Backlink Audit and Disavow

A backlink audit is a systematic review of the links pointing to a site, identifying patterns that contribute to authority, patterns that may damage it, and opportunities to clean up or strengthen the profile. The disavow file is Google’s mechanism for telling the algorithm to ignore specific backlinks.

Most sites do not need to disavow, and Google’s published advice is narrower than the industry’s habit. The tool is for one situation, and Google states it as a two-part test: you should disavow “only if” you have “a considerable number of spammy, artificial, or low-quality links” pointing at your site, and those links “have caused a manual action, or likely will cause a manual action”.¹ Both conditions, not either. Where that applies, cleanup matters a great deal. Everywhere else, the links are already being handled without you.

The tool is also on a downward trajectory. Bing removed its equivalent in October 2023, saying its systems “can now differentiate between natural and unnatural links, and we can ignore or discount the latter without affecting the former”.² Asked whether Google would follow, John Mueller said: “At some point, I’m sure we’ll remove it.”³

When is a backlink audit worth doing?

After a manual action. Google sends a manual action notice via Search Console for unnatural links. Cleanup is required to lift the penalty.

After a noticeable algorithmic suppression. A sudden organic drop coinciding with a known link-related update (Penguin in past years; modern equivalents in spam updates) warrants a full audit.

Before a major link campaign. Understanding the existing profile shapes what kinds of links to pursue and avoid.

Annually or post-acquisition. A baseline audit once a year, or after acquiring a new site, surfaces problems that have accumulated quietly. Auditing and disavowing are separate activities: a routine audit is for understanding the profile and finding opportunities, and should not end in a disavow file by default.

What should you look for in a backlink audit?

Pull the full backlink profile from Ahrefs, Semrush, or a combination. Then categorise the links by:

Source domain quality. Authority, traffic, content type. Major publications, industry blogs, university sites, government domains: high quality. Generic directories, expired-domain blogs, comment spam, link farms: low quality.

Topical relevance. A link from a relevant niche site is more valuable than one from an unrelated site. Audits often surface large clusters of low-relevance links from scraped or auto-generated content.

Anchor text patterns. High exact-match concentration on commercial terms is the classic red flag. A natural profile has a varied mix dominated by branded and naked-URL anchors.

Link velocity. Sudden spikes in link acquisition can indicate either a successful PR campaign (good) or a negative SEO attack or paid link campaign (problematic). Look at the time-series chart in Ahrefs or Semrush.

Link source country and language. A UK-targeted site with a sudden influx of links from Russian, Chinese, or Indonesian domains is unusual; investigate.

Link types. Editorial links in body content vs sidebar widgets, footer links, profile links. The distribution should skew editorial.

Patterns that warrant action

The categories of links most commonly disavowed:

• Comment spam. Bulk-generated comments with backlinks on unrelated blogs.
• Forum profile links. Backlinks from auto-created forum profiles, signature links on low-quality forums.
• Spammy directories. Generic auto-approve directories of the kind that proliferated in 2008-2012.
• Article spinning networks. Low-quality auto-generated content sites that exist to host links.
• Link farms and PBNs. Networks of interlinked sites whose only purpose is link manipulation.
• Negative SEO attacks. Sudden inflows of clearly toxic links following a competitive interaction.

The categories that are NOT worth disavowing in most cases:

• Low-quality but genuine sites that happen to mention your brand
• Old guest posts on sites that have since declined
• Foreign-language sites that legitimately reference your content
• Aggregator and scraper sites that copy your content with attribution

Google’s algorithm is generally good at identifying and ignoring low-quality links automatically. SpamBrain, described by Google as “our AI-based spam-prevention system”, is built to detect both sites buying links and sites passing them, and Google’s stated aim is to “nullify these unnatural links at scale”.⁴

The wording of the outcome matters more than it looks. Google says “ranking may change as spammy links are neutralized and any credit passed by these unnatural links are lost”.⁴ The link stops counting; the site is not demoted for having received it. A ranking drop after a spam link is nullified is the loss of credit you should never have had, not a punishment, and no disavow file restores it. Mueller’s summary of the practical position: “Most spammy / paid / placed / swapped links are just ignored nowadays. It’s rare you’d need it.”³

Are “toxic links” a real thing?

Not at Google. The term, and the toxicity scores attached to it, are vendor constructs with no documented counterpart in Google’s systems. John Mueller has said so directly, answering a question that quoted a tool’s toxicity percentages back at him: “The concept of toxic links is made up by SEO tools so that you pay them regularly.”⁵ On the tools themselves: “I’d consider it a big red flag if any SEO tool reported on ‘toxic links’ and suggested you need to clean it up regularly, that’s been wrong for many years now. Don’t fall for it.”³

This page uses the phrase because the industry does and readers search for it, not because it names anything Google measures. A toxicity score tells you what a vendor’s model thinks of a link. Whether that corresponds to Google’s treatment of it is undocumented, and no vendor has published evidence that it does.

Google speaks for Google, and the usual caution applies: Google has an interest in discouraging link work in general, so its denials are not neutral. But the commercial incentive runs at least as strongly the other way. A recurring subscription to monitor a problem the vendor defines, scores, and then sells you the cleanup for is not a disinterested position either.

How do you use the disavow file?

Google’s first instruction is not the file. “First and foremost, we recommend that you remove as many spammy or low-quality links from the web as possible.”¹ For manual-action recovery this is not a formality: documented removal effort is what a reconsideration request rests on, and the disavow file is the fallback for links you genuinely could not get taken down.

