What Google's Site Reputation Policy Update Means for Your Site

What did Google just change about its site reputation policy?

Google published an update to its site reputation policy on Friday, August 28, 2026, and the change took effect beginning August 30. Manual actions under that policy now land differently for people searching inside the European Economic Area than for everyone else. The policy itself did not go away.

I read this one twice, because the headline version going around was that Google had backed off. It has not. What changed is the shape of the punishment in one region, not the behaviour Google objects to. If you run a blog, a resource hub, or any section of your site where someone else's content lives, this is worth twenty minutes of your attention.

Google's own post, from the Search Quality team, is short. That is usually a sign the company wants the change on record without inviting a debate. So let me do the part Google did not do, which is translate it into decisions you can actually make this week.

Why does the site reputation policy exist at all?

Google introduced the policy in 2024 to stop a practice where third-party content is published on a trusted website just to exploit that site's good reputation to rank higher in Search. Google says the practice hurts search quality and creates a bad experience for users. That reasoning is unchanged in the 2026 update.

The mechanic it targets is simple and old. A domain earns trust over years through real reporting, real products, or real expertise. Someone then rents a corner of that domain and fills it with content that has nothing to do with why the domain earned trust in the first place. The content ranks, not because it is good, but because of the address it lives at.

What makes this policy unusual is that it punishes a section rather than a site. Google is not saying the host is a bad site. It is saying one room in the house is being used for something the rest of the house did not earn.

What is actually different inside the European Economic Area?

For users outside the EEA, a manual action under this policy directly affects search results for the portion of the site affected, and as before, the rest of the site is not affected. For users inside the EEA, the impact of that manual action does not apply. Instead the affected section may be separated in Google's systems so that, over time, it ranks independently from the rest of the site.

Read that second half slowly, because it is not amnesty. Inside the EEA the manual action stops being the instrument, and separation becomes the instrument. The section still loses the thing it was borrowing. It just loses it gradually, through ranking independently, instead of immediately, through an action you get notified about.

Google also makes the global case explicit. Because many pages are viewed by people around the world, any given page might carry a manual action where that change only affects search results shown to users outside the EEA. One page, two realities, depending on where the searcher is sitting.

Why did Google make this change now?

Google says the adjustment follows discussion with the European Commission. In the same post it says it remains concerned that an overbroad application of the DMA could prevent it from addressing real threats to the integrity of its search results. That is a regulatory accommodation written in the language of a company that does not like the accommodation.

I think that framing matters for how you plan. When a platform changes enforcement because a regulator pushed, the underlying opinion has not moved. Google still thinks this practice is manipulation. It has found a mechanism that survives the regulatory environment it operates in, and it told you the mechanism has the same destination.

Planning around the loophole is the mistake I expect people to make. The loophole is regional, procedural, and explicitly temporary in effect, since separation compounds over time rather than expiring.

Does this mean guest posts and sponsored sections are safe again?

No. Site reputation abuse remains listed among Google's web search spam policies. Manual actions are still issued. Inside the EEA the affected section can still be cut loose from the parent domain's authority. What changed is the delivery mechanism in one region, not Google's position on the practice.

The useful distinction has never been guest post versus not guest post. It is whether the content belongs to the site that hosts it. A software company publishing a partner's integration walkthrough on its own docs is not the thing Google is describing. A software company renting its subfolder to an unrelated affiliate operation is.

If you cannot explain why your domain is the right home for a piece of content without mentioning your domain rating, that is your answer. I have written before about how the penalty conversation usually distracts from the thing that actually matters, and this is another case of it.

How would you even know if this hit your site?

Search Console. Google says site owners will continue to be notified within Search Console when a manual action is applied. If you believe an action was taken in error, you can submit a reconsideration request. Eligible sites will, following that reconsideration request, also have the opportunity to bring disputes to mediation.

That is the clean path. The messy path is the EEA one, because separation does not come with a notification. You would see it as a section that quietly stops performing while the rest of the site holds steady, and you would probably blame a core update.

So the practical monitoring change is to stop looking at sitewide performance as one number. Segment your Search Console data by directory. If your resource hub, your partner pages, and your main site move together, fine. If one directory decouples and drifts down while nothing else does, you have a specific question to ask rather than a vague feeling that something is wrong.

What should you do if you already host third-party content?

Inventory it first. Most teams genuinely do not know how many directories on their domain carry content they did not write, because those arrangements get made by partnerships, by sales, or by a previous marketing lead who has since left. You cannot assess risk on a map you do not have.

The platform underneath does not change the exercise. Whether the site runs on Webflow, WordPress, Shopify, Ghost, or a custom build, the question is about who fills which directory, not about the CMS. As a Certified Webflow Partner most of what I look at is Webflow, and the audit is identical either way.

Then ask one question per directory. Would this content be worth publishing if it lived on its own domain with no inherited authority? If yes, keep it and improve it. If the honest answer is that it only works because of where it sits, you are holding the exact pattern Google described, and the regional difference in enforcement is not a plan.

The third step is editorial control. If someone else writes it and nobody on your side edits it, approves it, or is accountable for it, then it is not really your content in any sense a search engine would recognise. Ownership shows up in the same trust signals that make a site legible to Google in the first place, and those signals are absent on rented pages almost by definition.

Is this a sign that Google is softening on spam?

I do not read it that way. Google kept the policy, kept the manual actions, kept the spam policy listing, and kept the reconsideration process. It changed one regional enforcement mechanism and said in the same breath that it worries the regulation behind the change could stop it from protecting search results.

The broader pattern I keep seeing is that enforcement is getting more surgical, not more lenient. Section-level actions, directory-level separation, and independent ranking are all ways of saying that authority is becoming less transferable across a domain than it used to be. That is a bigger idea than this one policy.

If you have been treating domain authority as a bucket you can pour into any page, the direction of travel is against you. It is consistent with what Google's own quality guidance has been pushing toward, which is evaluating pages for what they are rather than for the company they keep.

What does this change about how I advise clients?

Very little, and I think that is the point. Shortcuts rarely arrive labelled as shortcuts. They arrive with a plausible-sounding SEO justification attached, which is exactly what makes them hard to argue with in a kickoff call when everyone in the room wants the number to go up this quarter.

What I will change is the question I ask during discovery. I now want to know who writes on your domain besides you, and whether anyone reviews it. That is a two-minute question that surfaces a category of risk most site audits skip entirely, because audits tend to look at pages rather than at arrangements.

The other thing I will do is stop treating EEA traffic as a hedge. If a client's audience is mostly European, the regional difference might delay a problem. Delay is not the same as protection, and building a content strategy on a regulatory gap is the kind of decision that looks clever for two quarters and expensive after that.

What should you do next?

Pull a list of every directory on your domain that contains content you did not write or commission. For each one, decide whether it would survive on its own. Then segment your Search Console performance by directory so a quiet decoupling shows up as data rather than as a hunch six months late.

None of that requires new tooling, and none of it requires you to have an opinion about the Digital Markets Act. It requires you to know what is on your own domain, which is a lower bar than most sites are currently clearing.

If you are staring at a site with partner pages, legacy microsites, or a resource hub that somebody else fills, and you are not sure which ones are a liability, let's chat. I look at this kind of thing all the time and I would rather tell you it is fine than watch you find out the slow way.