Google processes roughly 8.5 billion searches per day. For the companies on this list, the moment they stopped playing by the rules or simply stopped paying attention that number became their worst enemy.
SEO failures come in 2 flavours. There are the deliberate cheats: the brands that looked at Google’s guidelines, decided they were optional, and got publicly annihilated for it. And then there are the operational catastrophes: the multi-million-pound migrations executed by people who clearly never read anything about what happens when you move a website without a redirect strategy.
There’s also businesses who get caught up with sheisters (you know, the SEOs or agencies that tout expertise that they don’t have, or, where they cut corners with grey/black hat SEO to save money and speed up results).
Anyhow both are instructive. Both are spectacular. All ten should be pinned to the wall of every digital marketing department in the country or at least remembered by some of us older SEOs who’ve been through everything from panda to penguin.
Here they are, ranked by the sheer scale of damage, embarrassment, and financial fallout.
#1 J.C. Penney (2011): The New York Times Called. Google Listened.
Image credit: https://searchengineland.com/new-york-times-exposes-j-c-penney-link-scheme-that-causes-plummeting-rankings-in-google-64529
The brand:
One of America’s largest department store chains, founded in 1902. Annual revenues in the billions. A household name, well, in the US at least.
What they did:
Throughout the 2010 holiday season, jcpenney.com ranked #1 on Google for almost every commercial search term imaginable. Not just “JC Penney dresses.” We’re talking “living room furniture,” “Samsonite carry-on luggage,” “area rugs,” “bedding,” “skinny jeans,” and hundreds more all queries where JC Penney had precisely zero organic right to dominate. SEO analyst Doug Pierce described it as “the most ambitious attempt at link spamming he had ever heard of.”
When the New York Times commissioned a forensic SEO investigation, the answer became abundantly clear. Thousands of entirely unrelated websites casino sites, engineering forums, completely hollow link farms were linking back to jcpenney.com with hyper-targeted exact-match anchor text. Someone had orchestrated a coordinated, large-scale paid link network across multiple holiday seasons, building enormous artificial authority for the retailer on demand.
The NYT took their findings directly to Google. Matt Cutts, then head of the web spam team, reviewed the evidence and confirmed it violated guidelines. Within hours, Google manually intervened.
Who was responsible for this? We don’t know but it was likely a result of external influences – perhaps an SEO agency that they had hired at the time who had used FFA / link farms etc. Some people say it was SearchDex (their apparent SEO agency at the time) – Searchdex denied it.
How they got hit:
At 7 p.m. on 9 February 2011, JC Penney was still #1 for “living room furniture.” By 9 p.m., they were at position 68. For “Samsonite carry-on luggage,” they went from #1 to #71 in two hours flat. Across 59 tracked keywords, their average position dropped from 1.3 to 52 in a matter of days right in the middle of the post-holiday clearance period.
JC Penney fired their SEO agency, SearchDex, and claimed they knew nothing about the links. It’s worth noting they were spending over $2.46 million per month on Google Ads at the time, which made the subsequent penalty all the more pointed.
The lesson:
Google will burn a brand publicly if the alternative is looking complicit. And no advertising spend, no brand size, no holiday season revenue will protect you. The manual penalty was applied in hours. The reputational damage took years.
#2 Forbes, CNN, Time, WSJ: Vouchergeddon (2024)
The brands:
Forbes. CNN. Time. The Wall Street Journal. Reuters. USA Today. The Washington Post. The Daily Express. The Mirror. In other words: the entire top tier of English-language digital media.
What they did:
From roughly 2020 onwards, major publishers discovered a lucrative side hustle. Instead of building their own affiliate content, they licensed their domain authority to third-party companies. Under sections like “Forbes Advisor,” “CNN Underscored,” and “WSJ Buyside,” these publishers hosted entire affiliate marketing operations best VPN guides, coupon codes, insurance comparisons, product reviews written by external agencies with zero editorial oversight. The strategy, known in the industry as “parasite SEO,” worked brilliantly. A product review published on Forbes.com, regardless of quality, would rank almost automatically on the strength of Forbes’s 20-year domain authority.
