An SEO risk is a decision that can cost you rankings, traffic or enquiries from Google, and SEO risks fall into two families: the ones you take in order to grow (a migration, a redesign, content written with AI, a test on title tags) and the ones with no upside (bought links, pages produced in bulk, recycled expired domains). What separates them is recovery time: according to Google a small or medium site completes a move in a few weeks, while after a quality demotion it can take several months, with no guarantee of getting back to where you were.
Most of what you read about SEO risks is about black hat.
Lists of banned techniques, one after another: keyword stuffing, cloaking, hidden text.
And everything else?
Everything else is where businesses really lose traffic: a rebuilt site with no redirect map, a hundred articles generated in an afternoon, a £300 monthly fee that buys three hours of work. None of these is "black hat". All three do damage.
We see three mistakes more often than any others:
- treating every risk the same way, and so never touching the site again out of fear;
- taking the wrong risks because they're cheap up front;
- ignoring the risks that don't depend on you, such as Google updates and AI answers.
Among the projects we work on, Macropix, a Milan manufacturer of made-to-measure LED screens, went from position 88 to 2 on Google Italy for "monitor pubblicitario" (advertising display). It took five years. Today, on the "ledwall" keyword group, it has a 25.55% share of voice, ahead of Amazon at 18.08% (Semrush, July 2026).
Sunscape, which develops solar farms in Italy, went in six months from March 2026 from 1 to 38 keywords on page one, out of 143 tracked.
What does that have to do with risk?
Five years of rankings can be lost in a week with one wrong redirect. The real risk in an SEO project that works is what you build on top of it afterwards.
Here you'll find:
- the table of risks, with the damage, recovery time and source for each;
- four risks worth taking and how to reduce them;
- three risks to avoid, with the numbers from those who took them;
- the risks you don't choose, and the one almost nobody puts in the table.
Let's start.
SEO risks in one table (damage, recovery time, source)
Every SEO risk can be judged with three questions: how much it can cost, how long it takes to undo, and whether the recovery depends on you or on Google. The table lines up the nine risks we come across most often, with the primary source for every type of damage and every timing given.
| Risk | Worth taking? (Visilay's view) | Possible damage | Recovery time | Source |
|---|---|---|---|---|
| Migration, change of domain or CMS | Yes, with a redirect map | Ranking fluctuations during the move | A few weeks for small and medium sites; redirects kept for at least 1 year | Google, site moves |
| A/B tests on titles and pages | Yes, with canonical and 302 redirects | "Little or no impact" on snippet and ranking | Immediate, once the test ends | Google, website testing |
| Content written with AI and reviewed by a person | Yes | None linked to the tool itself | Not needed | Google Search Central, February 2023 |
| Small, slow searches to target | Yes, with a budget that lasts | Budget spent before the results arrive | 1.74% of new pages in the top 10 within a year | Ahrefs, 2025 |
| Pages generated in bulk without review | No | Up to -99.52% of estimated traffic (Causal, manual action) | Several days or weeks after the reconsideration request, once cleaned up | Ahrefs, 2024; Google, Manual actions |
| Cheap SEO (£300 a month) | No | Between 3 and 7.5 hours of work a month, often bulk content | Whatever it takes to redo the work | Bark, UK rates; Ahrefs, 439 providers |
| Bought links, expired domains, other sites' reputation | No | Links discounted or a manual action under the spam policies | Several days or weeks after reconsideration | Google, spam policies |
| Disavow as a precaution | No | "Can potentially harm" the site's performance | Undone by removing the file | Google, disavowing links |
| Core updates and AI answers | Not your choice | Demotion of whole sections; 58% lower CTR in position one with an AI Overview (desktop) | Several months, no guarantee; an AI Overview isn't recovered from, it's worked around | Google, core updates; Ahrefs, February 2026 |
We didn't find a table like this on the first page of Google UK. On 10 October 2026 we went through the nine organic results for "seo risks": of the eight we could open, five were lists of mistakes or banned tactics, two dealt with a single issue (site security, overly long content), and the only one that separated risks worth taking from the rest was a 2018 page by a New York agency. None gave a recovery time in figures.
