Toxic Backlinks: Fixing Spammy Links the Right Way
A backlink report that flags hundreds of "toxic" links can look alarming, but a high toxicity score is not the same as a problem. Every established site picks up junk links it never asked for, and Google says its systems ignore most of them.
What matters is whether there is a pattern of links someone placed to manipulate rankings, such as paid articles, link networks or keyword-stuffed directory entries. This guide shows you how to tell the two apart, when to leave links alone, when to ask for removal, and when a disavow file is justified.
What "toxic" actually means
No search engine publishes a toxicity score. The number you see in a backlink tool is that tool's own estimate, built from signals such as how many outbound links the linking site has, whether it shares hosting with known spam sites, what language it is in, how much traffic it seems to get and how its anchor text looks. Google does not see those scores and does not use them. They are a way of sorting a long list so a person can review the worst-looking links first.
That is useful, but it leads to two common mistakes. The first is treating every low-scoring link as harmful, when most are simply worthless: a scraper that copied your article, a directory that lists every domain it finds, a statistics site that generates a page for every website on the internet. Google has said for many years that its systems are designed to ignore links like these. The second mistake is assuming a clean score means a clean profile. A carefully built network of paid guest posts can score well in a tool while clearly breaking Google's rules.
So the useful definition is narrower. A link is a problem when it was created to pass ranking credit in a way that breaks Google's spam policies, and particularly when you, an agency you hired or a previous owner of the site created it. Links you had nothing to do with are rarely worth your time.
What Google counts as link spam
Google's spam policies describe link spam as links intended to manipulate rankings. The examples below are drawn from that policy. If a group of your links fits one of these descriptions, it deserves attention; if it does not, it probably does not.
| Pattern in the policy | How it shows up in a backlink report |
|---|---|
| Buying or selling links that pass ranking credit | Articles on unrelated blogs with a "sponsored"
feel but no rel="sponsored", often with a keyword anchor to a product or service page. |
| Excessive link exchanges | Many sites you link to also link back, often from a "partners" or "friends" page, with no real business connection. |
| Large-scale guest posting with keyword-rich anchors | Dozens of posts by you or your agency across general "write for us" blogs, each with the same commercial anchor text. |
| Automated programs or services that create links | Thousands of links from forum profiles, bookmarking sites or comment sections appearing within days. |
| Links required by a contract or terms of service | Customers or clients forced to link back as a condition of using your product, without the link being qualified. |
| Links in widgets or templates spread across many sites | Footer or sidebar credits with keyword anchors on hundreds of unrelated sites, often from a theme or plugin you released. |
| Low-quality directory and bookmark links | Pay-to-list directories that accept anything and exist only to host links. |
| Optimised links in forum posts or signatures | Keyword anchors in signatures repeated across hundreds of threads. |
Paid links are not banned outright. Advertising, sponsorships and affiliate links are fine when they
carry rel="sponsored" or rel="nofollow", which tells Google not to count them
for ranking. The problem is the undisclosed paid link that pretends to be an editorial vote.
Who created the links? The question that decides everything
The same-looking link can need very different handling depending on how it got there. Before you look at scores, find out the history of the site's link building.
You or your own staff
If anyone in the business paid for articles, joined a link exchange or ran a guest post campaign with keyword anchors, those links are the most likely to be a real risk. You also know where they are, which makes removal realistic. Check old invoices, emails and spreadsheets for lists of placements.
An SEO agency
Ask any past agency for a list of every link they built, the sites used and whether any were paid. A monthly report saying "12 high-authority links built" with no list is a warning sign. Agencies that sold packages of a fixed number of links per month very often used paid placements or private blog networks.
A previous owner of the domain
If you bought an expired or second-hand domain, it may have a link history that has nothing to do with your business: casino, pharmacy or loan links from years ago. The Wayback Machine at web.archive.org shows what the domain used to host. A domain that was once a spam project may carry links worth disavowing even though you never built any.
Strangers, scrapers and automated sites
Most links in a typical "toxic" list come from here: scraper sites, auto-generated statistics pages, spam directories that list everyone, and hacked sites stuffed with outbound links. You did not create them, they follow no plan aimed at you, and Google's systems are built to discount them. These rarely need any action.
Is it negative SEO?
A sudden wave of spammy links, often with adult, gambling or pharmaceutical anchor text, makes many owners fear a competitor is attacking them. Genuine negative SEO campaigns are much rarer than the worry about them, and Google has said its systems are designed to cope with them. Before acting, check three things:
- Rankings and traffic. In Search Console's Performance report, compare clicks and impressions for the weeks before and after the spike. If nothing changed, the links are being ignored.