It was, in effect, renting out a century of editorial credibility to the highest bidder.
How they got hit:
Google announced its “Site Reputation Abuse” policy in March 2024, began enforcement via manual actions in May 2024, and then in November 2024 days before Black Friday and Cyber Monday, the most valuable week in affiliate marketing delivered the killing blow.
The numbers were insane. Forbes Advisor saw its top-3 keyword rankings collapse from an estimated 10,402 keywords to less than 3,000 keywords in a single month a traffic cost decline Semrush valued at approximately $8.6 million. Time’s affiliate section, Time Stamped, lost 97% of its search visibility. The Wall Street Journal’s Buyside dropped 77%. CNN Underscored fell 63%. These weren’t quiet algorithmic adjustments they were targeted manual actions, and Google’s Danny Sullivan confirmed it publicly.
Several publishers had entire site sections deindexed. Forbes Advisor’s health section disappeared from Google Search entirely. URLs that had previously ranked for millions of commercial queries now returned 404 errors or redirected to homepages. Forbes subsequently fired multiple freelancers as it scrambled to remove the offending content and file reconsideration requests.
The lesson:
Google does not care how old your domain is or how many Pulitzer Prizes your newsroom has won. If you rent your authority to spam, you lose your authority. The era of brand immunity is over.
Saying that, even in 2026, spam is still rife with self promotional listicles et al.
#3 BMW Germany (2006): The Original “Death Penalty”
The old story is still available here: http://news.bbc.co.uk/1/hi/technology/4685750.stm
The brand:
BMW. The car. One of the most recognised brands on the planet.
What they did:
BMW’s German website had a structural problem. Its main navigation was built entirely in JavaScript, which Google’s crawlers at the time couldn’t parse at all, back in the day Google did not render any JS. So rather than fix the underlying architecture, BMW’s team created “doorway pages” separate HTML pages stuffed with keyword-rich text targeting terms like “used cars” (gebrauchtwagen) that showed to Google’s crawler but instantly redirected human users to the real BMW website using JavaScript.
One of the captured doorway pages contained the phrase “used cars” forty times. The actual bmw.de homepage contained it twice.
How they got hit:
Google’s web spam team, led by Matt Cutts, detected the doorway pages in late January 2006. On 4 February 2006, Cutts announced on his personal blog that BMW.de had been removed from Google’s index entirely. PageRank: zero. SERP visibility: zero. A search for “BMW Germany” no longer returned bmw.de. It was the first time a globally recognised brand had received what the SEO industry immediately dubbed the “Google death penalty,” and it set off alarm bells across every digital marketing department on earth.
BMW moved fast. They stripped the doorway pages, filed a re-inclusion request, and were reinstated within roughly five days. But the damage was done in terms of public humiliation and industry precedent, the story ran everywhere. The BBC, The Register, Handelsblatt. A spokesperson for BMW argued the pages were only meant to “give search engines an idea of what was behind them,” which satisfied precisely nobody.
The lesson:
BMW’s speed of reinstatement was partly a function of brand leverage, and the SEO community was quick to notice the contrast with how smaller sites were treated. But the principle holds: cloaking is Google’s cardinal sin. Show your users and your crawler the same content, every time, no exceptions.
#4 Expedia (2014): 25% Gone. The Stock Moved.
Image source: https://www.seroundtable.com/expedia-google-penalty-17989.html
The brand:
One of the world’s largest online travel agencies, publicly traded, billions in annual revenue.
What they did:
Expedia had, over a number of years, accumulated an enormous and deeply unnatural backlink profile. The usual playbook: paid links with exact-match anchor text (flights, hotels, car rentals, vacations), low-quality guest posts on link farms, directory submissions, press release link wheels, sitewide footer links, and microsites built purely to pass authority. SEO investigator Nenad Simicevic publicly documented the profile in a detailed blog post, the SEO community picked it up, Google, apparently, was paying attention.
