Backlink Audit: Find and Fix Toxic Links

Here is the uncomfortable truth about toxic backlinks: most sites worrying about them do not have a toxic-link problem — they have an unknown link-profile problem. Google finished its September 2026 spam update on 8 October after nearly 14 days — the fourth spam update of 2026 — and every update like it is a reminder that a clean link profile is maintenance, not emergency surgery. The short version: audit your links regularly, manually review anything suspicious, ask for removal first, and disavow only the clearly unnatural leftovers. Everything below is that sentence unpacked.

One more thing to internalise before you start: Google's systems now mostly ignore low-quality links rather than penalising sites for them. That changed the economics of cleanup — indiscriminate disavowing can hurt you more than the spammy links ever did. Precision beats panic.

Step 1: Pull your link profile (free baseline)

You cannot audit what you cannot see. Start with the free baseline in Search Console:

• Links report → Top linking sites: export the full list. This is Google's own view of who links to you — the ground truth for the audit.
• Top linked pages: check whether links point at the pages you expect. A flood of links to an obscure old post can signal injected or hacked placements.
• Top linking text: scan the anchor distribution. A natural profile is dominated by brand names, URLs and generic text ("click here"); a profile heavy on exact-match commercial keywords ("cheap hotels dubai") deserves a closer look.

For depth, pair this with a backlink index from an SEO tool (Ahrefs, SEMrush and similar all maintain one) to catch links Google's report samples out, plus authority and traffic estimates per linking domain. The free GSC export is the audit; the tool data is the magnifying glass.

Step 2: Learn the toxicity signals

No single metric convicts a link. Toxicity is a pattern — look for three or more of these on the same linking domain:

• Near-zero authority and zero real traffic. A domain with no topical standing, no traffic and hundreds of outbound links is not editorial — it is inventory.
• Off-topic or foreign-language linking pages. A casino link on a plumbing blog, or a page in a language you have never operated in, did not happen by editorial merit.
• Over-optimised exact-match anchors. Natural links say your brand name. Dozens of links all anchored "best personal loan india" are a footprint of old-school link schemes.
• Sitewide links. The same link in the footer or sidebar of every page of a domain — especially a low-quality one — is a classic paid or template-injected pattern.
• Network footprints. Clusters of linking domains with identical themes, registrars, hosting or design are private blog networks (PBNs), built to sell links.
• Hacked or injected placements. Links appearing in content you can tell the site owner never wrote — pharma or gambling anchors on an abandoned blog, for instance.

What does not count: a low-authority blog that genuinely reviewed your product, a directory listing in your industry, a forum mention from a real user, or a link from a small site in your niche. Small is not toxic. Irrelevant-at-scale is.

What a healthy link profile looks like

It helps to know the target you are auditing toward. A healthy profile is diverse: links from many different domains rather than hundreds from one. It is topically relevant: most linking sites operate in your industry or an adjacent one. Its anchors are natural: brand names, raw URLs and generic phrases dominate, with exact-match commercial anchors a small minority. And it grows gradually: a steady trickle of new referring domains over months, not a cliff of 500 links in a week. You do not need to manufacture this — you need to stop anything actively working against it, then let genuine mentions accumulate. Most established small-business sites already look like this; the audit usually confirms health rather than finding disease.

Step 3: Manually review before you touch anything

This is the step most guides skip and most cleanups regret skipping. Export your suspicious candidates into a spreadsheet and actually open a sample of the linking pages — 20 to 30 is usually enough to calibrate your judgement:

• Is the page real content with a real audience, or auto-generated filler?
• Does the link make editorial sense in context?
• Is the pattern repeated across many pages or domains (a campaign), or is it one odd link (noise)?

Mark each candidate keep, remove (ask the site owner), or disavow (unnatural and removal unlikely). If you cannot decide, the answer is keep — uncertainty favours inaction, because a wrongly disavowed good link costs you real authority.

