How to Use Search Console Manual Actions Report

Your Site Got Flagged. Here's What Actually Happens Next

Google just sent you a message. Not a friendly one. Your site triggered a manual action—meaning a real human at Google reviewed your pages and decided something violated their guidelines. This isn't an algorithm update. It's worse. It's intentional.

Manual actions tank organic traffic. Hard. Sites lose 50%, 80%, sometimes 100% of their search visibility overnight. But here's the brutal truth: most founders don't even know they have one. They just watch traffic crater and assume they're cursed.

You're not cursed. You just need to know what you're looking at and how to fix it.

This guide walks you through the Search Console Manual Actions report—the exact tool Google uses to tell you what went wrong. We'll show you how to find it, read it, diagnose the problem, and submit a recovery request that actually works. No fluff. Just the steps that recover visibility.

Prerequisites: What You Need Before You Start

Before you can access the Manual Actions report, you need three things locked down.

First, you need Google Search Console access. If you haven't set it up yet, stop here and follow the 10-minute setup guide. You need to verify your domain and have owner-level access. Admin access doesn't cut it—you need the ability to submit recovery requests, and only owners can do that.

Second, you need to know your baseline. Pull your organic traffic numbers from GA4 or your analytics platform. Screenshot them. Document the date. When did traffic drop? Was it sudden or gradual? This timing matters. Manual actions usually hit like a switch—traffic disappears in a day or two. Algorithm updates are slower. Knowing the difference tells you what you're fighting.

Third, you need a clear head. This is going to feel bad. Your site got penalized. But panic doesn't help. The recovery process is straightforward if you follow it exactly. Expect 2-6 weeks to full recovery once you submit a valid request, assuming you actually fix the underlying problem.

Step 1: Access the Manual Actions Report in Search Console

Open Google Search Console and navigate to your property. On the left sidebar, you'll see a section called "Security & Manual Actions." Click it.

Inside, you'll see three options:

• Manual Actions
• Security Issues
• Core Web Vitals

Click "Manual Actions." This is where Google tells you if your site has been flagged.

The page will either show you a clean bill of health ("No manual actions detected") or a list of issues. If you see issues, they'll be grouped by type. Google uses several categories:

Unnatural links — You have spammy backlinks pointing to your site, or you bought them, or you participated in link schemes. This is the most common manual action.

User-generated spam — Your site hosts user content (forums, comments, reviews) and it's full of spam. Users are posting garbage, and Google blames you for not moderating.

Hacked content — Your site was compromised. Attackers injected malware, phishing pages, or spam content. Google detected it and flagged you.

Cloaking and/or sneaky redirects — You're showing different content to Google than you show to users, or you're redirecting users deceptively.

Structured data issues — Your schema markup is misleading or fraudulent. You're lying about prices, ratings, or product details.

Thin content with little or no added value — Your pages are thin, low-quality, or plagiarized. This one is rarer as a manual action (usually it's an algorithm issue), but it happens.

Unnatural content — Your pages are AI-generated garbage or obviously spun/duplicated content.

If you see any of these, you have a manual action. Write down exactly which one. This is critical—the recovery steps differ by category.

Step 2: Understand What Google Is Telling You

Google gives you more than just a category. Click on the specific manual action to expand it. You'll see:

Affected pages — A partial list of pages that triggered the action. Google doesn't always show all of them (they cap the list), but these are the ones they caught. Open a few in a new tab. Look at them with fresh eyes. What's wrong with them?

First detected — When Google first spotted the issue. This tells you how long it's been happening.

Affected content type — Sometimes Google specifies: is it the entire site, specific pages, or a specific type of content?

Additional details — Google sometimes provides extra context. Read this carefully. It's often vague, but it's the only hint you get.

Don't assume Google is right about everything. Google makes mistakes. But Google is the authority here—if they say your site violates their guidelines, you need to treat that as fact, even if you disagree.