Risk worth taking no. 1: migrating or rebuilding the site (the 301 decides everything)
A migration is the most common of the SEO risks worth taking: you change CMS, domain or URL structure, and Google has to find every page again at its new address. Google writes that for a small to medium-sized site it "can take a few weeks for most pages to move", and warns that your visibility in Search may fluctuate temporarily during the move.
Fluctuations. Not collapses.
Collapses come from mistakes. Across 418,125 audits published in 2025, SE Ranking found redirect chains on 21.58% of sites and pages returning 4xx on 35.73%. On a freshly rebuilt site, each of those 4xx pages may be a page that was bringing in enquiries the day before.
How we reduce it on our projects:
- A list of the pages with clicks in the last 16 months, from Search Console: those are the ones to protect first.
- An old URL → new URL map, one row per page, with 301 redirects to the closest page by content, not to the home page.
- Redirects kept for at least a year, as Google recommends, so that all the signals are passed on.
- Checks at 7, 30 and 90 days on those same pages.
There's one mistake that most migration checklists don't mention: deleting the pages of discontinued products. In US results it's one of the most frequently flagged risks. The page has rankings and links: if the product has a successor, redirect to the successor; if it doesn't, the page stays online, says the product is no longer available and links to the alternatives.
At Macropix, for example, the pages about individual installations, from the LED wall at CityLife in Milan to the displays for Fuorisalone during Milan Design Week, are the ones a redesign would remove first because they look "old". They're also the ones that answer buyers' searches.
The full method for a site rebuilt from scratch is in our guide to SEO for a website redesign; the other mistakes that lose traffic are in the most common SEO issues.
Risk worth taking no. 2: writing with AI (the problem is scale, not the tool)
Using AI to write isn't an SEO risk in itself: in February 2023 Google explained that it rewards quality content however it's produced, and that only automation used to manipulate rankings breaks its rules. The risk starts when AI is used to produce more pages rather than better ones.
Since March 2024 that behaviour has had a name in Google's spam policies: scaled content abuse, meaning many pages generated mainly to manipulate rankings rather than to help users. With that month's core update, completed on 19 April 2024, Google says it cut low-quality, unoriginal content in results by 45% (Google announcement).
But who did it actually happen to?
Causal, for one. Ahrefs compared the estimated organic traffic of around 1,600 SaaS companies between August 2023 and August 2024: Causal lost 99.52%, after a manual action linked to a mass of AI-generated articles (Ryan Law, Ahrefs, September 2024). These are the tool's estimates, not Search Console data, but the order of magnitude holds.
In the UK the temptation is growing: according to the ONS, the share of businesses with 10 or more employees using at least one AI technology rose from around 12% in late 2023 to around 35% in June 2026. Nearly three times as many in under three years.
We use AI, and we say so. This article also comes out of a workflow with AI agents: research, drafting and checks are automated, but every number is checked against its primary source, and anything that can't be checked comes out of the text. The difference between how we use it and how Causal did isn't the tool. It's that we publish one piece at a time, with data a model doesn't have on its own.
What the data says about the indexing and clicks of generated text is in our analysis of AI content and SEO.
Risk worth taking no. 3: testing titles and pages (almost no impact, on four conditions)
An A/B test on titles, copy or layout often has little or no impact on rankings, according to Google's documentation on website testing, as long as it meets four conditions. They are:
- no cloaking: Googlebot and people must see the same variants;
- rel="canonical" on the variants, pointing to the original URL;
- 302 redirects, not 301, if the test sends the user to another URL;
- only as long as necessary, then the variants come down.
And why take this risk if the rankings are already there?