Expedia’s incoming Marketing Director Martin Macdonald publicly denied any involvement in the link-building programme. Google declined to comment. Expedia declined to comment.
How they got hit:
In January 2014, Expedia lost approximately 25% of its Google search visibility almost overnight. The drop was significant enough to move financial markets Expedia’s share price fell 3% in the days following the visibility collapse, as analysts began connecting the organic traffic decline to revenue projections. Whether it was formally a manual penalty or an algorithmic action has never been officially confirmed, but the industry consensus was clear: the unnatural link profile triggered Google’s response, and it cost them enormously.
The lesson:
At scale, an unchecked link profile can become a liability that sits on your balance sheet. The risk isn’t just rankings it’s investor confidence, quarterly revenue, and public credibility.
#5 Sports Illustrated (2023): The AI Ghost-Writers
The brand: Sports Illustrated. Founded in 1954. Fifty-nine years of some of the finest sports writing in American history. Ali on the cover. Michael Jordan. The swimsuit issue. A cultural institution.
What they did:
Under the ownership of The Arena Group, SI began hosting a product review section, si.com/review, operated by a third-party company called AdVon Commerce. The reviews covered products like volleyballs, fitness equipment, and outdoor gear. On the surface, nothing unusual. Below the surface, it was a catastrophe.
In November 2023, investigative outlet Futurism published a detailed report revealing that multiple SI authors complete with biographical descriptions, headshots, and claimed areas of expertise simply did not exist. Their profile photographs were sourced from AI-generated image marketplaces. Futurism found the exact same faces available for purchase online. One author, “Drew Ortiz,” was described as having “spent much of his life outdoors” and was “excited to guide you through his never-ending list of the best products to keep you from falling to the perils of nature.” Drew Ortiz was not a person.
When Futurism reached out to SI for comment, the fake author profiles began quietly disappearing from the site. Then they reappeared under different fake names. Then the articles were reattributed to those new fake names with no editor’s note.
How they got hit:
The PR fallout was immediate and catastrophic. The SI Union issued a statement saying they were “horrified.” Staff writers expressed public disgust. The Arena Group terminated its relationship with AdVon Commerce. But from an SEO perspective, the longer-term consequence was the demolition of E-E-A-T signals across a huge swathe of SI’s content. Google’s Helpful Content system is explicitly designed to evaluate Experience, Expertise, Authoritativeness, and Trust. Fabricated authors with AI-generated headshots are, by definition, the antithesis of all four.
The broader context matters: Google had been warning about exactly this class of abuse for over a year. Sites caught manufacturing fake authority signals don’t just lose rankings they become cautionary examples that inform Google’s future algorithm development.
The lesson:
E-E-A-T is not just a box-ticking exercise. The humans behind the content are increasingly the content. If your “expert” is a JPEG purchased from an AI headshot marketplace, Google will eventually find out. So will the New York Times
#6 Overstock (2011): The .EDU Discount Scheme
The brand:
Overstock.com. One of America’s major e-commerce retailers. Launched in 1999, went public in 2002.
What they did:
Overstock ran a programme offering a 10% discount to university students and staff. In exchange, the participating universities linked back to Overstock.com from their educational domain (.edu) pages pages that listed student discounts and perks. Overstock also encouraged students and faculty to blog about the site using specific anchor text.
This wasn’t especially subtle. .edu links had long been considered particularly valuable by the SEO community, partly because of an outdated assumption that educational domains were more “trustworthy” by definition, and partly because Google’s early algorithms genuinely weighted them heavily. Overstock was exploiting this systematically.
How they got hit:
In January 2011 weeks after the JC Penney story broke and Google was clearly in a heightened enforcement mood Google demoted Overstock.com significantly across its core commercial terms. The penalty made headlines partly because of the timing (Google was publicly signalling a zero-tolerance posture on link manipulation) and partly because the tactic had been so widely used across the industry. Overstock became the example of what happened when you tried to manufacture authority through institutional credibility you hadn’t earned.
