White hat vs black hat link building

By Bill Hartzer · Hartzer Consulting · 25+ years in search, domains and expert witness work

Where the labels came from

The hat metaphor is borrowed from mid-century Westerns, where the audience could tell the hero from the villain by headwear. It entered computer security first, then SEO, and it has been doing more harm than good in link building for about fifteen years.

As commonly used, white hat means tactics that comply with search engine guidelines, and black hat means tactics that deliberately violate them. That much is coherent. The trouble is what happens next: the labels stop describing techniques and start describing people. Practitioners adopt one as an identity, defend it as a moral position, and then have to justify everything they do as belonging to it. I have watched agencies describe buying links as white hat because they liked the sites they bought from, and I have watched people refuse to submit a business to a genuine industry directory because it felt too much like link building.

Neither of those is a judgment about risk. They are judgments about self-image, and self-image is a bad input to a decision about whether a client's revenue is exposed.

What the rules actually say

There is a real line, and it is published. Google's link spam policies — part of its search spam policies — describe what it considers manipulative link behavior. The categories named there have been broadly stable for years and include buying or selling links that pass ranking credit, excessive link exchanges, large-scale article marketing and guest posting campaigns with keyword-rich anchor text, automated link creation, and requiring a link as a condition of a contract or agreement.

Running through all of it is one test, stated by Google in various forms over the years: was the link editorially given by the site owner, freely, without your having induced it? That question resolves nearly every case that the hat labels leave ambiguous.

Take an affiliate link. Money is involved, which sounds black hat. But Google's own guidance is that affiliate links should carry an attribute marking them as such, and a properly marked affiliate link is entirely fine. Take a guest post. Nothing in the policies forbids writing for another publication; what they name is large-scale campaigns with keyword-rich anchor text. The technique is not the offense. The intent, the scale and the anchor text are.

Read the policies yourself rather than reading commentary about them. They are short, they are public, and most of the arguments in this industry are conducted by people who have not.

Why grey hat is mostly a marketing term

"Grey hat" is offered as the pragmatic middle: slightly risky tactics, used carefully, by grown-ups. In practice it functions as permission. It lets a vendor sell something they know is against the published policies while implying the risk is a matter of taste.

Look at what it is used to describe and the pattern is obvious. Buying links, but from nice sites. Guest posts, but paid for. Niche edits, but on real blogs. In every case the underlying transaction is the one the policies name explicitly, with an adjective attached to make it feel considered. The link was not editorially given. Money or reciprocity produced it. That is not a middle position; it is the same position with better manners.

Where genuine ambiguity exists, it is not on that axis at all. A sponsorship of a local charity that publishes a supporter page is genuinely ambiguous — you paid, and the link is real and relevant and would exist for any supporter. So is sending a product to a reviewer. So is a testimonial. These are judgment calls about whether payment induced the link or merely accompanied it, and they are worth thinking about carefully. Calling that "grey hat" tells you nothing about how to think it through.

A more useful framing: four risk grades

Every tactic in this site's reference carries one of four grades. I use these instead of hats because they answer the question a business actually has, which is not "is this virtuous" but "what happens to me if this goes wrong".

• Safe. The mechanism does not breach the published policies even when executed clumsily. Broken link building, resource pages, local links, reclamation, original research, digital PR. The downside of doing these badly is wasted time, not lost rankings.
• Situational. Legitimate at honest volume, a detectable pattern when industrialized. Guest posting, directories, testimonials, sponsorships, the skyscraper approach. The technique is fine; the scale and the anchor text decide.
• High-risk. Squarely inside what the policies describe as link schemes. Paid links, niche edits, private blog networks, tiered schemes, forum profile links, press releases bought for the links. These sometimes work. That is why the market exists. The question is not whether they work but what the exposure is.
• Obsolete. Once effective, now inert. Blog comment links, social bookmarking, article directories. Not dangerous so much as a pure waste of the only resource you cannot buy back.

The advantage of this framing is that it forces the conversation onto consequences. "This is grey hat" invites a debate about philosophy. "This is high-risk, the downside is a manual action, and you carry it, not the agency" invites a decision.

What actually happens when it goes wrong

Two distinct outcomes, routinely confused, with very different severity.

Devaluation is silent. The links stop counting. Nothing appears in Search Console, no message arrives, and your rankings either drift or simply fail to improve. This is by far the most common outcome, and it is the reason so many people believe a tactic is still working — they are looking at links that exist but count for nothing. The cost is everything you spent, and the diagnosis is difficult because the absence of an effect looks like the presence of nothing.

A manual action is a human reviewer at Google deciding your site has unnatural links, recorded in Search Console with a description. This is rarer and much worse. It affects rankings you already had, it requires a reconsideration request to lift, and the request has to demonstrate that you removed or disavowed the offending links and changed the practice. Recovery takes months and is not guaranteed.

The asymmetry matters. If a high-risk tactic works, you gain some ranking for some period. If it fails quietly, you lose the investment. If it fails loudly, you lose the business you already had. And in nearly every arrangement I have reviewed, the vendor who recommended it carries none of those three outcomes.

How to decide, in practice

Four questions, in order. They settle almost every case faster than any argument about hats.

1. Would this link exist if search engines did not? If a real audience reaches you through it, or a real editor chose it, you are on solid ground. If the link's only function is to be counted, you are not.
2. Did money or reciprocity cause it? Not merely accompany it — cause it. If yes, the correct handling is an attribute marking the link as sponsored, and if attributing it makes the link worthless to you, that tells you what you were buying.
3. Would you show it to the client's board, or to a Google reviewer, without editing the description? This is the most reliable gut check I know.
4. Who carries the downside? If the answer is the site owner and the upside accrues to a vendor on a monthly retainer, the incentives are not aligned and you should weight the risk accordingly.

Module 8 of the course covers the risk side in operational detail — spotting a genuinely unnatural profile, when disavow actually applies (rarely), and how manual actions are handled. Worth reading before you commission anything from the high-risk column, and worth reading afterward if you have inherited a profile you did not build.