Backlink Audit: How to Find Toxic Links

Quick answer: A backlink audit is a review of every site linking to yours, to find links that break Google’s guidelines and could be holding your rankings back. Collect link data from Search Console and at least one third-party tool, group it by linking domain, then review each domain for signs of manipulation such as paid links, link networks, spammy directories and exact-match anchor text. Ask site owners to remove the worst links, then disavow the rest at domain level. Keep the good links, and do not disavow anything just because a tool gave it a poor score.

Links are still one of the strongest signals Google uses to rank pages. That is exactly why so many sites bought, swapped and automated them for years. Google’s Penguin algorithm, first launched in 2012 and last refreshed with Penguin 3.0 in October 2014, targets sites with manipulative link profiles. Because Penguin only updates periodically, a site caught by it can stay suppressed until the next refresh, even after cleaning up. An update has been expected for a long time.

Whether you have seen a drop in traffic, received a manual action message, or simply inherited a site with an unknown history, a backlink audit tells you where you stand.

When to run a backlink audit

You should audit your links if any of these apply:

You have a manual action for unnatural links in Search Console.
Organic traffic fell sharply around the date of a known Penguin update.
You or a previous agency bought links, used link schemes, or ran large directory and article submission campaigns.
You are taking over or buying a site and need to know what comes with it.
You are planning a migration and want to start the new site with a clean profile.

Even without a problem, a light review once or twice a year helps you spot negative SEO attempts or spam before they build up.

Step 1: Collect your link data

No single source shows every link. Use several and combine them.

Search Console

The Links to Your Site report under Search Traffic shows the domains Google knows link to you. Download the latest links and the sample links. It is free and comes straight from Google, so always start here. If you have not set up Search Console yet, our guide to Google Search Console covers it.

Make sure you check every version of your site that is verified: with and without www, and HTTP and HTTPS. Links can be reported against any of them.

Third-party link tools

Add data from at least one, ideally two, of these:

Ahrefs: a large, frequently updated index with good filtering by anchor text and referring domain.
Majestic: shows Trust Flow and Citation Flow, which help separate trusted links from volume links.
Moz Open Site Explorer: includes Domain Authority and a Spam Score for linking sites.
Link Research Tools: built specifically for link audits, with its own toxicity rating.

Export everything to a spreadsheet.

Step 2: Clean and group the data

Raw exports contain duplicates and thousands of individual URLs. Make the data workable:

Combine all exports into one sheet.
Remove duplicate URLs.
Extract the root domain from each linking URL.
Create a second sheet with one row per linking domain, showing the number of links, sample URLs and the anchor text used.

Reviewing by domain is faster and matches how you will disavow later. If one link from a domain is spam, the rest usually are too.

Step 3: Review your anchor text

Before looking at individual domains, look at the overall pattern of anchor text. A natural profile is dominated by:

Your brand name and variations of it.
Your URL.
Generic phrases like “click here”, “website” or “this article”.
Partial topic phrases written in a natural way.

If a large share of your links use exact-match commercial phrases such as “cheap office furniture London”, that is a strong sign of manipulation, and the domains using those anchors deserve close attention.

Step 4: Identify toxic links

Go through your domain list and mark each one as keep, remove or disavow. There is no shortcut that replaces looking at the sites. Tool scores help you prioritise, but they get things wrong in both directions.

Signs of a toxic link

Paid links that pass PageRank without a nofollow attribute, including sponsored posts and “advertorials”.
Link networks: groups of sites with similar designs, thin content and outbound links to unrelated businesses. Often found on expired domains.
Low-quality directories that accept any submission, especially those with “SEO friendly” in the title or a fee for a dofollow listing.
Article directories and spun content with keyword-rich links in the author box or body.
Comment and forum spam: signatures and comments added purely for links.
Sitewide footer or sidebar links with commercial anchors, especially from unrelated sites.
Hacked pages with hidden links injected into them.
Foreign-language sites with no connection to your market, unless you actually do business there.
Sites with obvious spam topics such as gambling, pharmacy and adult content, when you have no reason to be linked from them.

Signs of a link to keep

A real site with real content and visitors in your industry or area.
An editorial link placed because the content was useful.
Local business associations, suppliers, partners, press coverage and genuine customer mentions.
Links that send referral traffic you can see in Google Analytics.

When in doubt, ask one question: would this link exist if search engines did not? If the honest answer is no, it is a candidate for removal.

Low authority does not mean toxic

A small local blog with a low score is not a threat. Many perfectly natural links come from small sites. Disavowing them throws away value for no reason. Judge intent and quality, not metrics alone.

Step 5: Try to remove the worst links

Google wants to see an effort to clean up, especially if you are responding to a manual action. For the links marked remove:

Find a contact email from the site, its contact page or WHOIS data.
Send a short, polite removal request listing the exact URLs.
Follow up once after a week or two.
Record every attempt, including dates and responses, in your spreadsheet.

Expect a low response rate. Some site owners will ask for payment to remove links, which you should not pay. Anything you cannot get removed goes into the disavow file.

Step 6: Build and submit a disavow file

The disavow tool tells Google to ignore specific links when assessing your site. It is a powerful tool, and misuse can hurt you, so only include links you are confident are harmful.

The file is a plain text file (.txt), encoded in UTF-8 or 7-bit ASCII, with one entry per line:

# Directories that ignored removal requests
domain:spammy-directory-example.com
domain:another-link-farm-example.net
# Single page on an otherwise fine site
http://example-blog.com/bad-post/

Some practical points:

Use domain: for most entries. Disavowing single URLs often misses other links from the same site.
Comments start with #. They are ignored by Google but useful for your records.
Upload one file per property. A new upload replaces the old one, so always add to your existing file rather than starting again.
Submit it for the right version of the site. If you have moved to HTTPS, make sure the file is uploaded to the HTTPS property too.

Google processes the file as it recrawls the linking pages, which can take weeks or months.

Step 7: Request reconsideration if you have a manual action

If you received a manual action, submit a reconsideration request in Search Console after the clean-up. Explain what happened, what you did, and link to a shared document showing your removal attempts. Be specific and honest. Vague requests are usually rejected.

If your problem is algorithmic (Penguin) rather than manual, there is no reconsideration request. You need to clean up and wait for Google to refresh the algorithm.

Step 8: Replace bad links with good ones

Removing toxic links often causes a temporary dip, because some of those links were propping up rankings. The long-term fix is to earn links that are worth keeping: useful content, local partnerships, digital PR and outreach. Our guides to link building and broken link building cover practical ways to do that.

FAQ

How often should I run a backlink audit?

A full audit when you suspect a problem or take over a site, and a lighter review every six to twelve months.

Can competitors hurt me with spam links?

Google says it is good at ignoring random spam, but if you see a sudden flood of obvious spam links, adding them to your disavow file is a sensible precaution.

Should I disavow every link with a low score?

No. Tool scores are rough guides. Review the sites yourself and only disavow links that are clearly manipulative or spammy.

How long until rankings recover?

For a manual action, after a successful reconsideration request. For Penguin, usually not until the next refresh, so start now rather than later.

Get found with a clean link profile

A careful backlink audit protects the links that help you and removes the ones that drag you down. If you want an expert review of your link profile and a plan to build better links, see how we help businesses get found.