The lesson:
.edu and .gov links aren’t magic. They never were. Any link acquired through an incentive programme rather than genuine editorial endorsement is a paid link by another name.
#7 Toys “R” Us (2009): $5.1 Million. No Redirects.
The brand:
The world’s most famous toy retailer. A genuinely iconic brand, and at the time of this particular decision, a brand trying to dominate e-commerce.
What they did:
In 2009, Toys “R” Us acquired the domain toys.com for $5.1 million. The logic was sound an exact-match domain with existing authority, inbound links, and search equity, pointing at their core commercial category. A power move.
Then they migrated the content without implementing 301 redirects.
Every URL on the old domain every product page, every category page, every inbound link from years of accumulated editorial coverage pointed at dead ends. The “link juice,” the crawl equity, the signals Google had been accumulating about those URLs for years: gone. Because nobody had implemented the single most fundamental technical requirement of any domain migration.
How they got hit:
Rankings evaporated. The organic traffic they had purchased at a premium price of $5.1 million failed to transfer, because the technical infrastructure required to transfer it was never built. What made this story particularly instructive for the industry was the scale of the opportunity cost: the domain itself was valuable. The SEO benefit was real and available. It was simply never claimed because a basic, free technical step was skipped.
The lesson:
No migration checklist. No redirects. $5 million wasted. The rule is so simple it appears in every SEO primer ever written: when you move URLs, you map them. Every single one.
#8 H&M (2022–2023): The Hreflang Nightmare
The brand:
H&M Group. One of the world’s largest fashion retailers, operating in 77 markets with a digital presence across dozens of localised domains and subfolders.
What they did:
During various site updates and international migrations, H&M introduced significant errors in their hreflang implementation. Hreflang is the attribute that tells Google which version of a page to serve to which audience critical for a retailer operating German, French, Swedish, US, UK, and dozens of other localised experiences simultaneously.
When hreflang breaks at scale, the results are ugly. The US English version of a product page begins appearing to German searchers. The German domain gets served to UK users. Google’s geographic and linguistic targeting collapses into a confused patchwork of cannibalization, where your own international variants compete against each other for the same search real estate and everyone loses. This isn’t a hypothetical: H&M saw meaningful declines in organic visibility across multiple European markets, with traffic redistributing in ways that no revenue model accounts for cleanly.
How they got hit:
Unlike a manual penalty, this wasn’t a single dramatic event. It was a slow bleed the kind that takes months to diagnose, because the traffic doesn’t disappear, it just goes wrong. The UK version starts ranking in the Netherlands. The Swedish version bleeds into Denmark. Conversions drop because users are landing on the wrong language. The compound cost across a retailer of H&M’s scale is significant but because there’s no “Google penalty” headline, it often receives less attention than the black-hat disasters above.
The lesson:
For any brand operating multiple international versions of a site, hreflang is not optional maintenance. It is load-bearing infrastructure. Errors at this level don’t get flagged in a Search Console notification they get discovered six months later when someone finally joins the dots on a traffic anomaly spreadsheet.
#9 CNET (2023): They Deleted Their Own Archive
The brand:
CNET. One of the most respected technology journalism and consumer review sites in the world, operating since 1994. Thirty years of tech coverage.
What they did:
In summer 2023, CNET quietly began mass-deleting thousands of old articles from its website. When Gizmodo exposed the practice in August 2023, an internal memo emerged explaining the rationale: the company believed that removing old, low-traffic content would “send a signal to Google that says CNET is fresh, relevant and worthy of being placed higher than our competitors.”
Content deprecation “sends a signal to Google that says CNET is fresh, relevant and worthy of being placed higher than our competitors in search results,” the document stated.
I guess they hadn’t got Google’s memo:
Google’s Danny Sullivan, their Public Liaison for Search, responded publicly and immediately: “Are you deleting content from your site because you somehow believe Google doesn’t like ‘old’ content? That’s not a thing!” John Mueller, Google’s Senior Search Analyst, added further context: content age alone should never be the deciding factor. Editorial judgment matters. Historical significance matters. The content CNET was deleting included original reporting, historical tech coverage, and legacy reviews that had accumulated inbound links and organic traffic over decades.
