What a reformed black hat taught me about balance in the SERPs: a conversation with Martin McGarry

I waited until 2026 to ask somebody else whether WordPress comment spam ever ends. It was 2006 and my blog was overwhelmed with it. 2016, still overwhelmed. This year I logged into a client site and found 200,000 spam comments sitting in the filter. So when Martin McGarry told me he installs Disable Comments before anything else, I knew we’d get on.

Martin runs Search Assistance in the UK. He’s done some kind of SEO for about 20 years, professionally for ten, and by his own account started in the “murky world of building WordPress websites and trying to hack links,” fell into the black hat trap and went clean about a decade ago. He calls himself a reclusive SEO, and this was, he said, probably the first real podcast he’s ever done. He works with small local businesses, a few US healthcare clients and a lot of iGaming, and if you’ve seen him on LinkedIn or Bluesky he was probably complaining about black hat. By the end of the hour you’ll understand why.

Listen to the episode: https://www.youtube.com/watch?v=X4s7o82vq3I · https://the-unscripted-seo-interview-podcast.castos.com/episodes/martin-mcgarry-on-black-hat-balance-wordpress-exploits-and-perspective-as-currency-in-ai-search

WordPress’s flexibility is the thing that keeps getting your clients hacked

Martin doesn’t use WordPress for himself anymore (his own site is “pretty rubbish… like most SEOs, it’s terribly SEO’d”), but every client does. His problem was never the core. It was the amount of effort it took to do the basics, and the sheer amount of stuff that could be injected. His first moves on any WordPress build:

• Install Disable Comments (it used to be called Globally Disable Comments) and switch comments off.
• Turn off the automated files, taxonomies, categories and tags, which is the first thing you do on the technical side anyway.
• Keep the RSS feed and the API, because that’s where WordPress is great for automation.

“The flexibility of WordPress is also its curse,” he says. Somebody told him it’s the most secure and most insecure platform in the world at the same time: a hack shared on a dark forum spreads globally, and gets patched fast for the same reason.

If you’ve done local SEO, you know his intake pattern. Singing acts, tradespeople, small businesses. “Most of the time they come to you with an exploit of some kind, and it’s a plugin, obviously.” His case in point is RevSlider, rotating homepage banners nobody watched that grew into full PowerPoint presentations nobody saw, with a “mega security flaw.” Carousels around 2010, then RevSlider, then parallax and single-page sites. His rule holds up: “the cool trends in WordPress tend to lead to exploits.”

My gripe is the incentive. Out of the box you get four walls, and you add plugins for the dividers, the heating and the plumbing until it’s a mishmash. You can run a very secure WordPress environment with Wordfence, firewalls and locked-down permissions. You can also watch an install get hacked on day two because the password was one, two, three, four, five. I’ve seen both.

Google didn’t judge your content. It judged whether it trusted your site

Martin had listened to earlier episodes on the Helpful Content Update and brought a pattern I hadn’t weighted enough: the sites that vanished were WordPress sites on the same not-quite-custom themes the industry had promoted as simple to scale. Everybody could be a creator, and Google didn’t want that competition filling the index with infinite content.

“The helpful content update was not about finding helpful content. It was about finding a profile of a website that looked helpful. It wasn’t about the content on the site. It was about the entity graph or the knowledge graph. Would you trust that platform? Would you ask that person or that company for help?”

Danny Sullivan later said the wording was probably incorrect. By then, Martin says, we’d all fallen into the trap of asking why our helpful content wasn’t being acknowledged. Our theory on this show had been distance to seed, authority passing from trusted sites in a niche. The two don’t conflict. Chris Tweeten put it as Google deciding how much of the internet it’s willing to service after it incentivised every plumber to write a leaky-faucet page.

What Martin holds onto is that Google “still calls words on pages.” Text on the site matters. The prospectors just thought a single platform full of words was enough, and for a while it was. “Google used to be for everybody… It’s a really strict discipline now and the threshold for entry has been put up by Google.”

Why the levers stopped working in iGaming

Martin’s core position is balance, and he’s careful about what he means by it. A lot of SEO contravenes Google’s guidelines and he wants it that way: “We do want levers that we can pull as SEOs.” What he can’t accept is a top 20 of churn-and-burn sites, because his clients need to stick around. You can’t do what the black hats do or the site disappears. “So you either do nothing and let the black hat carry on, or you stand up and say something.”

The iGaming deluge, in his telling, comes from “offshore illegal companies,” and that changes the argument. If a reputable pharmaceutical company had to compete with offshore illegal drug suppliers, Google would clear it straight away. iGaming, he thinks, has been left, handled algorithmically by a Google that doesn’t understand regulation country by country. In the UK those brands are contributing to crime. Put that next to the canonical redirect abuse Timothy Malmros showed me, where operators buy old domains and push the traffic to an end destination, and you can see why Martin calls it a perfect storm.