Here's what you're looking for: Is this a real problem, or is it a false positive? Real problems include:

• You actually did build spammy backlinks
• Your site hosts user content and it's genuinely full of spam
• Your site was hacked and you didn't notice
• You're cloaking or redirecting deceptively
• Your schema is misleading
• Your content is thin or plagiarized

False positives are rare but they happen. If you're certain you haven't done anything wrong, you can request a review anyway. But be honest with yourself first.

Step 3: Diagnose the Root Cause

Now comes the hard part: figuring out exactly what went wrong.

For unnatural links: Use a tool like Ahrefs to audit your backlink profile. Look for spammy domains, private blog networks (PBNs), directory submissions, or obviously low-quality sites linking to you. Check your Google Search Console backlinks report—click "Links" on the left sidebar to see who's linking to you. Sort by "Top referring sites." Do any of them look sketchy? If you bought links or participated in link schemes, you need to disavow them. Use the Disavow Links tool in Search Console to tell Google "ignore these links." This is critical. Don't skip it.

For user-generated spam: Check your comments, forums, reviews, or any user-submitted content. Is it full of spam? Disable comments. Delete spam. Add moderation. Set up a filter to auto-remove obvious spam. If you have a large volume, consider using Akismet or a similar spam filter.

For hacked content: Run a security scan. Use Wordfence if you're on WordPress. Check your server logs for suspicious activity. Look for files you didn't create. Check your Google Search Console Security Issues tab (next to Manual Actions) for malware warnings. Remove the malicious files. Update your passwords. If you're on shared hosting, consider moving to a more secure host.

For cloaking and redirects: Audit your site's redirects. Are you redirecting users to different pages than you're showing to Google? Are you using JavaScript to show different content? Stop. This is intentional deception and Google hates it. Fix your redirects. Show the same content to everyone.

For structured data issues: Check your schema markup. Use Google's Rich Results Test to validate it. Are you marking up product prices, ratings, or other details accurately? If you're inflating ratings or lying about prices, fix it.

For thin content: Read your own pages. Are they thin? Short? Plagiarized? Rewrite them. Make them substantial. Add real value. If you've copied content from other sites, rewrite it entirely. If your pages are 200 words of fluff, expand them to 2,000+ words of actual insight.

The diagnosis step takes time. Don't rush it. You need to understand the actual problem before you can fix it.

Step 4: Fix the Underlying Issue (The Real Work)

This is where most founders fail. They submit a recovery request without actually fixing anything, then they're shocked when Google rejects it.

Google's review team is looking for evidence that you've actually solved the problem. They're not looking for promises. They're looking for action.

If it's unnatural links: Disavow the spammy links. Use the Disavow Links tool in Search Console. Upload a text file listing all the domains you want Google to ignore. Google will process it within a few days. But here's the thing—disavowing doesn't remove the links. It just tells Google to ignore them. If you can actually get the links removed (by contacting webmasters and asking them to take the links down), that's better. But that's often impossible. Disavowal is usually the practical solution.

If it's user-generated spam: Delete all the spam. Every comment, every forum post, every review that's obviously spam—delete it. Then implement moderation. Add a CAPTCHA. Use a spam filter. Require email verification. Make it harder for spammers to post. Document your moderation policy. Write a brief summary of what you did.

If it's hacked content: Remove all malicious files. Scan your entire site for malware. Update all passwords. Enable two-factor authentication. Check your Google Search Console Security Issues tab to confirm Google no longer detects malware. This might take a few days for Google to re-scan your site.

If it's cloaking or redirects: Fix your redirects so everyone sees the same content. Remove any JavaScript that shows different content based on user agent. Verify the fix by checking your site as both a regular user and Googlebot (use the URL Inspection tool in Search Console to see what Googlebot sees).

If it's structured data issues: Fix your schema. Make sure it's accurate. Test it with Google's Rich Results Test. Verify that prices, ratings, and other details are correct.

If it's thin content: Rewrite your pages. Make them substantial. Add real value. Aim for 2,000+ words on core pages. Make sure the content is original, not plagiarized.

Once you've fixed the issue, wait a few days. Let Google re-crawl your site. Check the Manual Actions report again—the issue should still be there (Google doesn't remove it automatically), but your site should be clean now.

