The link building strategies that still work for an SMB in 2026 all share one property: they earn links as a byproduct of publishing something valuable, not as the goal itself. Google’s own Link best practices state that only an <a href> element is crawlable, and Google’s spam policies (updated 15 May 2026) define “link spam” as “the practice of creating links to or from a site primarily for the purpose of manipulating search rankings” — a definition that rules out link buying, PBNs, guest-post commerce and comment spam. What is left is a small set of durable moves — digital PR, reference-worthy assets, expert-sourcing, first-party data, community contribution — that any team can defend to Google, to leadership and to a future audit.
Operating rule
If you cannot describe why a link happened without embarrassment, do not pursue that tactic. Google’s own definitions are the honest filter.
What still works for link building in 2026
The link-building conversation has moved on twice since 2019: first when Google reframed E-E-A-T, then when generative search added a new success surface. What has not changed is Google’s definition of a crawlable link and the spam-policy language it uses to describe manipulation. Every durable strategy I still run for an SMB starts from those two boundaries and works outward — not from a tactic blog and inward.
The core question I ask before running any link move: could I describe how this link happened to a Google reviewer, a client CFO and a future audit without editing the answer? If yes, the tactic is durable. If no, the tactic is a landmine — sometimes profitable, always dangerous, and impossible to defend when it detonates.
What Google itself says about links
Reading rule
Every strategy on the site should trace to a specific sentence in either the Link best practices page or the Spam policies page. Anything that cannot trace is opinion, not doctrine.
Google’s Link best practices page (updated 10 December 2025) is short and clear: “Google can only crawl your link if it’s an <a> HTML element with an href attribute.” The editorial reading, given that sentence, is that JavaScript-only links, span-based clickables, and non-standard router attributes are unreliable acquisition targets. If a placement does not resolve to an <a href> on the linking page’s rendered HTML, treat it as a mention, not a link.
Google’s Spam policies page (updated 15 May 2026) is where every link tactic should be pressure-tested. It defines link spam as “the practice of creating links to or from a site primarily for the purpose of manipulating search rankings” and lists forbidden behaviour explicitly: buying or selling links for ranking, automated link creation, guest posts or press releases with optimised anchor text distributed across multiple sites, forum comments with optimised links, and keyword-rich or hidden links embedded in widgets. The policy does allow sponsored links “properly qualified with rel='nofollow' or rel='sponsored'” — that is legitimate advertising, not link building.
Visual slot: Add a crawlable-vs-not-crawlable link anatomy diagram here — real <a href> on the left with all valid variants (relative path, query string, class attributes), and non-crawlable patterns on the right (JS handlers, span-based clickables, routerLink). Replace this block with the final visual later.
| Google source | What it establishes | Anchoring sentence | Do not extend into |
|---|---|---|---|
| Link best practices (2025-12-10) | Only <a href> is crawlable | “Google can only crawl your link if it’s an <a> HTML element with an href attribute” | A ranking guarantee for any single link |
| Spam policies (2026-05-15) | Definition of link spam + forbidden tactics | “Link spam is the practice of creating links to or from a site primarily for the purpose of manipulating search rankings” | Any pay-for-ranking arrangement |
| SEO Starter Guide (2025-12-10) | Content quality drives visibility | Content people find compelling and useful “will likely influence your website’s presence in search results more than any of the other suggestions in this guide” | An engagement-metric guarantee |
| Structured Data intro | Google Search Central is definitive over schema.org | “You should rely on the Google Search Central documentation as definitive for Google Search behavior, rather than the schema.org documentation” | Schema as a link substitute |
| How Search Works (2025-12-18) | Hundreds of factors, no single lever | “Relevancy is determined by hundreds of factors” including user context; “ranking is done programmatically” | A specific weight for links in the ranker |
Five strategies I’d run for an SMB
Strategy rule
The five strategies are an editorial synthesis of what Google’s policies allow — they are not a Google-endorsed list. Pick one and hold it for a quarter before adding a second.
The following five moves are the ones I still run for SMB clients in 2026. Each is defensible under Google’s Link best practices and Spam policies, each can be measured, and each earns links as a byproduct of publishing value rather than as the primary goal.
1. Digital PR that earns real citations
Digital PR is not press-release seeding. It is the practice of turning something you actually know — data, an operational insight, a market observation — into a story a journalist can quote by name. The link is a byproduct of being the credible source in a piece the journalist wrote for their own reasons. It respects Google’s Spam policy because the journalist is not compensated for the link and the anchor is natural (usually your brand name). It works because publications with editorial oversight are exactly the sources generative search engines cite.
