We bought 3,700 backlinks. Google demoted us in 9 days

On 15 August our search impressions were 287. On 16 August they were 35. Average position went from 19 to 63 in about 48 hours, across every page and every country at once.

We had bought backlinks. This is what that actually looks like from the inside, with the numbers.

I am publishing this because we sell a content tool and it would be dishonest not to, and because the specifics are more useful than the general advice. Everyone knows not to buy links. Almost nobody publishes the timeline.

What we bought

A "3,000-link, 3-level backlink pyramid." The spec sheet described 200 Level 1 links pointing at trylyra.ai, 600 Level 2 links pointing at the Level 1 pages, and 2,200 Level 3 links pointing at Level 2. It promised links "sourced exclusively from websites with a DR 50+ rating, independently verified using Ahrefs," delivered on a "30 to 40 days drip-feed approach" using "white-hat link-building methods."

I want to be precise about the failure here, because "we got scammed" is the comfortable version and it is not quite true. A tiered link pyramid is a link scheme. Google's link spam policy describes it plainly. The document even sells it as supporting "recovery from previous penalties," which in hindsight is the tell: nobody markets legitimate link building as penalty recovery. We had enough information to say no.

What we did instead was try to be careful about it. We wrote the vendor a detailed brief specifying an anchor-text distribution of 35% branded, 30% partial match, 15% naked URL, 15% exact match and 5% generic, spread across six target URLs. The brief included this sentence, which I now find hard to read:

Two hundred links landing on one domain with exact-match commercial anchors is the pattern most likely to attract a manual review.

What was delivered

Ten exact-match anchors, each spread across 23 to 38 domains: "aeo tools," "seo automation," "ai visibility checker," "how to rank in ai search," "content marketing automation" and five more. The brief had asked for ten target keywords. The vendor used them as the entire anchor profile.

The article was not ours either. We supplied one, with seven contextual links. What actually got published was a machine-spun rewrite of it, carrying one link, to the homepage, with a keyword anchor spliced mid-sentence: "how a brand appears in [ai visibility checker] AI-generated responses."

The one genuinely useful thing the vendor provided was a tracking export listing all 3,700 URLs. It showed the pyramid was fiction. We sampled pages from the supposed Level 2 and Level 3 batches, on domains our backlink tool had not even discovered yet, and both linked directly to our homepage. Every one of the 3,700 URLs had one of our ten money keywords in its slug. It was not a tiered structure. It was 3,700 keyword pages all pointing at the same place.

The nine days

The detail that matters diagnostically: average position moved as much as impressions did. A reporting lag drops impressions and leaves position flat. Ours went from 19 to 63, which means pages fell from page two to page six and simply stopped being served.

Our best page, a technical piece on GitHub App permissions, went from position 8 to position 52 and from 435 impressions a day to 12. It is still indexed. It is just not competitive for anything any more.

What it was not: there was no manual action, nothing was deindexed, 210 pages stayed in the index and Googlebot kept crawling daily. Google's August 2026 spam update began rolling out on 18 August, two days after our collapse, so it did not cause this, though it landed on a site that fit its profile precisely.

The part that is our fault, not the vendor's

We had published 182 posts in 62 days on a two-month-old domain. Three a day, peaking at nine in a single day. Twelve of those posts were platform migration guides sharing an identical heading skeleton, ending with the same two headings every time. Twenty-eight more were "X alternative" pages built from one template.

Over 90 days, those 182 posts produced 24,900 impressions and 101 clicks. A 0.4% click-through rate. Twenty of them had never received a single impression.

The links were the trigger. The corpus was the reason it worked. A site with real engagement absorbs a bad link event; a site publishing three templated posts a day does not.

We had even published our own advice against this. Our post on how many blog posts per month argues for two to four, not sixteen. We were running three a day while it sat on the same blog. And the mechanism Google used here is the one described in our own piece on what Google actually says about AI content: the policy targets pages made mainly to rank, at any volume, by any method.

What we did

Disavowed 227 domains. We built the file from the vendor's own campaign export merged with an Ahrefs referring-domains export, which caught 82 domains Ahrefs had not yet discovered. One thing that cost us an hour: Search Console's disavow tool does not support domain properties. Selecting sc-domain: returns "Domain properties are not supported at this time." You need a URL-prefix property, which auto-verifies if the domain property is already DNS-verified.

When we later asked the vendor to stop, they said they could not, and sent us a disavow list of their own. It contained 215 domains. Ours already covered all of them, plus twelve they had left out, including four SEO link-shops. A vendor who can hand you a precise list of every domain they used can also stop using them.

Cut the blog from 188 posts to 133. Twelve migration guides became one. Twenty-eight tool-comparison pages became one. Four thematic clusters collapsed into four pillars. Fifty-seven URLs now carry permanent redirects into the page that absorbed them. Nothing was deleted without a redirect. If you are doing the same exercise, our guide to content pruning is the decision framework we used, written before we needed it.

Fact-checked the merged pages, and found twenty errors in our own published content. A quotation attributed to OpenAI that OpenAI never wrote. A Google policy change we stated as fact with no source behind it. A widely-copied claim about Squarespace exports that turns out to be a myth. A statistic traced to a "study" that appears not to exist, its supporting figures lifted from an unrelated analysis. Prices that had moved. Titles attributed to the wrong companies.

That last one is the uncomfortable part, so I will be direct about it. These were written by our own pipeline, with a review stage that verifies links. Every link resolved. The failures were in a different layer: a link that returns 200 while the quoted sentence is not on the page, a citation chain that ends at a blog citing another blog, a confident sentence with no citation attached for the checker to check. And the reviewer is a model with the same priors as the writer, so a plausible fabrication reads as plausible twice.

We have changed three things as a result: every quotation is now string-matched against the fetched source, every statistic must carry a citation or be flagged, and citations are followed to depth two so a laundered number gets refused. The mechanics of that stage are documented in how AI content fact-checking actually works, now updated to match what it does rather than what we intended it to do.

Stopped publishing while we did all of it.

What we would tell someone about to do this

The cost-benefit was never close, and not for the reason you would expect. We lost about one click a day, because 24,900 impressions were producing 101 clicks. The traffic was not converting and its disappearance changed no revenue number. What it cost was four days of engineering time, a two-month-old domain's head start, and the ability to say we had never done this.

A business with real organic revenue would have lost something that mattered.

Three things worth knowing if you are in this position now:

1. Diagnose on position, not impressions. If both fall together, it is a demotion. If impressions fall and position holds, it is probably reporting lag and you should wait before doing anything.
2. Get the vendor's URL export. It is the only complete record of what was built, it is better than any backlink tool's discovery, and it will disappear when their tracking page expires.
3. Do not migrate the domain. Redirects pass the link profile including the spam, the content problem moves with you, and a two-month-old domain has nothing worth fleeing.

Recovery from an algorithmic demotion arrives when the algorithm next reassesses, which historically means the next spam update, three to four months out. There is no faster path and we are not going to pretend otherwise. We will publish the follow-up either way.

We build a tool that writes blog posts and opens them as pull requests, specifically so a human sees every claim before it publishes. Writing this made us fix three real gaps in that review stage. If you want the version that exists after we found them, it is here.

Try Lyra → · Talk to the founder