Step 5: Submit a Recovery Request

Once you've actually fixed the problem, it's time to request a review. This is the moment Google's team looks at your site again and decides whether you've earned forgiveness.

Go back to the Manual Actions report. Click on the specific action you fixed. You'll see a "Request Review" button. Click it.

Google will ask you to describe what you did to fix the issue. This is your chance to explain. Be specific. Don't be vague. Here's what a good recovery request looks like:

"We discovered that our site had accumulated spammy backlinks from private blog networks and low-quality directories. We've disavowed 247 domains using the Disavow Links tool. We've also audited our entire link profile and will not participate in any paid link schemes going forward. All disavowed links are documented in our Disavow file, uploaded on [date]."

Or:

"Our site was compromised by attackers who injected malware on 34 pages. We've removed all malicious files, updated all passwords, enabled two-factor authentication, and patched the vulnerability. We've confirmed via Google Search Console that no malware is currently detected. The site is now clean and secure."

Or:

"We've rewritten 156 pages that were thin, low-quality, and provided little value. Each page now contains 2,000+ words of original, substantive content. We've removed all plagiarized content and ensured every page provides genuine insight to users."

Be honest. Be specific. Show evidence. Don't make excuses. Google respects founders who own their mistakes and fix them.

Submit the request. Then wait. Google typically reviews recovery requests within 2-6 weeks. Some take longer. Check your Search Console for updates. Google will send you a notification when they've reviewed your request.

Step 6: Monitor the Recovery Process

After you submit a recovery request, you're in a holding pattern. But you're not helpless. You can monitor progress.

Check the Manual Actions report regularly. It won't change immediately, but once Google approves your request, the action will disappear from this report.

Monitor your organic traffic. Use GA4 or your analytics platform to track organic traffic. Once Google approves your recovery request, traffic should start climbing. It won't return to pre-penalty levels immediately—that takes weeks—but you should see an upward trend.

Check the Performance report. Go to "Performance" in Search Console. Look at your impressions and clicks over time. You should see them increasing as Google starts ranking your pages again. Read the Performance report like a founder to understand what you're looking at.

Use the URL Inspection tool. Pick a few key pages and use the URL Inspection tool to check their indexing status. Are they indexed? Can Googlebot crawl them? This tells you if Google is re-crawling your site.

Monitor your Coverage report. Go to "Coverage" in Search Console. Are you seeing any coverage issues? If you're still seeing errors or warnings, fix them. Clean coverage helps recovery.

Recovery is not linear. You'll see traffic fluctuate. Some days it'll be up, some days down. This is normal. What you're looking for is an overall upward trend over 2-6 weeks.

Step 7: What If Google Rejects Your Recovery Request?

Sometimes Google says no. You submit a recovery request, you wait 4 weeks, and they reject it. This means they don't believe you've actually fixed the problem.

Don't panic. You can request another review. But first, figure out what Google didn't like.

Go deeper. If you disavowed links, maybe you didn't disavow enough. Audit your backlink profile again. Look for links you missed. If you deleted spam comments, maybe you didn't delete all of them. If you removed malware, maybe you didn't get all of it. Be more aggressive. Be more thorough.

Get external validation. If it's a hacked site, run a security scan with a professional service. Get a report. Include it in your next recovery request. If it's thin content, have someone outside your team review it. Get their feedback. Improve based on it.

Wait before requesting again. Don't spam Google with recovery requests every week. Wait at least 2 weeks between requests. Use that time to make your site genuinely better, not just different.

Be more detailed in your next request. Explain not just what you did, but why you did it and how you verified the fix. Include specific dates, numbers, and evidence. Google wants to see you've thought deeply about this.

Some sites need 2-3 recovery requests before they're approved. This is normal. The key is actually improving each time, not just tweaking your message.

Pro Tip: Prevent Manual Actions in the Future

Once you recover, don't get hit again. Here's how.

Never buy links. Ever. It's not worth it. Build authority the hard way—through genuine content and natural links.

Moderate user content. If you host comments, forums, or reviews, moderate them aggressively. Delete spam immediately. Use filters.

