"Spammy free host" manual action: when a hosting service is judged as a whole

How a WordPress network becomes a free host

In a Multisite network, Network Admin → Settings → Registration settings has an option to allow both user accounts and sites to be registered. Turn that on without controls and you have built a free blog host. Spammers find these quickly, because a subdomain on an established domain is more appealing than a fresh one.

Typical signs you have a problem:

• Thousands of subsites created in a short period, many with random names.
• Subsites whose content is pills, casino, loans, streaming or essay-writing pages.
• A spike of new users who never log in again after creating a site.
• Complaints or abuse reports from other services about links from your network.

The same logic applies to any platform where users get their own space: a portfolio host, a school or community blog network, a free landing-page builder.

Cleaning the network

Google's recommended actions start with removing existing spam accounts. On a Multisite network, WP-CLI can list and remove sites in bulk:

# Sites registered recently, newest first
wp site list --fields=blog_id,url,registered --format=csv | sort -t, -k3 -r | head -100
# Mark a spam site as spam (reversible) or delete it outright
wp site spam 482
wp site delete 482 --yes
# Users with no posts on any site
wp user list --network --fields=ID,user_login,user_registered

Marking a site as spam makes it unavailable to visitors while you decide. Delete what is clearly abuse. Then change the registration setting so new sites need approval, require email confirmation, and add a spam-screening service to the sign-up form. Google's abuse-prevention guidance adds several more ideas worth adopting on a network:

• Publish a clear abuse policy and show it during sign-up.
• Keep content from new, unestablished users noindexed until they build a track record, and mark links in untrusted content nofollow or ugc.
• Require manual approval for certain actions, such as the first site a new account creates.
• Use a CAPTCHA or similar check so only humans can register.
• Block IP addresses that keep returning with spam.
• Watch for signals such as forms completed impossibly fast, many sign-ups from one IP range, odd user agents, sites full of redirects, ads or encoded JavaScript, and content in a language your network does not serve.

Telling the review team what changed

Google asks you to contact the technical team at the hosting service about the action; if you are that team, that step is done. Once the spam sites are gone and sign-ups are controlled, select Request Review in the Manual actions report for the affected property. Give scale and describe the new controls:

Our Multisite network allowed open site creation. We removed 5,300
spam subsites and 7,900 accounts, disabled open site registration,
and now approve each new site manually after email confirmation.
Abuse reports go to abuse@ourdomain.example and are handled daily.

Reviews for any manual action can take days to weeks, and Google tells you the outcome by email. Because the whole service was affected, legitimate sites on it may have lost visibility too; tell those site owners what happened so they are not left guessing.

If you are a site owner on an affected host

You cannot file the request yourself unless you control the service's Search Console property. Your options are to ask the host what it is doing, or to move. Moving to your own domain on paid hosting also means you own your URLs and can redirect them in future, which a free subdomain does not allow.

When you move, export your content, import it into a new WordPress install, and redirect old URLs if the host lets you. If it does not, link from your old pages to the new ones where possible, then submit the new site's sitemap in Search Console. The site migration guide covers the redirect side. There is no guarantee a new domain ranks where the old one did.