Great forensic SEO looks less like a checklist and more like detective work with a paper trail: a specific claim, backed by specific evidence, that leads to a specific fix. Below are illustrative examples — composite patterns drawn from the kinds of cases we see repeatedly at Salterra — showing what the method looks like when it’s done well, organized by the type of problem each one solves.
- Example: The Silent Canonical Tag Failure
- Example: Separating an Algorithm Update From a Technical Fault
- Example: Catching a Google Business Profile Suggested-Edit Attack
- Example: Confirming Negative SEO With Multiple Data Sources
- Example: Distinguishing an AI Overview Click Loss From a Real Ranking Drop
- Example: Reconstructing History for an Inherited, Undocumented Account
- What Separates a Great Investigation From a Mediocre One
Example: The Silent Canonical Tag Failure
A site migrates to a new CMS and traffic to its core pages declines gradually over several weeks rather than all at once — no cliff, just a steady erosion that’s easy to dismiss as normal fluctuation. Great forensic SEO doesn’t wait for the decline to become undeniable. A scheduled post-migration crawl diff catches that the new CMS is auto-generating self-referencing canonical tags with a trailing slash mismatch against the URLs actually being served, effectively creating thousands of near-duplicate canonical conflicts across the site.
What makes this a strong example isn’t the fix — it’s straightforward once found. It’s that the problem was caught through routine, scheduled verification rather than reactive panic three months later, when the erosion would have been much harder to reverse and much harder to prove was caused by the migration at all.
It’s also a good illustration of why a crawl diff beats a single crawl in isolation. Looking at the new site alone, the canonical tags appear valid — they point to a real, working URL. Only the comparison against the pre-migration crawl reveals that the URL they now point to isn’t the one that used to rank, which is the detail a one-off audit checklist would miss entirely.
Example: Separating an Algorithm Update From a Technical Fault
A client reports a sharp ranking decline and immediately assumes a Google penalty. A confirmed broad core update did roll out in the same window — but great forensic SEO doesn’t stop at that coincidence. The investigation pulls performance data segmented by page type and finds that only a specific content category (thin, templated location pages) lost rankings, while the site’s genuinely useful long-form guides held steady or even improved.
This is a textbook example of using segmentation to separate correlation from causation: the timing matched a known algorithm update, but the pattern of who was affected — thin pages specifically — confirmed the update was rewarding content quality rather than applying a blanket penalty. The resulting fix (consolidating or substantially rewriting the thin pages) addressed the actual cause instead of a fear-driven guess.
Example: Catching a Google Business Profile Suggested-Edit Attack
A local service business’s phone stops ringing and the owner assumes their website is broken. A forensic check of the Google Business Profile edit history — a step too many investigations skip in favor of jumping straight to the website — reveals the listing’s phone number was changed via a public suggested edit that Google auto-approved, redirecting calls to a wrong number for nearly two weeks before anyone noticed.
The strength of this example is procedural: checking GBP edit history before touching the website at all saved significant wasted effort chasing a technical SEO problem that never existed. It’s a reminder that “the website” is often the wrong place to start for a local business complaint.
Example: Confirming Negative SEO With Multiple Data Sources
A site sees a sudden ranking decline with no internal changes logged and no confirmed algorithm update in the window. A backlink profile pull in Ahrefs shows a sharp spike in new referring domains — several thousand low-quality links from unrelated foreign-language sites, all pointing to the same handful of URLs, appearing within a tight few-day window.
Great forensic SEO doesn’t stop at “we found spammy links” and declare victory. It cross-references the exact URLs targeted against the pages that actually lost rankings, confirming the attack was targeted rather than incidental, before recommending a disavow file — because disavowing preemptively or on weak evidence can do more harm than the suspected attack itself.
The patience shown here matters as much as the tools used. It would have been easy to submit a disavow file the same day the spike was noticed and call the case closed. Waiting the extra day or two to confirm the URL-level pattern turned a plausible story into a proven one, which is the entire difference between a good guess and a forensic conclusion.
Example: Distinguishing an AI Overview Click Loss From a Real Ranking Drop
A content-heavy site reports “rankings crashed” based on a falling Google Analytics organic sessions number. Pulling Search Console data by query shows something different: average position for the affected queries barely moved, but a new AI Overview began appearing above the organic results for those same queries during the reported window, absorbing a meaningful share of clicks that previously went to the site.
This example illustrates why forensic SEO increasingly has to account for the AI search era specifically. The “problem” here isn’t fixable through traditional on-page or technical work, because the site didn’t actually lose ranking position — the SERP itself changed shape. The right response is adapting content to better serve zero-click and AI-citation scenarios (clear, quotable, well-structured answers) rather than chasing a ranking fix for a ranking that never dropped.
Example: Reconstructing History for an Inherited, Undocumented Account
An agency takes over a client with no records from the previous provider and a years-long, unexplained decline the client can’t fully explain either. With no internal change log to consult, the investigation leans entirely on external archives: the Wayback Machine’s snapshot calendar to spot design and content changes over time, historical backlink data in Semrush to see when link equity was gained and lost, and Search Console’s full available history (typically around sixteen months) as the anchor for anything recent enough to still be visible there.
This example shows forensic SEO’s adaptability when the ideal data — clean internal logs — simply doesn’t exist. The method still works; it just leans harder on third-party historical sources and requires more patience to reconstruct a usable timeline.
What Separates a Great Investigation From a Mediocre One
Across all six examples, a few habits repeat: checking the cheapest, fastest sources of truth first (Manual Actions, GBP edit history) before anything elaborate; insisting on at least two independent data points before naming a root cause; and segmenting data by page type or query rather than accepting a site-wide average at face value. None of these require exotic tools — they require discipline and a refusal to guess.
Frequently Asked Questions
Are these examples based on real client cases?
They're illustrative composites built from patterns we see repeatedly across real investigations, not any single client's specific data, presented this way to demonstrate the method clearly without exposing confidential details.
What's the common thread across all of these examples?
Every one relies on at least two independent pieces of evidence lining up before a root cause is named, and each starts with the cheapest, fastest checks before moving to more elaborate analysis.
Why does the Google Business Profile example matter so much for local businesses?
Because it illustrates how often a "website SEO problem" reported by a local business owner is actually a listing-level issue that has nothing to do with the site itself, and checking GBP first can save weeks of misdirected effort.
How is the AI Overview example different from a traditional ranking drop?
The site's actual ranking position didn't change — the SERP itself changed shape by adding a feature above the organic results. The fix is different too: adapting content for AI-citation quality rather than chasing a technical or on-page ranking problem.
What should you do if there's no internal change log to work from?
Lean on external historical sources — the Wayback Machine, historical backlink data from tools like Ahrefs or Semrush, and whatever Search Console history is still available — to reconstruct a usable timeline from the outside in.
Why is checking Manual Actions the very first step in almost every example?
Because it takes under a minute, is completely free, and immediately confirms or rules out an entire category of possible causes before any other, more time-consuming investigation begins.
Terry has 30+ years in software and SEO. He’s the founder of Salterra Digital Services and SEO Spring Training, host of the Roundtable SEO Mastermind, and lead instructor at SEO University — teaching the exact tactics his team uses on client work.
Continue learning
Ready to master this?
This guide is one lesson from the Forensic SEO course. Get every lesson, framework and checklist — plus the full 38-course catalog — inside SEO University.
Practitioner-focused training across the full digital marketing stack — from technical SEO to conversion optimization and the AI search era. By Salterra Digital Services, since 2011.