How they got hit:
The strategy backfired in the most ironic way possible. Rather than improving overall site quality signals, the aggressive mass deletion removed high-performing legacy content, destroyed backlink equity pointing at URLs that now 404’d, and triggered further reputational damage at a moment when CNET was already under fire for a separate AI-generated content scandal. The site’s total organic footprint declined rather than improved.
The lesson:
Content pruning, done correctly with proper auditing, can be valuable. Content mass-deletion based on a misunderstanding of how Google works carried out without checking which pages actually have traffic, backlinks, or historical significance is just destruction. CNET paid for a lesson they could have learned for free by reading Google’s own documentation.
#10 The Daily Mail (2019): A Core Update Meltdown in Public
The brand:
The Daily Mail / MailOnline. One of the world’s most-read English-language news websites. Enormous traffic, enormous advertising revenues, and at the time of this incident, a turbulent relationship with its own digital quality signals.
What they did:
Unlike the other entries on this list, the Daily Mail didn’t break any rules. They weren’t running link schemes or farming AI content. What they had done over years of aggressive traffic-growth strategy was build a site so heavily monetised, so bloated with third-party ad scripts, trackers, intrusive display formats, and slow-loading elements, that the underlying user experience had deteriorated significantly. From a technical SEO standpoint: poor Core Web Vitals, high server response times, aggressive ad injection, and a content quality profile that mixed high-quality journalism with low-quality clickbait in roughly equal measure.
How they got hit:
In June 2019, Google rolled out a broad Core Algorithm Update. The Daily Mail’s traffic dropped by approximately 50%. What followed was almost more damaging than the traffic loss itself: MailOnline’s then-SEO director took to Google’s public Webmaster Forums to complain, publicly questioning Google’s judgment and demanding explanations. The post became widely read in the SEO industry not because the complaint was unreasonable, but because it so clearly illustrated the gap between how the site’s team understood their own quality signals and how Google’s systems saw them.
Google did not issue a manual penalty. There was no link scheme to disavow. There was simply an algorithm update that deprioritised exactly the kind of ad-heavy, user-experience-degraded content that MailOnline had been building for years.
The lesson:
Core Updates are not penalties. They are Google recalibrating what “quality” means and if your content strategy has been optimised for maximum monetisation at the expense of user experience, a Core Update will find you eventually. The appropriate response is not a forum complaint. It is a serious audit of what your site actually delivers to a user who lands on it.
The Recurring Themes
Across twenty years and ten brands, the same patterns keep appearing.
Agencies carry the risk, clients take the hit.
In the JC Penney, BMW, and Overstock cases, the brands either claimed ignorance of their agencies’ tactics or pointed the finger immediately. In every case, the brand’s domain and reputation absorbed the penalty regardless. If you’re delegating your organic search strategy, you are also delegating your brand’s risk profile.
Scale amplifies stupidity.
Every mistake on this list existed at smaller sites for years before a major brand was caught doing it. The link schemes, the doorway pages, the hreflang errors, the content mass-deletions: none of these tactics was invented at enterprise level. Scale just makes the fallout visible, measurable, and newsworthy.
Google’s enforcement is increasingly reactive to public exposure.
The JC Penney penalty followed a New York Times investigation. Forbes Advisor’s full penalty followed a widely-shared public blog post calling out the behaviour. Sports Illustrated’s consequences followed a viral Futurism exposé. Google has limited human enforcement capacity. Public pressure accelerates its deployment.
The modern era has added new failure modes.
Fabricated E-E-A-T, AI-generated content without disclosure, and parasite SEO at scale are 21st-century problems that didn’t exist when BMW was stuffing keyword pages in 2004. The brands that will appear on this list in 2030 are already making decisions today that they’ll come to regret.
