SEO crisis management: emergency playbook for ranking drops, traffic loss, and penalty recovery
1. Day one of the crash: diagnose first, don’t touch anything
When you see your GSC traffic curve suddenly drop more than 30%, your first instinct shouldn’t be to change code. Check two things: whether the Search Console manual actions report has any new notices, and whether Google released an algorithm update around those dates. These two steps rule out half the panic.
Check manual actions: log into GSC, go to “Security & Manual Actions” → “Manual Actions” in the left sidebar, and look for notices like “Spam,” “Structured Data Issue,” or “Unnatural Links.” No notice means it’s probably not a penalty. Check algorithm updates: look at the Google Search Central blog and monitoring sites like seroundtable to confirm whether the dates fall within an update window.
| Diagnostic signal | Points to cause | Action |
|---|---|---|
| GSC shows a manual action notice | Manual penalty | Clean up per the notice type, then request a review |
| No notice, but dates fall in an update window | Algorithm fluctuation | Watch for 2 weeks, don’t rush to change anything |
| No notice and no update | Technical failure or hack | Check crawl stats and homepage source code |
| Only core keywords dropped, long-tail is stable | Content quality issue | Check whether competitors outranked the dropped pages |
Counterintuitive take: what most teams call a “penalty” is actually algorithm fluctuation. Google rolls out 8 to 10 core updates a year, and each one shakes up a batch of sites; swings of 20% to 40% are normal. As long as GSC shows no manual action notice, don’t overhaul your site in the first week. For the emergency process after a hack, see After your site gets hacked.
2. Step two: determine whether the whole site dropped or just single pages
After diagnosing, define the scope. A whole-site drop and a single-page drop have completely different causes and require different fixes. To tell them apart, export the last 28 days of data by page from GSC and compare it with the previous 28 days.
| Drop scope | Common Causes | Check first |
|---|---|---|
| All pages across the site drop together | Algorithm update, technical failure, hack | Crawl stats, homepage source code |
| Only one section drops | That section’s content quality declined or it was demoted | Recent updates for this section |
| Only core keywords dropped; long-tail terms held steady | Competitors outranked you on core keywords | Who owns the SERP for your competitors now |
| Only new pages dropped; older pages held steady | Content quality or indexing issue on new pages | Indexing status of new pages |
Example: A B2B site noticed traffic had dropped 40% on Monday and assumed the whole site had been penalized. Breaking it down by page, only the blog section had dropped, while product pages and the homepage held steady. Digging into the blog revealed that a plugin update the previous week had accidentally turned on noindex. Turning off noindex and requesting a recrawl fixed it in 3 days.
For site-wide monitoring and alerts, see Site monitoring and alerts.
Step 3: Attribute the drop to one of five causes
Once you’ve scoped the problem, attribute it to one of the five causes below. Each one requires a completely different fix, so don’t mix them up.
| Cause | Rationale | Fix Direction | Recovery time |
|---|---|---|---|
| Algorithm update | No manual action, dates line up with a known update | Wait and improve content quality | 2 to 4 weeks |
| Technical failure | Crawl errors, indexing drop, 5xx errors | Fix the technical issue and submit for indexing | 3 to 10 days |
| Content quality | Core keywords dropped, competitors outranked your pages | Refresh content and add depth | 4–8 weeks |
| Backlink issues | Sudden mass loss of backlinks or a flood of low-quality new links | Disavow spammy links and build quality ones | 6 to 12 weeks |
| Hacked site with injected malware | Unknown links in the source code, security alert in GSC | Remove malicious code and harden the site | 4–8 weeks |
Example: A site’s traffic dropped 50%. GSC showed no manual action notice, and the date didn’t fall within any known update window. A crawl tool revealed hundreds of gambling links added to the footer of the homepage. This was a hack, not an algorithm issue. The fix is to remove the malicious code from the server first, then request a review. See After your site gets hacked.
Keyword cannibalization across multiple pages dilutes rankings. To diagnose it, see keyword cannibalization. For whether to refresh or merge old content, see Refreshing Old Articles.
