Backlink audit guide: find and remove toxic links

A backlink audit is the process of reviewing every external link pointing to your website, evaluating each one for quality and relevance, and taking action on the links that could be hurting your search rankings. If you have been building backlinks for any length of time, or if your site has been around for a few years, you almost certainly have links you did not ask for and would not want. This guide walks through how to find them, how to decide which ones are actually harmful, and what to do about them.

Google's algorithms have become better at ignoring low-quality links on their own. But "mostly ignores" is not the same as "always ignores." A profile dominated by spammy links still sends a signal, and manual actions for unnatural link patterns are still issued. Even outside of penalties, a messy backlink profile makes it harder to understand what's actually driving your rankings and where to focus your off-page SEO efforts next.

Why you need a backlink audit

Backlinks remain one of the strongest ranking factors in Google's algorithm. But their value depends entirely on quality. One editorial link from a relevant, authoritative site is worth more than a hundred directory submissions from sites nobody visits.

Problems start when low-quality links accumulate. This can happen for several reasons:

• Negative SEO -- a competitor (or automated bot) points thousands of spammy links at your site.
• Old tactics -- link-building strategies from years ago (blog comment spam, article directories, link exchanges) that were once acceptable but now look manipulative.
• Scraped content -- your content gets copied onto spam sites that link back to the original.
• Paid links gone wrong -- links bought from low-quality networks that violate Google's spam policies.

A backlink audit gives you a clear picture of your link profile and puts you in control of what stays and what goes.

Step 1: Gather your backlink data

You need a complete list of every site linking to you. No single tool captures every link, so the best approach is to pull data from multiple sources and merge them.

Google Search Console (free)

Go to Links > External links > Top linking sites. You can export the full list. This is Google's own data, so it is the most authoritative source for links Google actually knows about. If you are not using Search Console yet, set it up first.

Ahrefs, Semrush, or Moz

These paid tools crawl the web independently and typically find links that Search Console does not report. Export the full backlink report, including referring domain, anchor text, link type (dofollow/nofollow), first seen date, and the linking page's authority score. Even the free versions give you enough data for a basic audit.

Merge and deduplicate

Combine your exports into a single spreadsheet. Remove duplicate URLs. Sort by referring domain so you can evaluate at the domain level first, then drill into individual pages where needed.

Step 2: Identify toxic and spammy links

This is the step that takes the most judgment. Not every low-authority link is toxic, and not every link from a site you don't recognize is bad. Here are the signals to look for:

Signal	What it looks like	Risk level
Irrelevant foreign-language sites	Links from sites in languages your business has no connection to	Medium
Link farms and PBNs	Sites that exist only to sell links, with thin content and hundreds of outbound links per page	High
Exact-match anchor text at scale	Dozens of links all using the same keyword as anchor text	High
Sitewide footer/sidebar links	Your link appears in the template of another site, creating thousands of links from one domain	Medium
Hacked or malware sites	Browser warnings, injected pharmaceutical or gambling content	High
Paid link networks	Sites openly selling links, "sponsored post" pages with dozens of unrelated outbound links	High
Comment and forum spam	Auto-generated comments with your URL stuffed in	Low-Medium

Tools like Ahrefs and Semrush assign their own toxicity scores. These are useful as a starting filter, but do not rely on them blindly. Always manually review the linking page before deciding a link is harmful. Some perfectly legitimate sites have low domain authority simply because they are small or new.

When in doubt, ask yourself: "If a Google reviewer looked at this link, would it look like someone tried to manipulate rankings?" If the answer is yes, flag it.

Step 3: Request manual removal

Before reaching for the Disavow Tool, try to get harmful links removed at the source. This is Google's preferred approach and the most effective one.

1. Find the site owner's contact -- check the linking site for a contact page, email address, or WHOIS information.
2. Send a polite removal request -- explain which page contains the link, provide the exact URL, and ask them to remove it. Keep it short and professional.
3. Follow up once -- if you don't hear back within two weeks, send one follow-up. After that, move on to disavowal.
4. Document everything -- keep a record of your outreach attempts. If you ever need to file a reconsideration request with Google, this evidence shows you made a good-faith effort.

Realistically, response rates on link removal requests are low. Many spam sites have no active owner. But the ones that do respond and remove the link give you a cleaner result than disavowal, because the link actually stops existing rather than just being flagged.

Step 4: Use the Disavow Tool

For links you cannot get removed manually, Google provides the Disavow Tool in Search Console. It lets you upload a text file telling Google to ignore specific links or entire domains when assessing your site.

How to format the disavow file

The file is plain text (.txt) with one entry per line. To disavow an entire domain (usually the better choice for spam sites), prefix it with domain:. To disavow a single URL, just list the full URL.

# Spam domains identified in Sept 2026 audit
domain:spamsite1.com
domain:linkfarm-example.net
# Individual pages
https://example.com/blog/spammy-post-with-my-link

Important warnings

• Only include links you are confident are harmful. Disavowing a link from a legitimate site removes a real ranking signal.
• The tool does not work instantly. It can take weeks or months for Google to process your file and reflect the changes.
• You can update the file at any time, but each upload replaces the previous one entirely. Always keep a running master file.

If your site has received a manual action for unnatural inbound links, submit the disavow file and then file a reconsideration request in Search Console explaining the steps you have taken. Include your outreach documentation from Step 3.

Step 5: Monitor and repeat

A backlink audit is not a one-time project. New links appear constantly, and some of the spam you cleaned up may return or be replaced by new sources.

• Set a quarterly reminder to re-export your backlink data and check for new toxic links.
• Watch for sudden spikes in referring domains. A jump from 200 to 2,000 referring domains in a week almost always means a spam attack, not organic growth.
• Track your disavow file as a living document. Add new entries as you find them. Remove entries for domains that no longer link to you.
• Monitor ranking changes after cleanup. If rankings improve over the following weeks, your audit likely removed links that were genuinely suppressing your performance. Use SEO measurement practices to track the impact.

If you are running active link-building campaigns, auditing helps you catch problems early rather than letting toxic links pile up over months.

Common backlink audit mistakes

Even experienced SEOs make these errors during audits. Avoid them to get better results:

• Disavowing too aggressively -- treating every low-authority link as toxic. A small blog linking to your site with a relevant article is not spam, even if its domain authority is 5. Quality signals go beyond a single metric.
• Ignoring nofollow links -- while nofollow links pass less (or no) ranking value, a pattern of thousands of spammy nofollow links can still look suspicious and is worth noting in your audit.
• Using only one data source -- Google Search Console, Ahrefs, and Semrush each see different parts of your backlink profile. Relying on a single source means missing links.
• Never actually submitting the disavow file -- going through the entire audit, building the file, and then forgetting to upload it. Check that it is successfully submitted in Search Console.
• Confusing low authority with toxicity -- a new site linking to you is not the same as a spam site. Context matters more than domain rating.

Need help cleaning up your backlink profile? As an SEO specialist in Nepal, I run backlink audits as part of my SEO audit service. If your rankings have dropped or you suspect link spam, get in touch and I will take a look.