Because rankings and clicks don't move together. On one site we work on, average position improved by 64% in eight months and clicks by only 36%. That gap is closed by working on titles and snippets, and that's where a test earns its keep.
The real risk is the opposite: rewriting titles by stuffing them with keywords. Google rewrites them itself, and the page loses control over how it appears. We explain this in our guide to SEO over-optimisation.
Risk worth taking no. 4: going after slow searches (you risk time, not the site)
The risk of an honest SEO strategy is time: Ahrefs followed 1 million URLs first seen in September 2023, and within a year only 1.74% had reached the top 10 for at least one keyword. In 2017 the figure was 5.7%. In the same study the page in position one is on average five years old, against two in 2017 (Patrick Stox, Ahrefs, May 2025, US keywords).
On our projects in Italy, timescales range from the same order of magnitude to much less.
Macropix: five years to go from position 88 to 2 on a category keyword.
Sunscape: six months to take organic impressions from 329 to 5,809 a month, on more specific regional searches.
The search you choose makes the difference, not the site. Small, precise searches pay off sooner and bring enquiries that are already qualified; category keywords take longer and are worth more.
You manage this risk with the budget: if the plan runs out of money in month eight and the results arrive in month twelve, the project has failed even if the strategy was right. The stages, with measured timings, are in our guide to how long SEO takes to show results, and the method applied to Macropix is in our article on SEO for manufacturing.
Risk to avoid no. 1: cheap SEO (£300 a month buys between 3 and 7.5 hours)
Cheap SEO is a risk because the price doesn't cover the hours: at UK rates of £40 to £100 an hour, a £300 monthly fee buys between 3 and 7.5 gross hours of work. The range is the one published by Bark, the UK marketplace for freelancers and agencies, which also puts a typical retainer at £400 to £1,500 a month. The international benchmark is similar: an average of $111 an hour in an Ahrefs survey of 439 providers (published December 2023, mostly English-speaking sample).
Three hours a month isn't enough to do SEO.
It's enough to produce bulk articles or links from site networks, which are exactly the two things Google discourages most.
And what does that look like in practice?
We opened the Search Console of an Italian consultancy for dental practices that had bought bulk content: 71 clicks in 92 days, average position 25.8. The site hadn't been penalised. None of those pages answered a search that would bring in customers, simple as that.
It's the least visible damage: no collapse, no warnings, just a year of fees that produced nothing. The four signs of an empty package you can spot in the proposal are in our analysis of affordable SEO services.
Got an SEO proposal on your desk and not sure how many hours it buys?
You've just seen how a cheap monthly fee turned into 71 clicks in three months. Let's go through your proposal or your Search Console together: in half an hour we'll tell you which activities it really contains and which pages are bringing in enquiries.
Book a strategy consultationRisk to avoid no. 2: the shortcuts Google has put in writing (links, expired domains, other sites' reputation)
The SEO shortcuts to avoid are the ones listed in Google's spam policies: 16 named entries, three of which were added in March 2024. The three new ones are scaled content abuse, expired domain abuse and site reputation abuse, enforced from 5 May 2024 (Google, March 2024).
Translated into what gets offered to businesses:
- buying links for rankings: that's link spam, unless the link is marked nofollow or sponsored;
- buying an expired domain with a good history to publish content that has nothing to do with that history;
- publishing pages on someone else's authoritative site just to borrow its strength, like the "voucher codes" sections hosted by newspapers.
The damage, when it comes, is a manual action shown in the Search Console report. You get out by fixing everything and submitting a reconsideration request, which according to Google can take several days or weeks to review. The traffic lost in the meantime doesn't come back.
How to check whether the drop you're looking at really is a penalty is explained in our guide to Google penalties; the list of techniques with examples is in our guide to black hat SEO. If you've received a message about links, start from the unnatural links warning.
Risk to avoid no. 3: disavowing out of fear (408 spam domains and no action)
The disavow tool is an advanced feature that Google recommends only if you have a considerable number of artificial links and they have caused, or are likely to cause, a manual action. The same help page warns that, if used incorrectly, it can potentially harm your site's performance in search results.
