What if an SEO company uses black hat techniques?
Stop the work in writing, get a complete record of what was done, and only then decide what to undo, because the consequences fall on your site rather than on the company. Google’s spam policies state: “Sites that violate our policies may rank lower in results or not appear in results at all.” Google’s help page on disavowing links names this situation directly, noting that “you or an SEO that you’ve hired may have built bad links to your site” through paid links or other link schemes. What you do next depends on what the company did. Work on your own pages and links placed on other sites are handled differently, and for links, the most aggressive response is not the safest one.
Stop the work and get the record
Tell the company in writing to stop all link building and all changes to your site until you have reviewed what was done. Then ask for a complete record: every link it built or paid for, with the linking page and the anchor text; every page it created; every change it made to your site’s code, redirects, and settings; and the services or networks it used to get the links. Every later step depends on this list.
Check your access at the same time. If the company set up your Search Console property, confirm that you are listed as an owner, because one of the cleanup steps below can only be taken by a property owner.
Find out whether it is affecting you
Open the Manual actions report in Search Console. If Google has taken manual action, the report says so and names the issue, and the cleanup then ends in a reconsideration request. If the report shows no issue, the site is not in the clear on that basis alone. Google says it detects violations “through automated systems and, as needed, human review that can result in a manual action.” A drop in traffic without a manual action can still trace back to the work, and the record you asked for is how you match its dates against the dates your traffic changed.
Undo the work on your own site
Some black hat work sits on your own pages, where you have full control. The spam policies describe cloaking as “presenting different content to users and search engines” to manipulate rankings, and scaled content abuse as “when many pages are generated for the primary purpose of manipulating search rankings and not helping users.” Hidden text and sneaky redirects belong to the same list. Remove hidden text and any code that serves search engines something different from visitors, take out redirects that send visitors somewhere search engines are not sent, and remove or rewrite mass-produced pages so that what remains serves readers. This part of the cleanup does not wait on anyone else.
Links on other sites: apply Google’s test first
Links the company placed on other sites are harder, because you do not control those sites. Google’s first recommendation is to “remove as many spammy or low-quality links from the web as possible.” In practice, that means asking the company, and the sites that host the links, to take them down.
For links that remain, Google’s help page on disavowing links sets a test before you use the tool. It says: “In most cases, Google can assess which links to trust without additional guidance, so most sites will not need to use this tool.” It advises disavowing only when both of two conditions hold: you have “a considerable number of spammy, artificial, or low-quality links” pointing to your site, and the links “have caused a manual action, or likely will cause a manual action, on your site.” It calls the tool “an advanced feature” and warns that, used incorrectly, it “can potentially harm your site’s performance in Google Search results.”
Under that test, a manual action for unnatural links, or a campaign of bought links large enough to make one likely, is a reason to disavow. A handful of poor links with no manual action is not.
How the disavow file works
If the test is met, a few rules on the same help page decide whether the file does what you intend. Only a property owner can upload it, and each property holds one list: “Uploading a new list for a property will replace any existing list for that property.” A new file therefore has to include everything you still want disavowed, not only the latest additions. The tool “does not support Domain properties.” A list applies to the property it was uploaded to and any child properties, so a site with both http and https properties needs a list for each. Google says it “can take a few weeks for Google to incorporate your list into the index” as it recrawls the web. The same page notes: “Disavowed links will continue to be shown in the Links report.” That report will therefore not show you whether the file took effect.
Before any file is uploaded, ask to see it, along with the record of removal requests sent to the sites that host the links.
What to do about the company
Whether the company that did the work should also do the cleanup is your decision, and the record is the best basis for it. A company that hands over a complete list of what it built and changed gives you something to check its cleanup against. One that cannot or will not produce that list leaves you without the information the cleanup needs, whoever does it. Whichever provider you use next, ask it to list every link it builds and every page it creates in its regular reports, so that you can see the work as it happens.