Step 4: Request removal first

For links you have marked "remove", contact the site owner before reaching for the disavow tool:

• Find a contact page, WHOIS email or site contact form. Keep the request short, polite and specific — link the exact URL of the linking page.
• Give it two to three weeks. Many webmasters comply quickly, especially for hacked or outdated placements they did not create.
• Log every request with dates. If you later disavow, this log is your evidence of good-faith effort.

Removal is preferable to disavowal because it deletes the signal entirely rather than asking Google to ignore it — and it works more often than people expect for genuinely unwanted links.

Step 5: Disavow — only the clearly unnatural leftovers

The disavow tool still exists in Search Console (via Google's standalone disavow page) and still accepts URL- or domain-level entries. Use it only for links that are clearly unnatural and unremovable: paid links you cannot get taken down, PBN placements, hacked injections on abandoned sites.

• Prefer URL-level over domain-level disavows unless the whole domain is a link farm. Domain-level disavow is a blunt instrument — it discards any good links from that domain too.
• Keep the file minimal. A 40-line disavow file built from manual review beats a 4,000-line file exported from a tool's "toxic" filter. Tool toxicity scores are heuristics, not verdicts.
• Expect weeks, not days. Google processes disavow files on recrawl; do not expect ranking movement the next morning.

And the warning worth repeating: disavowing good links can hurt. Every disavow entry should survive the question "would I bet a ranking drop that this link is unnatural?" If the answer is not yes, leave it out.

Step 6: Set a re-audit cadence

Link profiles rot. New spammy links appear without you doing anything — scrapers, directories, negative SEO attempts. A sane cadence:

• Every 3–6 months: a 30-minute routine — export the GSC links report, scan new linking domains, check the anchor distribution for drift.
• After every spam or core update finishes: compare the two weeks before and after (for the September 2026 spam update, that window was 24 September to 8 October). If organic traffic dropped inside the window and stayed down, the link profile is one of the suspects to check — alongside content quality and technical issues from your SEO audit checklist.
• After any unexplained ranking drop: rule out the link profile before rebuilding pages. A sudden influx of toxic links is rarer than people think, but it is cheap to check.

Between audits, Search Console's link report is always there. The habit matters more than the tooling.

Start with the on-page half

A backlink audit is the off-page half of site health. If you have not run the on-page half recently, do that first — most ranking problems turn out to be technical or content issues, not link issues. Run the free website SEO audit to check your pages, then come back here for the link profile. And if page speed or vitals surface as problems, the page speed guide and Core Web Vitals guide cover the fixes.

Frequently asked questions

What is a backlink audit?

A systematic review of every site linking to yours: who they are, why they link, and whether those links help or hurt. The goal is a clean, natural-looking link profile — not a perfect one.

How do I know if a backlink is toxic?

No single metric decides. Look for a pattern: very low authority plus zero real traffic, off-topic or foreign-language linking pages, over-optimised exact-match anchors, and sitewide or network footprints. One weak signal is noise; three together is a candidate for review.

Should I disavow every spammy link I find?

No. Google\u2019s systems now mostly ignore low-quality links rather than penalising for them, so disavowing indiscriminately can remove links that were harmless. Reserve the disavow tool for clearly unnatural links — paid links, PBNs, hacked placements — after removal requests fail.

Can disavowing links hurt my rankings?

Yes, if you disavow good links by mistake. A disavow tells Google to ignore those links entirely, including any authority they passed. That is why manual review comes before every disavow file, and why broad domain-level disavows need extra care.

How often should I audit my backlinks?

Every 3–6 months as routine maintenance, plus after any Google spam or core update finishes rolling out, and immediately if rankings drop without an on-page explanation. A 30-minute check beats a yearly panic.

Is the disavow tool still available in Search Console?

Yes. It lives outside the main Search Console interface at Google\u2019s disavow links page, and it still accepts domain- or URL-level disavow files. Use it as the last resort in the cleanup order: audit, manual review, removal request, then disavow.