2. Reference-worthy assets that people cite
Reference-worthy means “would you cite this if you had not written it?” Definitions, comparison tables, checklists, decision frameworks, and technical explainers that answer a real professional question earn citation links over time. Google’s SEO Starter Guide (updated 10 December 2025) puts it plainly: content people find “compelling and useful will likely influence your website’s presence in search results more than any of the other suggestions in this guide.” An SMB does not need thousands of pages; it needs ten that a professional in the field would actually save.
3. First-party data as a link magnet
The most durable link-earning asset an SMB can create is an original data set. Aggregated anonymised numbers from your own operations — quotes-to-close rate by category, average project duration, seasonality curves — become the reference journalists and analysts cite because nobody else has them. The link that comes with a data citation is defensible, natural in its anchor, and often repeated by follow-on writers over time.
4. Expert sourcing on other people’s platforms. Being the expert quote in someone else’s article, podcast episode or panel is the fastest legitimate way for an SMB with a strong operator perspective to earn credible links. HARO-style platforms, journalist requests on LinkedIn and industry-body newsletters remain the standard channels. The link is natural, the anchor is your name or company, and the placement respects Google’s Spam policy because the outlet chose the quote for its editorial value.
5. Community contribution that produces referral traffic first. Answers on Reddit, Stack Exchange, GitHub discussions, LinkedIn, community forums and public Slack workspaces earn links less often than the previous four, but the ones they do earn are extremely defensible. The rule for this channel is simple: contribute where you would still be contributing without the link. If the link is the only reason for the answer, the answer usually reads like the reason for the answer, and it will neither be upvoted nor cited.
Visual slot: Add a five-strategy map here — one card per strategy showing the primary output artefact, the natural anchor pattern, the honest measurement metric, and the “why Google is fine with it” note. Replace this block with the final visual later.
| Strategy | Primary artefact | Honest measurement | Why Google’s policies allow it |
|---|---|---|---|
| Digital PR | Sourced quote or data in a journalist’s piece | Named mentions with follow / nofollow ratio | Editorial decision by the publisher |
| Reference-worthy asset | Definition, framework, comparison table | Repeat-visit + citation-anchor pattern | Content quality is Starter Guide’s primary lever |
| First-party data | Original data set with methodology note | Follow-on citations across writers | Original evidence is inherently non-manipulative |
| Expert sourcing | Named quote in another outlet | Named brand mentions in outlets that matter | Publisher chose the quote for editorial value |
| Community contribution | Substantial answer with natural link | Referral traffic + community response | Contribution driven by professional value |
What I’d skip: what Google’s spam policy flags
The Spam policies page is not a suggestion. Every tactic on the list below traces to an explicit prohibition on Google’s own page. Running these on behalf of an SMB is not a productivity risk — it is a business-continuity risk, because a manual action or algorithmic penalty on the small pool of pages that produce revenue can end the site as an acquisition channel.
- Buying or selling links for ranking: prohibited outright; sponsored links must be qualified with
rel="nofollow"orrel="sponsored". - Automated link creation: any script, service or software that generates links to your site.
- Guest posts and press releases with optimised anchor text distributed across many sites: named as spam when the anchors are keyword-rich and the placements repeat.
- Forum comments with optimised links in the post or signature: explicitly listed as spam.
- Widgets or templates that inject keyword-rich, hidden or low-quality links into other sites’ footers: named as spam.
- Private blog networks: not explicitly named, but “widely distributed links in the footers or templates of various sites” covers the pattern.
- Reciprocal exchange schemes (“link to us and we link to you”): the same manipulative intent falls under the link-spam definition.
Visual slot: Add a spam-policy flag board here — one row per prohibited tactic with the exact Google policy sentence and the safer alternative. Replace this block with the final visual later.
Measuring link building the honest way
Measurement rule
DA, DR and TF are third-party proxies, not Google metrics. Track them if you like, but report the four numbers below to leadership — they connect to actual business outcomes.
The four numbers I report on link building are unfashionable. They are also the four that survive the second quarter of scrutiny. First, linking root domain (LRD) growth month over month, filtered to sources you would show to a client. Second, brand-mention-with-link ratio — of the times your brand appeared in a piece this quarter, how many included a link at all? Third, referral traffic quality — sessions, engagement time and downstream conversion action from linking sites. Fourth, appearance in Google Search Console’s generative AI performance report, which shows impressions from AI Overviews and AI Mode; Google announced its introduction on the Search Central Blog in June 2026, and rollout is gradual.