- Manual actions. An attack that Google took seriously would show up as a manual action notice. No notice means no manual penalty.
- The shape of the links. Spam that points at your homepage with random anchor text is typical of automated link blasting that hits huge numbers of sites. It is not personal.
If traffic is steady and there is no manual action, record the spike in your notes with the date and move on. If you still want peace of mind, disavowing the handful of worst domains at domain level does little harm, but it is rarely needed.
The fix, step by step
Step 1
Check Search Console for a manual action
Open Google Search Console, go to Security and Manual Actions, then Manual actions. If it says no issues detected, you have no penalty and any work that follows is precautionary. If it shows Unnatural links to your site, the notice explains whether the action affects the whole site or some pages, and the clean-up becomes a priority. Screenshot the notice and note the date, because you will refer to it in your reconsideration request later.
Step 2
Export links from more than one source
Export the full link list from the Backlink Tools, then export Top linking sites and the latest links from the Links report in Search Console, which shows a sample of the links Google itself has found. Combine the lists in a spreadsheet with one row per linking domain. No single tool sees every link, and the Search Console export is the closest thing you have to Google's own view of your profile.
Step 3
Group the links by domain and pattern
Add columns for anchor text, target page, link count, whether the link is followed and a short note on what the linking site is. Sort by anchor text and look for repeated commercial phrases pointing at service or product pages. Sort by target page to spot one money page receiving most suspicious links. Open a sample of domains in a browser, because thirty seconds on a site tells you more than any score.
Step 4
Put each domain into ignore, remove or disavow
Mark scrapers, auto-generated directories, statistics pages and random spam you never asked for as ignore. Mark links you, your agency or a previous owner placed to pass ranking credit as remove, since those are the ones Google objects to. Anything in the remove group that you cannot get taken down moves to disavow. Leave real editorial links alone even if a tool scores them badly, because disavowing them can cost you visibility.
Step 5
Ask for removal of links you or your agency placed
Contact the owners of the sites in your remove group with a short, polite message
naming the exact page and link, and asking them to delete the link or add rel="sponsored".
If you paid for the placement, say so plainly. Keep a log with the date, contact method and reply for
every site. Removal is the cleanest outcome, and the log is evidence of real effort if you need to file
a reconsideration request.
Step 6
Upload a disavow file only if the evidence supports it
If you have a manual action, or a clear history of paid or network links
that you could not remove, list them in a plain text file with one entry per line, using domain:
for whole sites. Upload it through Google's disavow links tool for the correct Search Console property.
It replaces any earlier file, so always include previous entries you still want. Google processes it
as it recrawls the linking pages, which can take weeks.
Step 7
Stop the source and review quarterly
Cancel any service still building links for you, ask agencies in writing to stop, and remove forced footer credits from themes, plugins or widgets you distribute. If you had a manual action, file a reconsideration request describing what you found, what you removed and what you disavowed. Then re-run the Backlink Tools every three months and compare against your spreadsheet, looking only for new patterns rather than new individual junk links.
Writing the disavow file correctly
The disavow file is a plain text file encoded in UTF-8 or 7-bit ASCII with a .txt extension.
Each line is either a full URL, which disavows links from that one page, or domain: followed
by a hostname, which disavows every link from that site. Lines starting with # are comments
and are ignored by Google, so use them for your own notes. Google limits the file to 2 MB and 100,000
lines.
# Disavow file for example.co.uk, updated 28 September 2026
# Paid guest posts placed by previous agency in 2023, removal requested, no reply
domain:cheap-guest-posts.example
domain:seo-article-hub.example
# Private blog network found via shared template and hosting
domain:best-home-tips-daily.example
domain:home-garden-insider.example
# Single paid page on an otherwise genuine site
https://regional-news.example/advertorial/fitted-kitchens-offerDomain or URL?
Use domain: for sites that exist to sell or trade links, because a network can add new
pages with links to you at any time and a URL entry would miss them. Use a single URL only when a genuine
site has one bad page, such as an undisclosed advertorial on a real local news site, so you do not throw
away any good links that site gives you elsewhere.
Mistakes that cause harm
- Uploading a tool's full "toxic" export. These lists routinely include genuine local directories, industry associations and news sites that happen to score badly. Disavowing them removes value you earned.
- Disavowing your own domains or subdomains. This has no useful effect and can confuse your own records.
- Using the wrong property. Upload for the property that covers the version of the site the links point to. A domain property covers every protocol and subdomain.
- Forgetting that each upload replaces the last. Keep a master copy and always upload the full list.
- Expecting instant results. The file is used as Google recrawls the linking pages, so allow weeks to months.
