo-basics/black-hat-seo/#entity-stacking) tactics are two examples: interlinking Google properties or cloud-hosted documents to simulate endorsement.

Both fail for the same underlying reason. Google's systems increasingly assess whether authority is genuinely earned through independent editorial endorsement, and discount signals that are rented, borrowed, or self-generated.

## The involuntary version: when someone parasites your site

There is a second, entirely different situation that uses the same mechanic against you rather than for you. Here you are the host, and the parasite is hostile.

**Subdomain takeover.** If a subdomain points (via a dangling DNS record) to an external service you no longer use, such as a deprecated cloud host, an attacker can claim that service and serve their own content from your subdomain. They inherit your domain's authority to host spam or cloaked pages. This is a security vulnerability, not an SEO tactic: the fix is DNS hygiene (remove dangling records for decommissioned services), not anything in Google Search Console.

**Hacked content.** Attackers who compromise a site can inject spam or cloaked pages that ride its reputation. Google has a dedicated hacked-content spam policy, and the injected pages can rank surprisingly fast on the strength of the host's authority before the owner notices. This is the involuntary counterpart to parasite SEO: someone exploiting your domain's reputation without consent.

Both differ from the [negative SEO](/seo-basics/negative-seo/) category in intent and method, but they overlap with it in practice, since injecting content onto a victim's site is also a recognised negative-SEO vector.

## What to do about it

**If you host third-party content**, editorial oversight is back at the centre of the test, having been written out of it in November 2024. Google's stated goal in a review is now to work out whether the content "is created with sufficient input, editorial oversight, or contribution from the host site to be considered fully integrated with the main site".[^5] The underlying question is unchanged, whether a section exists primarily to rank on your domain's authority rather than to serve your own audience, but integration is how Google says it now answers it: named authorship, disclosed commercial relationships, presentation consistent with the rest of the site, content made for this audience rather than syndicated across sites, and a route into the section from your own navigation.

A section that fails those tests is exposed. Options are to bring the content genuinely into your site's remit (same audience, same editorial standard, same purpose), move it to its own domain where it ranks on its own merits, or discontinue the arrangement. A section that only makes sense as a rented ranking shortcut is a liability. The white-hat SEO version of the same commercial idea is a partnership that would still make sense if the host domain had no ranking advantage at all: shared audience, shared editorial standard, and content each party would publish on its own merits.

**If you are defending your own domain**, treat subdomain takeover and hacked content as security work: audit DNS for dangling records, remove subdomains pointing at decommissioned services, keep software patched, and monitor Search Console for unfamiliar pages appearing in your index. A manual action for hacked content, or an unexplained set of indexed URLs you did not create, is the signal to investigate.

## The regulatory backdrop

The policy has not been uncontested, and the contest has now changed it. In November 2025 the European Commission opened a formal Digital Markets Act investigation into Google, on the basis that the policy demotes publishers who include content from commercial partners.[^4] The tension is real: the same policy that stops ranking manipulation also cuts a revenue line publishers had come to depend on.

Google gave ground on 30 August 2026. A manual action under the policy no longer affects the results shown to searchers inside the EEA, and Google is lifting the EEA actions it had already issued, while restating its concern that "an overbroad application of the DMA could prevent us from addressing real threats to the integrity of our search results".[^6] **The split is keyed to the searcher's location, not the site's**, so an EEA publisher under a manual action still loses its rankings for searchers elsewhere. [Google's EEA site reputation change](/seo-news-updates/google-site-reputation-policy-eea-exemption/) sets out what the carve-out does and does not do.

[^1]: [Updating our site reputation abuse policy — Google Search Central](https://developers.google.com/search/blog/2024/11/site-reputation-abuse)
[^2]: [What web creators should know about our March 2024 core update and new spam policies — Google Search Central](https://developers.google.com/search/blog/2024/03/core-update-spam-policies)
[^3]: [Google's site reputation abuse crackdown hits major publishers — Search Engine Journal](https://www.searchenginejournal.com/google-strengthens-policy-against-site-reputation-abuse/533018/)
[^4]: [EU investigating Google over site reputation abuse policy — Search Engine Land](https://searchengineland.com/report-eu-probe-google-site-reputation-abuse-464592)
[^5]: [Site reputation policy — Google Search spam policies](https://developers.google.com/search/docs/essentials/spam-policies#site-reputation)
[^6]: [Update to the Site Reputation Policy — Google Search Central](https://developers.google.com/search/blog/2026/08/update-site-reputation-policy)