The recent peer-reviewed evidence is a useful sanity check for the AI-side of the metric. Xu, Iqbal and Montgomery’s arXiv preprint “Measuring Google AI Overviews” (2605.14021, under peer review) reports 13.7% AI Overview activation across 55,393 trending queries; Grossman et al.’s “How Generative AI Disrupts Search” (arXiv:2604.27790, accepted ACM SIGIR 2026) reports 51.5% activation on a different 11,500-query set with Jaccard similarity below 0.2 between engines. The takeaway for link building is not “traditional links stopped mattering”. It is that the linking-root-domain measure alone does not tell you your AI-Search share.
Visual slot: Add a measurement dashboard sketch here — LRD growth, mention-with-link ratio, referral traffic quality, GSC gen-AI impressions. One column per metric with definition, source, target trend and honest limitation. Replace this block with the final visual later.
A 90-day SMB scenario
Assume a services SMB with a small marketing team and no full-time PR resource. The scenario below is illustrative — no real business named, no fabricated outcome. In month one, the team picks the single strongest first-party data set already available (aggregated anonymised project-duration numbers by category) and turns it into a written reference asset with a methodology note. Nothing else is launched.
In month two, the team reaches out to three journalists who have written about the same category in the previous six months, offering the data as a source with a specific angle the story could take. Two journalists ignore the outreach. One writes a piece that names the SMB as the data source with a link back to the reference asset. The team also participates in three community discussions where the same data would answer a live professional question; two of them earn a natural mention with a link.
In month three, the team measures. Four new linking root domains, three from editorial contexts and one from a community platform. Brand-mention-with-link ratio has moved from a baseline the team wrote down in month zero. No PBN links, no paid placements, no guest-post chains. The team documents the outcome — the specific data set, the specific pitches, the specific responses — and continues the same pattern in the next quarter. The point of the scenario is the shape of the discipline, not the specific number.
Visual slot: Add a 90-day SMB scenario timeline here — three columns for months 1/2/3 with the specific move, the measurement action and the honest outcome expectation. Clearly labelled Assume… banner. Replace this block with the final visual later.
Want to know which of the five strategies actually fits your SMB?
An authority and link audit maps your current link profile against Google’s Link best practices and Spam policies, scores the five strategies against your operational reality, and returns a written 90-day plan — no backlink volume promise, no DA/DR guarantee.
Common mistakes I still see
Patterns that repeat every quarter
These patterns appear in almost every SMB link-building conversation I have. They are not novel; they are just resilient. Each of them is answered by a specific line in the Google source pages I quoted above.
| Mistake | Google policy sentence that answers it | Safer alternative | Metric that catches it |
|---|---|---|---|
| Chasing DA / DR numbers | Ranking is “programmatic” and driven by “hundreds of factors” | Report linking-root-domain growth + client-showable sources | LRD growth trend |
| Guest-post campaigns with keyword-rich anchors | Guest posts / press releases with optimised anchor text on many sites are link spam | Single genuinely editorial contribution to a real publication | Anchor variety per LRD |
| Buying “sponsored” placements as ranking help | Sponsored links must carry rel="nofollow" / rel="sponsored" | Treat sponsorship as advertising, not link building | Ratio of sponsored vs earned |
| Publishing a large content library nobody cites | SEO Starter Guide: quality > every other suggestion | Ten reference-worthy assets over one thousand thin pages | External citation count per asset |
| Reporting AI Overview impressions in isolation | How Search Works: hundreds of factors, no single weight | Pair AI Overview impressions with SEO click baseline | Combined report to leadership |
Read the table above with the linking-root-domain growth chart open on the second screen. The mistakes that look serious on the chart will be different from the ones you would have named from memory — and the safer alternative will already be in reach for a team that has committed to the five strategies for a full quarter.
- Chasing DA / DR numbers instead of linking-root-domain growth from sources you would show to a client.
- Believing “guest posts are still fine” without reading Google’s specific language about optimised-anchor placements distributed across multiple sites.
- Buying links through an intermediary and telling yourself the label “sponsored” was implicit.
- Building a large content library nobody would cite and calling it a link magnet.
- Reporting AI Overview impressions to leadership without the SEO click baseline for comparison.
