Backlink audit and toxic links: what to check and when to disavow
A backlink audit sorts the links pointing at your site into ones you built, ones that appeared on their own and ones you have lost. "Toxic backlinks" is a tool label, not a Google signal, and the disavow tool is only worth using in a narrow set of cases.
In short
- A backlink audit answers three questions. Which links did you create, which patterns in them could draw a manual action, and which good links have you lost?
- Google's John Mueller has called toxic links a concept made up by SEO tools, and the toxicity score in a tool is that vendor's estimate, not a Google signal.
- Random scraper links and foreign-language spam are overwhelmingly ignored by Google. Links you built or bought in manipulative patterns are the ones that carry risk.
- Google's guidance is reported to be to disavow only with a manual action for unnatural links, or with a considerable number of artificial links you built or paid for that are likely to cause one.
- Mueller said on 2 September 2026 that the disavow tool "does have effects", which includes lower rankings if you disavow links that were helping.
A backlink audit is a structured review of every site that links to you. Its purpose is to sort your links into three groups: links you or a past agency created, links that appeared on their own, and links you used to have and lost. Only the first group can get you into trouble, and the third group is often where the quick wins are.
“Toxic backlinks” is the phrase most people search for when they start an audit. It is a label from SEO tools, not from Google. Most of what tools flag as toxic is spam that Google already ignores. The audit below is built to find the smaller set of links that matter.
What an audit is for
Run one when you take over a site, after a ranking drop, before a migration, and after any period of bought links. A good audit produces four things:
- a list of links you are responsible for, with how each was obtained
- a view of your anchor text against competitors
- a list of lost and broken links worth reclaiming
- a decision on whether anything needs removal or a disavow file, which is usually “no”
How to run a backlink audit
- Export from Search Console. Use the Links report. It is a sample, not a full list, but it is the only data that comes from Google.
- Add a third-party index. Ahrefs, Semrush and Majestic each crawl a different slice of the web. One is enough for most sites, two for a site with a link buying history. The backlink tools comparison covers the options.
- Merge by referring domain. A hundred links from one site are one decision, not a hundred.
- Label how each link came to exist. Use the same classes as a penalty review: paid placements, private blog networks, guest post farms, widgets, sitewide links, comment and forum spam, foreign-language spam, links from hacked sites, and editorial links nobody asked for.
- Review anchors. Compare your share of exact-match commercial anchors with the top five competitors for the same page type.
- Check what you paid for. Is each bought link still live, still followed and still on an indexed page? How to track backlinks has the full checklist.
- List lost links. Pages that return a 404 but still have links, links pointing at old URLs, and links removed by publishers.
Step four is the one that takes judgement. If you have no record of what was bought, the patterns usually give it away: links from sites that publish on every topic, articles with one keyword-rich link to you and one to an unrelated casino, or a batch of referring domains that all appeared in the same month. The checks in how to vet a publisher work just as well in reverse on links you already have.
What “toxic links” means
Backlink audit tools label links as toxic or give domains a spam score. Moz’s Spam Score, for example, is described as the percentage of sites with similar features that were penalised or banned. Any such score is the vendor’s estimate, built from what the tool can see. It is useful as a sorting aid. It is not a measure Google uses. Our desk reviews of Semrush and Moz cover what each tool offers.
Google’s John Mueller has called toxic links a concept made up by SEO tools and has said Google ignores random spam links. That matches how Google is reported to have worked since Penguin 4.0 in September 2016: its systems mostly devalue bad links and do not demote the site that receives them.
Myth versus reality
| Claim | What the evidence says |
|---|---|
| Every low-quality link hurts and must be disavowed | Scraper links, foreign-language spam and most attack links are overwhelmingly ignored |
| A high toxicity score means a penalty is coming | The score is a tool estimate. Penalties are manual actions, shown in Search Console |
| Disavowing is harmless housekeeping | Mueller said on 2 September 2026 that the tool “does have effects”. Disavowing good links can lower rankings |
| Bad links never matter | Links you built or bought in manipulative patterns can trigger a manual action. Gary Illyes and John Mueller have both been reported as saying an overwhelmingly manipulative profile can lead Google to distrust a site’s links more widely |
The last row is the reason to audit at all. The risk sits in your own link building history, not in the spam that every site collects.
One more number for context on anchors. Ahrefs’ anchor text study of 384,614 pages found only a weak positive correlation between exact-match anchor share and rankings, and most top pages had a low share. Google publishes no safe ratio, so compare yourself with competitors, not with a fixed percentage. The anchor text lesson explains how.
When the disavow tool is worth using
Google’s guidance is reported to be narrow. Use the tool if you have a manual action for unnatural links, or if you have a considerable number of spammy, artificial links that you built or paid for and that are likely to cause one.
| Situation | Disavow? |
|---|---|
| Manual action for unnatural links to your site | Yes, after asking for removal first |
| A past agency bought hundreds of links from link farms or a blog network, no manual action yet | Reasonable, at domain level, for the links you can identify as bought |
| A burst of spam links from an apparent attack, rankings unchanged | No. Document it and watch |
| A tool reports a high toxicity score, rankings unchanged | No |
| Scraper sites, odd directories, foreign-language spam | No |
| A ranking drop on a core update date | No. The cause is probably not links |
If you do disavow, list whole domains so every page of a bad site is covered, and keep a copy of the file with a note on why each domain is in it. As far as our research could confirm, the tool works on URL-prefix properties in Search Console.
Mueller’s other comments set expectations. He has said disavowing is not part of normal site maintenance. He has also said “At some point, I’m sure we’ll remove it”, though no date has been announced, and Bing removed its own disavow tool in October 2023. The full procedure for a manual action is in Google link penalties and recovery.
What to do with the results
Most audits end with three short lists.
Reclaim. Redirect dead pages that still have links, and ask publishers to fix links that point at old URLs. This is the cheapest link work there is, because the editorial decision was already made. See link reclamation.
Stop. If the audit shows a tactic that leaves an obvious pattern, such as rented links or a network, stop adding to it. Google’s note with the March 2026 spam update says that when spam links are neutralised, the benefit is lost and cannot be regained.
Record. Put every paid or negotiated link into a tracker with its cost, date and vendor, so the next audit starts from a record and not from guesswork.
No reliable study says how often to repeat the exercise. A working routine is a full audit once or twice a year, plus weekly alerts for new referring domains so that anything unusual is seen early.
Where to go next
If the audit turned up a sudden wave of spam links, read negative SEO and link attacks before you act. For terms such as referring domain, link farm and disavow, use the glossary.
Common questions
What are toxic backlinks?
The term comes from SEO tools, which score links on signals such as the linking site's quality and the anchor text. Google has no toxicity score. Its systems mostly ignore spam links, and Google's John Mueller has called the concept made up by tools.
How do I do a backlink audit?
Export links from Search Console and at least one third-party tool, merge them by referring domain, label each domain by how the link came to exist, then review anchors, lost links and anything you paid for. The output is a short action list, not a disavow file.
Should I disavow toxic backlinks?
Usually not. Disavow links you built or paid for when you have a manual action for unnatural links or are likely to get one. Disavowing links at random risks removing ones that help.
How often should I audit my backlinks?
No study sets a correct interval. A working routine is a full audit once or twice a year and after any agency handover, with weekly alerts for new referring domains in between.
Do toxic links hurt rankings?
Spam links you did not create are, in almost all cases, ignored. Links you bought or built in obvious patterns can lead to a manual action, and when Google neutralises them the ranking benefit they gave is lost.
