Backlink Audit: How to Find Toxic Backlinks and Decide What to Disavow

A backlink audit is a close look at every link pointing at your site, done specifically to find the ones that could be hurting you rather than helping: spammy links, automated links, or links from sites that have nothing to do with your topic. It matters because a link profile can look impressive at a glance (a big backlink count) while actually being mostly low-quality noise underneath, and that noise can drag down trust signals even as the headline number grows.

This guide walks through the audit the way we do it for clients: pull the full list, find the spam patterns, read the spam scores properly, and only then decide whether a disavow file is worth filing. You can do the whole thing by hand in an afternoon with a spreadsheet.

What a toxic backlink actually is

A toxic backlink is a link that exists for reasons that have nothing to do with your content being useful. The usual sources:

• Link farms and private blog networks. Sites that exist only to sell or trade links. Thin pages, dozens of unrelated outbound links, no real readers.
• Scraper and spun-content sites. They copy your page (link included) to fill out their own site. One is harmless. Hundreds are a pattern.
• Free-hosting spam waves. Automated blogs on free platforms generating thousands of near-identical links, often to old or dead URLs on your site.
• Paid links you forgot about. Directory packages and sponsored posts bought years ago, still live, often from sites that have since gone downhill.
• Hacked pages. Injected links on legitimate sites that were compromised. These often show pharmacy, casino, or loan anchor text pointing at pages you never wrote.

What a toxic backlink is not: a link from a small site, a link from a site in another language, or a link with a low authority score. Small and obscure is not the same as spam, and treating it that way is the most common way audits go wrong.

When you actually need one

You don’t need to audit your links constantly. It’s worth doing when:

• Your backlink count jumped sharply with no explanation. That could be a real campaign, a viral mention, or (more often) an automated spam wave hitting an old URL pattern on your site.
• You’ve bought links in the past, or paid an agency, and never checked what the resulting links actually look like.
• Your rankings dropped without an obvious cause and you want to rule out a link-quality problem.
• You received a manual action notice for unnatural links in Google Search Console. In that case an audit is not optional.
• You’re inheriting a domain (buying it, or taking over a client’s site) and want to know what you’re getting.

Step 1: Pull the full list

Start with a full backlink report, not just a summary. You need every referring domain, not the top five. If you haven’t pulled one recently, see how to check backlinks for how to get the complete, exportable list. Export it to a spreadsheet; you’ll be sorting and filtering it.

At minimum you want these columns: linking page URL, linking domain, anchor text, follow or nofollow, first seen date, and the page on your site it points to. If your source provides a per-link spam score, keep that column too. You will use it in step 4.

Step 2: Look for the shape of a spam wave

Real link profiles, built up over years, tend to come from a wide, varied mix of domains. A spam wave looks different: a small number of low-quality platforms (often free blog hosts) generating a huge volume of links, frequently to old or defunct pages on your site. The tell isn’t the total backlink count. It’s the ratio of backlinks to referring domains. If one platform alone accounts for a large share of your total links, that’s worth investigating on its own, regardless of what the rest of your profile looks like.

Three quick sorts surface most waves: sort by linking domain and look for one domain with hundreds of links, sort by first-seen date and look for a spike in a single week, and sort by target page and look for a URL you deleted years ago that is suddenly popular.

Step 3: Sort the good from the bad

A few honest signals to sort by, roughly in order of how much weight to give them:

1. Topical relevance. Does the linking site have anything to do with your industry or audience? A relevant link from a small site usually beats an irrelevant one from a big site.
2. Does the site look real? Genuine content, reasonable design, an identifiable owner. The opposite is a thin, auto-generated page that exists only to hold outbound links.
3. Is it part of a pattern? One odd link is noise. Fifty near-identical links from the same free-hosting platform, all pointing at the same old page, is a pattern worth acting on.
4. Anchor text.Your brand name, your URL, and plain phrases like “this article” are what natural links look like. Exact-match commercial anchors you never asked for, or anchors in a language your site is not written in, are a flag.
5. Nofollow vs. dofollow. A large volume of low-quality nofollow links is lower priority than the same volume of dofollow. Dofollow spam is the kind more worth disavowing first if you decide to.

Step 4: What a spam score tells you, and what it doesn’t

Most backlink tools, including a free link popularity check, attach a spam score to a domain or to individual links. It is a 0 to 100 estimate built from signals like the linking site’s own link profile, how many sites it links out to, whether it sits on shared spam hosting, and whether its anchor text patterns look automated.

Use it as a sorting aid, not a verdict. A score above roughly 60 deserves a manual look. A score of 30 to 60 is usually a small, neglected, or badly built site rather than a spammer. Below 30 is normal. The mistake people make is disavowing every link above some threshold without looking; that removes real links from real sites that simply have ugly templates. Look at the pattern first, the score second.

Step 5: Decide whether you need a disavow file

Google’s disavow tool lets you tell Google to ignore specific links or entire domains when evaluating your site. In effect, you are asking that they not count for or against you. It’s a narrow-use tool, not routine maintenance: most sites with an ordinary link profile never need it, and Google itself recommends using it only when you have reason to believe low-quality links are actively causing harm (for example, after a manual action, or when a spam wave is large enough and dofollow enough that it’s a genuine risk rather than background noise). If your audit turns up a handful of odd links, that’s normal and not worth a disavow file. If it turns up thousands of near-identical spam links dwarfing your real profile, that’s the case the tool exists for.

If you do file one, the format is a plain text file with one entry per line. Disavow whole domains where the entire site is junk (domain:example-spam-site.com) and individual URLs where a legitimate site has one bad page. Upload it in Google Search Console under the Disavow Links tool for the exact property (www and non-www are separate). Keep a copy; uploading a new file replaces the old one rather than adding to it. Our toxic backlink audit runs this whole process for you: it scores every link, flags the spam patterns in your profile, and builds a ready-to-review disavow file if the numbers justify one.

Step 6: Keep watching

An audit is a one-time deep clean; it doesn’t stop new low- quality links from arriving later, especially if the pattern that caused the last spam wave (an old URL structure, a common misconfiguration) is still in place. Once you’ve cleaned up the current profile, see our backlink monitoring guide for ways to catch the next wave earlier, and our link building tools guide if you’re assembling a fuller toolkit around checking, building, and watching your links.

Mistakes that make an audit worse than no audit

• Disavowing by score alone. Covered above, but it is the number one way sites lose real links.
• Disavowing nofollow links. They already pass nothing. Spending time on them is wasted effort, and disavowing them changes nothing.
• Blaming links for a ranking drop that was really a content or technical problem. Check for a site migration, a noindex slip, or a core update in the same window before concluding it was links.
• Expecting a fast recovery. Even a perfect disavow takes months to show, and it only helps if links were the problem in the first place.
• Auditing backlinks and ignoring the rest. Broken internal links and outbound links to dead sites are cheaper to fix and often matter more day to day. A full link audit covers all three.

Backlink audit FAQ

Start with a fresh look at where you stand: run a free link popularity report and see whether your own numbers show any of the warning signs above.