Step 4: Fix only the root cause, don’t change anything else along the way
Once you’ve identified the cause, the most common mistake is thinking “while I’m in here, I might as well optimize other things.” You fix a noindex issue and swap the site theme at the same time, or refresh content and change the URL structure along the way. These extra changes introduce new variables, making it impossible to tell which change actually made the difference.
| The right way | What not to do |
|---|---|
| Fix one root cause at a time | Swapping the theme while fixing a technical issue |
| Wait 7 days after a fix before the next step | Fixing everything in one day |
| Log the date and URL of every change | No records, relying on memory |
| Request reindexing in GSC after the fix | Wait for Google to crawl naturally |
If the drop was caused by a site migration or redesign, your 301 redirect map must be complete. See Site rebuilds and domain changes. For indexing drops caused by performance issues, see Core Web Vitals.
Step 5: Wait for recovery and resubmit
Fixing the issue doesn’t mean recovery. Google needs time to recrawl and recalculate rankings. Manual action penalties require you to request a review, while algorithm updates don’t need a submission; just wait for the natural recrawl.
| Fix type | Review submission needed? | Wait time | What to do meanwhile |
|---|---|---|---|
| Manual action penalty | Required, submit via GSC | 4–8 weeks | Keep publishing quality content |
| Fix technical issues | Request reindexing | 3 to 10 days | Monitor crawl stats |
| Algorithm update fluctuations | Don’t submit, wait for natural recovery | 2 to 4 weeks | Watch, don’t make big changes |
| After a hack cleanup | You must request a review | 4–8 weeks | Harden security and monitor |
For how to fix backlink issues, see Link building and digital PR. For the on-site SEO framework, see Google SEO.
Counterintuitive reminder: the worst thing you can do during recovery is keep making changes. Change a little every day and Google sees something new on every recrawl, which actually drags out the recovery. Once you’ve fixed things, seal the change log and wait 4 weeks before reassessing.
How do you catch a traffic drop on the day it happens? Two free tools are enough: turn on GSC email alerts for all three categories — indexing issues, manual actions, and security issues — then use server logs to monitor crawl frequency. A healthy site gets a few hundred pages crawled by Googlebot per day; a 50% drop two days running is a signal, and you’ll spot it 5 days earlier than checking reports every Monday. For the monitoring checklist, see Site monitoring and alerts.
If the drop was caused by a redesign or domain change, your 301 map must be complete, see Site rebuilds and domain changes. For indexing drops caused by performance issues, see Core Web Vitals.
FAQ
What should you do on day one of a rankings drop?
How do you tell a site-wide drop from a single-page drop?
If there’s no manual action notice in GSC, are you in the clear?
How long does it take to recover from a manual action penalty?
If an algorithm update caused the rankings drop, should you change your content proactively?
Why shouldn’t you keep changing your site during recovery?
Final thoughts
SEO crisis management isn’t about reacting fast. It’s about diagnosing before you touch anything. 80% of traffic crashes aren’t penalties, and most teams that overhaul their site in week one end up turning a recoverable algorithm fluctuation into real damage. Work through all five steps first, and only then will you know what to fix and how long to wait.
Three things to do now: today, open your GSC manual actions report and crawl stats and take a look; tomorrow, export page-level data and compare it to define the scope; by the weekend, use the five-category attribution table to pinpoint the root cause. Until you’ve pinpointed it, don’t change a single line of code.
If you finish all five steps and still can’t find the cause, pull up three charts from GSC side by side: crawl stats, index coverage, and clicks for the last 90 days. If all three drop together, it’s most likely a technical failure or an algorithm fluctuation. If only clicks drop while crawling and indexing hold steady, it’s a ranking problem, so check the SERP for your keywords and see who’s taken your spot. This cross-check takes an hour and beats randomly editing code by a mile. Print out the five steps and stick them on your desk, so next time traffic crashes you don’t panic from scratch, you just follow the list.
One line worth remembering: on day one of a ranking crash, the most expensive move is editing code. Diagnose first, define the scope second, and only then act. The order can’t be reversed.