If you have a manual action: the reconsideration request
A reconsideration request is a message to Google's reviewers, sent from the Manual actions report once you have fixed the problem. A person reads it, so write for a person. A good request covers four things:
- What happened. For example: "An agency we hired in 2023 bought guest posts with keyword anchor text on sites that sell links."
- What you found. The number of domains you reviewed, how you identified the paid and network links, and where the full list can be seen, such as a shared spreadsheet link.
- What you did. How many sites you contacted, how many removed or qualified the link, and which domains you disavowed because you could not get them removed.
- How it will not happen again. That the agency contract has ended, that you no longer
buy links, and that any future paid placements will carry
rel="sponsored".
Reviews can take several weeks. If the request is rejected, the reply usually includes example links that remain. Find the pattern those examples belong to, deal with the rest of that group, and submit again. Lifting a manual action restores normal treatment, but rankings that depended on the manipulative links will not come back, because those links no longer count.
Keeping the profile clean
- Get link lists from every supplier. Any agency or freelancer who builds links for you should give you the full list of placements every month, and confirm in writing that none were paid.
- Mark paid placements. Sponsorships, advertorials and paid directory listings should
carry
rel="sponsored". Ask the publisher to add it before you pay. - Check domains before you buy them. Look at the archive history and a backlink report for any second-hand domain before purchase.
- Keep credits out of templates. If you release themes, plugins or widgets, use a
brand-name credit link that users can remove, or mark it
nofollow. - Review patterns, not scores. A quarterly look at anchor text and new referring domains will catch real problems. A weekly scroll through toxicity scores mostly creates worry.
Once the clean-up is done, put your effort into links worth having. The content and digital PR guide is a good next step.
1. Can toxic backlinks hurt my rankings?
Links you had nothing to do with rarely do, because Google says its systems are designed to ignore spammy links automatically. The links that can hurt are ones placed to manipulate rankings, such as paid posts without rel sponsored, link networks or large guest post campaigns with keyword anchors. These can lead to a manual action, or simply stop counting, which removes any ranking they were propping up. Look for a pattern you or an agency created, not for individual bad scores.
2. Should I disavow every link my SEO tool marks as toxic?
No. A toxicity score is the tool vendor's own estimate and Google does not use it. These lists usually include genuine local directories, trade associations, forums and small blogs that score poorly for harmless reasons. Disavowing them throws away links that may be helping. Review the domains yourself and disavow only links that were placed to pass ranking credit and could not be removed, or links named in a manual action. For most sites, the right amount to disavow is nothing.
3. How do I know if I have a Google penalty for bad links?
A manual penalty is always shown in Google Search Console under Security and Manual Actions, then Manual actions. If that report says no issues detected, you do not have one. Algorithmic changes are different: Google does not send notices when its systems stop counting links, so the only signs are ranking changes, often around a spam or core update. Check the Google Search Status Dashboard for update dates and compare them with your Performance report before drawing conclusions.
4. How long does a disavow file take to work?
There is no fixed time. Google applies the file as it recrawls the pages that contain the disavowed links, and some of those pages are crawled rarely. Changes can take weeks or months to be reflected. If you are dealing with a manual action, the reconsideration request is reviewed separately by a person, which typically takes days to a few weeks. Do not keep uploading new versions in the meantime; each upload replaces the previous file.
5. Is a competitor building spam links to my site?
It is possible but uncommon, and most sudden waves of spam links come from automated link blasting that targets huge numbers of sites at once. Check whether your clicks and impressions in Search Console changed after the links appeared and whether a manual action exists. If traffic is steady and there is no manual action, the links are almost certainly being ignored. You can disavow the worst domains for peace of mind, but it is rarely necessary.
6. Can I get a link removed instead of disavowing it?
Yes, and for links you or an agency paid for, removal is the better outcome. Email the site owner with the exact page address and the link, ask them to delete it or add rel sponsored, and keep a record of the request. Many paid-link sites never reply, and some ask for a removal fee; do not pay it. Anything you cannot get removed after a reasonable attempt can go in your disavow file instead, particularly if you have a manual action.
7. Do spammy links from an old domain owner still matter?
They can if the domain was used for spam before you bought it, particularly if the old links used gambling, pharmacy or loan anchors, or if the domain carries an existing manual action. Check the Wayback Machine to see what the site used to be, look at the link profile and check the Manual actions report once you have verified the domain. If the history is clearly spam, disavowing those domains at domain level is a reasonable precaution even without a manual action.
The Backlink Tools pull your live link profile and score each link for quality and toxicity, so you can sort the list and review the worst-looking domains first, alongside your anchor text and referring domains.
Open Backlink Fixes →