Then there’s the mechanism, and it’s the most useful thing in the episode. Telegram link sellers have scaled an old trick, adding links to brands with their own anchor advertising their services, to hundreds of thousands of sites and millions of links. They work, and expired domains work, because of a grace period: Google needs to see things in the SERPs before it can understand whether users want them.

• A spam page ranks for two or three days.
• It gets tanked almost instantly. Ten more are waiting to be loaded.
• Meanwhile Google reassesses the organic listings that were already there. Martin has seen sites disappear for no reason, dug in, and found Telegram sellers diluting their anchor text.
• “You’ve got 20 sites that are under a temporary link penalty; your expired domain just slots in instantly.”

“We get one spam update a year that we know of,” he says. We were recording in the March core update window and he was hoping for an announcement.

The disavow routine that brought a client’s rankings back

A door manufacturer I worked with is the case that made Martin’s grace-period theory click. Somebody in that niche was buying about 20 domains a month, standing the same CMS content library up on different themes, and spraying junk links and irrelevant anchor text (image hotlinks, direct links, all of it) at everybody in the top 10. Everybody except one site. I suspect, and can’t prove, that the one site paid for it. Their rankings rose because everyone else got pushed down.

The counter was a hygiene program. Aggressive disavow, checked every week. Another ten sites launched, another ten disavowed. Once we kept at it, the rankings that had tanked climbed back and the anchor text profile cleaned up. Unglamorous — and it worked.

If you consult for anyone in a competitive vertical, that weekly check is the thing to steal. A site can be under a temporary penalty it never earned, and nobody notices until it’s on page three.

Martin’s response is the quote you’d want on the wall:

“I just want balance back. I want to be able to pull levers and for them to work, not to pull levers and end up on page three.”

He doesn’t mind black hats on social media saying they’re the ones making regular money and testing the waters. “It’s a bit of yin and yang.” But there’s still got to be an organic business. “At the moment, it’s not balanced at all. It’s swamped.”

Who buys a flip-flop for the rain?

People in tropical countries, and that answer is Martin’s whole argument for what still wins in AI search. Matt Brooks at SEOteric says ChatGPT is your most popular but least trained customer support representative, so the question for Martin was what a company selling precast concrete walls or sunrooms should actually do about it.

He started with a content gap. The companies he meets either scaled and have too much content or neglected it and have too little, and almost nobody looks at the traffic they already have to ask whether they’ve got enough unique, informational content for their own users. Then:

“You have a perspective on the product that you sell. And your opinion and your perspective is going to be your currency in the future.”

The facts (size, scale, colour, the technical elements of the product) can’t move and AI digs them out straight away. Perspective is what the models are looking for. Flip-flops are for summer; that’s the general aspect everyone publishes. The rain angle is, in his words, “not a unique selling point, but it’s a unique angle,” and you only find it down in the granular use cases and buying personas. There are a thousand perspectives on a product from a thousand personas. “AI can’t reproduce perspective or opinion.”

My version: every human has two things, a butthole and an opinion, and ChatGPT has neither. It’s the world’s biggest yes man. The editorial judgment we take for granted is the part humans are good at.

The one tip Martin gives everyone learning SEO right now

Try the API. Open Visual Studio, access the OpenAI or Gemini API in your terminal, and ask it a raw question. “What you get back is junk.” That’s the lesson: the standalone LLM on its own is rubbish, in his opinion, and something in the background is augmenting the chat results. There’s RAG. OpenAI has been caught Googling.

Once you understand those extra requests, you know why he’s certain “SEO is not dead, first of all, because these LLMs are having to go out and get extra information from somewhere,” and you know where your site needs to be positioned for that augmentation to find it.

One thing to add: read Stephen Wolfram’s breakdown of what an LLM is. It’s math, predicting output from a lexicon. It reads like English but it isn’t conveying thought. If you don’t understand that footing, you will never fully optimise for it.

Martin’s last idea is the one worth sitting with. Nobody is talking about optimising RSS feeds or APIs, and if part of SEO goes server-side, that might be the next llms.txt. If an external system you want to show up in is taking input, figure out how to optimise the input. He expects a whole raft of LinkedIn courses on it by next week.

So: which of your client sites has a link profile you haven’t checked in a month? And what does your client know about their product that nobody else would think to write down?

Listen to the full episode: https://www.youtube.com/watch?v=X4s7o82vq3I · https://the-unscripted-seo-interview-podcast.castos.com/episodes/martin-mcgarry-on-black-hat-balance-wordpress-exploits-and-perspective-as-currency-in-ai-search

Find Martin McGarry: Search Assistance · LinkedIn · Bluesky. Or the SEO Community Slack, where he’s “constantly on there whining about black hat.”