The disavow file is a plain text file uploaded via Google’s Disavow Tool. Note: the tool is only accessible via URL-prefix properties in Search Console. It is not available for Domain properties.¹ If your default property is a Domain property, add a URL-prefix version (https://yourdomain.com/) to Search Console to access it. Format:

# Comment lines start with #
# Domain-level disavow (recommended for most cases)
domain:spamdomain.com

# URL-level disavow (rarely necessary)
http://example.com/specific-page.html

Domain-level disavow is preferred for almost all cases. It tells Google to ignore all links from the specified domain, present and future.

The domain: directive also works at whole-TLD scope. This is undocumented but confirmed: asked about a client receiving bulk spam links from .xyz domains, John Mueller said “If you’re sure that it’s what you want to do, you can use ‘domain:abc’ in the disavow file. Keep in mind that you can’t carve out specific domains if you like some, but if you find the TLD is almost only annoying spammers, it’ll save you time.” He was equally clear about why it is not in the documentation: “Given how big of a hammer it is, I don’t know if it’s something we should really suggest in the docs. I’m sure all TLDs have some good sites.”⁶ Take the reluctance as the guidance. It exists; it is almost never the right instrument.

Uploading a new list replaces the previous one entirely rather than adding to it, and a Cancel Disavowals option removes every disavowal for a property.¹ The file is reversible, which is worth knowing before reading the risks below.

After uploading, Google processes the file gradually. Effects are typically visible within several weeks for manual action recovery, longer for algorithmic effects.

Risks of disavowing

The disavow tool has real downside risk if used carelessly:

• Disavowing legitimate links removes their authority benefit
• Disavowing too aggressively can suppress rankings even on sites with healthy profiles
• Disavowing instead of fixing the underlying issue (paid link practices, PBN reliance) doesn’t address the root cause

The general principle: disavow as little as possible to address an actual problem, not as a routine cleanup activity. If you can’t articulate why a specific link is harmful, don’t disavow it.

The negative SEO question

Negative SEO refers to deliberate link attacks intended to harm a competitor’s rankings. The phenomenon is real but exaggerated; Google’s algorithms now ignore crude link attacks automatically in most cases.

Links are not the only vector, though. A more effective modern attack skips links entirely: filing a fraudulent DMCA copyright takedown to deindex a rival’s page from Google Search. The disavow file does nothing against this, so index-status and Lumen-database monitoring belong alongside backlink monitoring in a complete negative-SEO watch.

When to take negative SEO seriously:

• Sudden, large-scale acquisition of obviously toxic links following a competitive event
• Links from clear spam networks rather than just low-quality sites
• Coincident ranking drops that align with the new link patterns

When to ignore it:

• Background-noise levels of low-quality scraper or aggregator links (every site has these)
• Foreign-language or off-topic links that don’t form an attack pattern
• Links you discover during routine monitoring with no associated ranking impact

Audit tooling

The dominant tools for backlink auditing:

• Ahrefs Site Explorer. Most detailed backlink index; best for full-profile audits.
• Semrush Backlink Audit. Good integration with disavow workflows. Its toxicity scoring is a vendor model rather than a reading of Google’s view, so treat the score as a sorting aid, not a verdict.
• Google Search Console > Links. Free, and the only view sourced from Google itself, but explicitly a partial one: “This report isn’t a comprehensive list of every link on your site. It shows a sample of internal and external links”.⁷ Useful for spotting patterns; not a full profile export.
• Majestic. Alternative backlink index; useful as a cross-reference.

For thorough audits, pull data from at least two sources; backlink databases differ enough that any single source has gaps.

Frequently asked questions

How often should I audit my backlink profile?
Annually for most sites. After major events (manual actions, ranking drops, suspected attacks) immediately. Continuously for sites in highly competitive or adversarial niches.

Will Google penalise me for not disavowing toxic links?
Generally no. Google’s algorithm increasingly ignores rather than penalises low-quality links. The disavow tool is for cases where the algorithmic ignoring isn’t sufficient, which is the minority of cases.

Does disavowing affect AI search visibility?
No. Disavow is a Google tool with no counterpart at any AI engine, and link signals correlate weakly with visibility in AI answers in any case. Nothing in a disavow file changes whether ChatGPT, Perplexity or an AI Overview cites you.

Can disavowing help me recover from a Google penalty?
For manual actions tied to unnatural links, yes; cleanup is required as part of the reconsideration process. For algorithmic suppression, the relationship is less direct; disavow may help but improving content quality and earning higher-quality links matters more.

Footnotes

1. Disavow links to your site — Google Search Console Help ↩ ↩² ↩³ ↩⁴

2. Bing Webmaster Tools to Remove Disavow Links Feature in October 2023 — Bing Webmaster Blog ↩

3. Google Will Remove Its Disavow Link Tool — Search Engine Roundtable, 6 May 2024. Mueller’s remarks in a thread on when the tool is and is not needed. ↩ ↩² ↩³

4. December 2022 link spam update — Google Search Central Blog ↩ ↩²

5. Google Again Blasts The Concept Of Toxic Links — Search Engine Roundtable, 27 May 2024. Mueller on Reddit, answering a question that cited a tool’s toxicity percentages. ↩

6. Google’s undocumented method to disavow a whole TLD — Search Engine Land. Mueller’s remarks were posted on Bluesky in March 2026. ↩

7. Links report — Google Search Console Help ↩