Audit your backlinks quarterly. Use a tool like Ahrefs to check who's linking to you. If you see spammy links, disavow them immediately. Don't wait for Google to flag you.

Keep your site secure. Use strong passwords. Enable two-factor authentication. Keep your CMS and plugins updated. Run regular security scans. Use a Web Application Firewall (WAF).

Write original, substantial content. Thin content is a liability. Every page should provide real value. Aim for 2,000+ words on core pages. Make it original. Make it useful.

Be transparent with schema markup. Only mark up data that's accurate. Don't inflate ratings. Don't lie about prices. Schema is for helping users, not tricking Google.

Monitor Search Console constantly. Set up Search Console alerts and check your reports weekly. The earlier you catch a problem, the easier it is to fix.

If you need a comprehensive SEO foundation, consider running a domain audit to identify issues before they become penalties. Most founders don't know what they don't know—an audit surfaces problems you're blind to.

Common Manual Action Recovery Mistakes

Founders mess up recovery in predictable ways. Don't be one of them.

Mistake 1: Submitting without actually fixing anything. You get a manual action notice, you panic, you submit a recovery request without changing anything. Google rejects it. Of course they do. You didn't fix the problem. Don't do this. Actually fix it first.

Mistake 2: Disavowing too conservatively. You think "I'll just disavow the obvious spam." Then Google rejects your request because you missed spammy links. Disavow aggressively. If a domain looks sketchy, disavow it. You can always remove domains from your disavow file later if you were wrong.

Mistake 3: Describing your fix vaguely. "We've improved our site" is useless. "We've disavowed 247 spammy domains and removed 89 thin-content pages" is specific and credible. Be specific.

Mistake 4: Giving up. Recovery takes time. If Google rejects your first request, you might need to request again. Don't give up. Sites recover from manual actions all the time. It just takes patience and real work.

Mistake 5: Ignoring the underlying problem. You fixed the symptom but not the cause. You deleted spam comments but didn't implement moderation. You disavowed spammy links but you're still participating in link schemes. You removed malware but you didn't patch the vulnerability. Fix the root cause, not just the symptom.

The Timeline: What to Expect

Here's a realistic timeline for recovery:

Day 1-2: You discover the manual action. Traffic has already tanked. You start diagnosing.

Day 3-7: You fix the underlying problem. This might take days or weeks depending on severity.

Day 8-14: You submit a recovery request. Google acknowledges it.

Day 15-35: Google reviews your request. This typically takes 2-4 weeks.

Day 36+: Google approves or rejects. If approved, traffic starts recovering over the next 2-4 weeks. If rejected, you diagnose deeper and request again.

Day 60+: Your site is back to normal. Full recovery usually takes 60+ days from initial penalty.

This is not a fast process. But it's the only process that works. There's no shortcut. There's no trick. You fix the problem, you request a review, you wait, and you recover.

Key Takeaways

Manual actions are serious, but they're recoverable. Here's what you need to do:

1. Access the Manual Actions report in Search Console. It's under "Security & Manual Actions." Check it regularly.

2. Understand exactly what Google flagged. Read the specific action. Look at the affected pages. Know what you're fighting.

3. Diagnose the root cause. Is it spammy links? User spam? Hacked content? Cloaking? Thin content? You need to know before you can fix it.

4. Actually fix the problem. Don't fake it. Don't half-fix it. Really solve it. This is the hard part, but it's non-negotiable.

5. Submit a detailed recovery request. Be specific. Show evidence. Explain what you did and why.

6. Monitor progress. Track your organic traffic, check the Performance report, use the URL Inspection tool. Recovery takes weeks, not days.

7. Be patient. Google's review team is slow. They're also thorough. Trust the process.

Manual actions feel catastrophic. Your organic traffic disappears overnight. Your business takes a hit. But you can recover. Thousands of founders have. You will too, if you follow these steps exactly.

Start with setting up Google Search Console properly if you haven't already. Then submit your sitemap and monitor your coverage to catch issues before they become penalties.

The best manual action is the one you prevent. The second-best is the one you recover from fast. Now you know how to do both.