- Measuring only the placements that came back, never counting the pitches that were ignored.
- Assuming a competitor’s PBN is “getting away with it” — you do not know what their private next quarter looks like.
Start with the one link you already earned
Before designing a new strategy, find the one editorial link your site earned that you did not directly pay for or ask for. Write down what the piece was, who wrote it, and — critically — why they linked. Nine times out of ten the reason is a specific sentence, data point or definition on your site that the writer needed. The rest of your link-building plan is that pattern, held for a year.
Publish the baseline audit internally with dates and sources. If the honest score is “we have one editorial link and we do not know why we got it”, the next repair is a reference-worthy asset built around that same reason. If the honest score is “we have three editorial links from journalists we already talk to”, the next repair is a first-party data set that gives them a new reason to link next quarter.
Two quarters of this discipline compound in a way that a hundred guest-post pitches never do. The team learns which shape of asset gets cited, the journalists learn which shape of source you are, and the linking-root-domain growth chart starts to slope up in a way you can defend to Google, to leadership and to any future audit.
Visual slot: Add a common-mistake control board here — mistake, Google policy sentence that answers it, safer alternative, metric to watch. Replace this block with the final visual later.
Score your links against Google’s own guidance, not a vendor deck.
An authority-and-links consulting engagement inventories your existing backlinks against Google’s Spam policies, identifies the assets doing the earning today, and returns a written 90-day plan an SMB team can actually run — no backlink packages, no ranking promise.
Sources and evidence
- Google Search Central — Make your links crawlable (updated 10 December 2025)
- Google Search Central — Spam policies for Google web search (updated 15 May 2026)
- Google Search Central — AI features and your website (updated 10 December 2025)
- Google Search Central — SEO Starter Guide (updated 10 December 2025)
- Google Search Central — How Google Search works (updated 18 December 2025)
- Google Search Central — Introduction to structured data
- Google Search Console Help — Generative AI performance report
- Google Search Central Blog — Introducing Search Generative AI performance reports (June 2026)
- Xu, Iqbal, Montgomery — “Measuring Google AI Overviews”, arXiv:2605.14021 (under peer review)
- Grossman et al. — “How Generative AI Disrupts Search”, arXiv:2604.27790 (accepted ACM SIGIR 2026)
FAQ
Is guest posting still safe in 2026?
Not the way most guides describe it. Google’s Spam policies explicitly name “guest posts and press releases with optimised anchor text distributed across many sites” as link spam. A single genuinely editorial guest contribution to a publication you would name to a client is a different animal from a guest-post campaign of ten similar-looking placements with keyword-rich anchors. The former is fine; the latter fits Google’s own definition of manipulation.
Do I still need to worry about DA and DR?
DA (Moz) and DR (Ahrefs) are useful third-party proxies but they are not Google metrics. Google’s How Search Works page describes ranking as programmatic and driven by hundreds of factors including user context. Track DA/DR internally if you like, but do not report them to leadership as if they were the goal. Linking-root-domain growth from sources you would defend to a client is a more honest headline number.
What about buying “sponsored” placements?
Google explicitly allows sponsored links “properly qualified with rel='nofollow' or rel='sponsored'“. That is advertising, not link building — the placement will not pass ranking credit. If a vendor sells you “sponsored” placements and then implies you will get ranking benefit from them, they are describing a spam-policy violation. Read the exact policy language before signing.
Does an SMB really need first-party data?
You need something a journalist or analyst cannot find elsewhere. First-party data is the most durable version of that; but a well-designed methodology explainer, a category-specific decision framework, or an operator-observation series can also produce citations if it is the only place the specific reference exists. The requirement is uniqueness plus usefulness, not proprietary data specifically.
How do I know if a competitor is doing something bad?
You often cannot know without their internal records. Some competitors on obvious PBNs will eventually take a manual action; some will not. Reporting a suspected pattern to Google is possible but not a business strategy. The disciplined move is to make your own site so defensible that a competitor’s algorithmic or manual action would not change your relative position much either way.
How long before link building shows up in results?
Longer than you want and shorter than a pure-organic content strategy. A specific editorial link earned this quarter can start moving keyword impressions inside weeks; the cumulative effect on brand-mention share and generative-AI citations plays out across quarters. Report your progress against the four honest metrics (linking-root-domain growth, mention-with-link ratio, referral traffic quality, GSC gen-AI impressions), not against a rank promise.