Among the results on Google there are pages that call it obsolete, such as seo.com's page on SEO risks. It isn't obsolete. It's rarely needed.
We went through it on our own site: between 1 August and 5 October 2026 visilay.com received links from 408 new spam referring domains, 377 of them in eleven days. We did what Google's guidelines say: no disavow, no removal requests. Since September 2016 Penguin has been part of the core algorithm and discounts spam links rather than demoting the site that receives them.
The full data on the wave, and the attacks that do still work, are in our guide to negative SEO.
The risks you don't choose (one day in five there's an update rolling out)
Google updates and AI answers are SEO risks you don't get to choose: from 13 March 2025 to 8 October 2026 Google released 10 official ranking updates, rolling out on about 119 days out of 574. The count, made by adding up the durations on the Search Status Dashboard, is in our article on SEO challenges.
If a core update demotes you, Google writes that some changes take effect in a few days, but that it can take several months for its systems to learn and confirm that a site has improved, sometimes not until the next core update. And that there's no guarantee that changes will have a noticeable impact.
Then there are AI answers. Ahrefs compared 300,000 keywords between December 2023 and December 2025, on desktop: with an AI Overview position one has an average CTR 58% lower (Ryan Law, Ahrefs, February 2026; the study doesn't state the market and the sample is largely in English). On Google UK, across the four informational searches we checked for this article on 10 October 2026 ("seo risks", "how long does a google penalty last", "what is a 301 redirect", "does ai content hurt seo"), the AI answer was the first thing on the page in 4 out of 4.
So there's nothing you can do?
You can avoid depending on a single type of search. Informational, commercial, local and brand searches should be tracked separately, because an update or an AI answer rarely hits them all in the same way. How to measure the effect on your own queries is in our analysis of the impact of AI Overviews.
Frequently asked questions about SEO risks
It depends on which risk you take. Migrations, content written with AI and title tests are manageable risks, with recovery times of weeks if done methodically. Bought links, pages generated in bulk and recycled expired domains break Google's spam policies and can lead to a manual action.
No. Google expects temporary ranking fluctuations and says a small or medium site completes the move in a few weeks. Lasting losses come from missing or wrong redirects: SE Ranking finds redirect chains on 21.58% of the sites it analysed.
It depends on scale and review. Google judges the quality of content, not the tool used to write it. It becomes a risk when you generate many pages mainly for rankings: that's scaled content abuse, part of the spam policies since March 2024.
It depends on the type. A manual action is closed with a reconsideration request, which Google says can take several days or weeks to review once you've fixed the problem. A demotion after a core update can take several months, and Google doesn't guarantee recovery.
No. Google recommends it only if you have a considerable number of artificial links that have caused, or are likely to cause, a manual action, and warns that used incorrectly it can harm the site. Since 2016 spam links have largely been discounted automatically.
No. Google says no one can guarantee a number one ranking, and algorithm updates don't depend on whoever works on the site. What an agency can guarantee is the method: a redirect map, no banned techniques, checked content and honest measurement.
The risk nobody puts in the table (and where to start)
One line per risk:
Migration: worth taking, with a redirect map.
AI: use it, one page at a time.
Tests: run them, with canonical and 302.
Slow searches: fund them all the way.
Cheap SEO, bought links, disavowing out of fear: leave them where they are.
There's one risk left that doesn't appear on any list, because it isn't a technique: concentration. On the business websites we analyse, organic enquiries often come from a handful of pages. A redesign, a core update or an AI Overview that hits exactly those pages weighs more than any row in the table.
The first step, before taking any risk, is a list: the pages that brought in an enquiry in the last twelve months. Those are the pages to protect in every migration, to check first after every update, and to back up with other pages so they stop being the only ones. If you'd like to do it with us, it's where our SEO consultancy starts.
Speak soon!
