How to Run a Backlink Audit and Disavow Toxic Links

Q: Should I disavow an entire domain or just one URL?

Use the `domain:` prefix only when the entire source is spam, such as a PBN or scraper site with no legitimate content. If just one placement on an otherwise real site is the problem, disavow that specific URL so you don't risk cutting off other, unrelated pages on the same domain.

TL;DR

Export your link profile from at least two sources, score and manually review flagged domains, attempt direct removal first, and only disavow links tied to a confirmed manual action or clear, unremovable spam. Most sites never need the disavow tool. Google's systems already ignore the majority of low-quality links automatically.

By Guru Editorial | August 11, 2026

An AI Overview sitting above your listing now correlates with a 58% lower average click-through rate for the page ranking in position 1, up sharply from the 34.5% drop Ahrefs measured back in April 2025 (Ahrefs, December 2025). Zero-click search sessions climbed from 54% to 72% over that same stretch. Organic clicks are scarcer than they were two years ago, and the sites still capturing the ones that remain are disproportionately the ones search engines trust without hesitation.

A backlink audit is how you find out whether your site is one of them. It is also the single most misunderstood maintenance task in SEO, because the tools that promise to find your "toxic" links and the search engine that actually ranks you do not agree on what toxic means. This guide walks through the audit process end to end: pulling a complete link profile, scoring it without over-trusting any one tool, and making the disavow call correctly instead of reflexively.

Why a Backlink Audit Is Still Core SEO Hygiene in 2026

Google's link-spam detection system, SpamBrain, has gotten dramatically better at its job. In Google's most recent public webspam report, the company said SpamBrain identified 50 times more link spam sites than its prior detection systems caught, and the volume of confirmed spam actions has kept climbing every year since. That is genuinely good news for site owners: it means the overwhelming majority of low-quality links pointing at your site are already being discounted before they ever touch your rankings.

But "mostly automated" is not "entirely automated," and it is not the same as "irrelevant to you." Three things still make a periodic link audit worth the time:

Negative SEO attacks still happen, and while SpamBrain absorbs most of them silently, sustained high-volume attacks with matching exact-match anchors can still cause short-term ranking volatility on smaller or newer domains.
Manual actions still get issued for genuinely manipulative link profiles, and a manual action does not resolve itself. Only removal, disavowal, and a reconsideration request clear it.
Old link-building mistakes accumulate, particularly on sites with five-plus years of history where directories, paid guest posts, or old PBN placements from a previous SEO vendor are still sitting in the profile.

None of this means you should be nervously scanning your link report every week. It means a structured quarterly audit, with a clear decision framework for what actually warrants action, belongs in the same category as a routine technical SEO check: scheduled, not reactive.

What Actually Counts as a Toxic Link

Here is the part most guides get wrong: Google does not have an internal concept of a "toxic backlink." Ahrefs states this plainly in its own help documentation, noting that Google's guidelines do "not specify any specific metric or score that would determine if a backlink is considered manipulative or spammy." The term itself was invented by SEO tool vendors to describe a heuristic score, not a Google-defined category.

That does not make the scores useless. It means you should treat them as a filtering layer, not a verdict.

The Real Red Flags

Links worth flagging for closer review tend to share several of these traits at once, not just one:

A referring domain with very low authority combined with effectively zero organic search traffic
Exact-match commercial anchor text pointing at a money page, especially in bulk
Placement in a footer, sidebar, or auto-generated widget with no editorial context
A sudden cluster of new referring domains appearing in a short window, especially from unrelated topical niches
A source domain on an irrelevant or spam-associated TLD with no topical connection to your business
A referring site that has itself been deindexed or hit with a manual action

What Isn't Toxic

Tool-generated scores produce false positives constantly, and disavowing on that basis alone is how sites accidentally remove links that were helping them. Do not auto-flag:

Old, low-authority links from years-old directory submissions that were never problematic, just low-value
Nofollow or UGC-tagged links, which already carry no ranking weight and need no action
A single link from a low-DR blog that is otherwise a real, operating site with real content
Comment links dropped by spammers on your own blog. Google has confirmed these have no effect on rankings, positive or negative, because they were never something you built

How to Run a Full Backlink Audit, Step by Step

Step 1: Pull your full link profile from more than one source. No single tool has complete link discovery coverage, and their toxicity scores diverge meaningfully on the same links. Export referring domains and individual backlinks from Ahrefs and Semrush, then cross-reference against the Links report inside Google Search Console, which is the only view that shows what Google has actually processed. If your workflow already routes through GSC data, Guru's Google Search Console integration keeps that report synced alongside the rest of your audit instead of living in a separate export.

Step 2: Score and segment every referring domain. Sort by the toxicity or spam score each tool assigns, but treat the number as a sort order, not a decision. A useful starting filter is a Domain Rating under 5 combined with zero organic traffic, or a spam score above 30 to 40%, depending on the tool. Segment the results into three buckets: clearly fine, needs manual review, and clearly harmful.

Step 3: Manually review everything in the middle bucket. This is the step most audits skip, and it prevents costly mistakes. Open a sample of the actual pages linking to you. Is there real content around the link? Does the site have a plausible audience? A link scoring 45% toxic in the middle of a genuinely relevant article is a very different case than the same score on a footer template repeated across thousands of pages.

Step 4: Attempt direct removal before you consider disavowing anything. For links you've concluded are genuinely harmful, email the site owner and request removal. Document every outreach attempt: the date, contact method, and response, or lack of one. This record matters twice, it shows genuine effort for a future reconsideration request, and it often just works.

The backlink audit workflow: most links resolve well before the last stage. Disavow only what survives every earlier step.

Backlink Audit Tools Compared

Every major tool scores toxicity differently because each uses a proprietary blend of signals, and none of them can see exactly what Google's own systems weigh. Cross-referencing at least two is the only way to catch what a single tool misses.

Tool	What It Scores	Data Source	Manual Action Visibility	Best Used For
Ahrefs Site Explorer	Domain Rating, traffic, link context via Best Links filter	Ahrefs' own crawl index	None	Broadest link discovery, historical link data
Semrush Backlink Audit	Toxic Score from 45+ toxic markers across six categories	Semrush's crawl index plus machine learning	None	Bulk scoring and export straight to a disavow file
Moz Link Explorer	Spam Score based on machine-learned site features	Moz's own crawl index	None	A third data point when Ahrefs and Semrush disagree
Google Search Console Links report	No score. Shows actual top linking sites and pages Google has indexed	Google's own index	Yes, under Security & Manual Actions	Ground truth on what Google has actually processed and any active penalty

Notice that only GSC can tell you whether you actually have a manual action. That single fact should carry more weight in your decision than any toxicity percentage from a third-party tool, because it is the one signal that comes directly from the system doing the ranking.

When You Actually Need to Disavow, and How to Do It Right

John Mueller, Google's Search Advocate, has been consistent about when the disavow tool belongs in your workflow. Speaking at Google's Search Central NYC event, he said the tool "is not something that you need to do on a regular basis. It's not a part of normal site maintenance," adding that he would "really only use that if you have a manual spam action." Google's own Search Console help documentation reinforces the same threshold: the tool is an advanced feature for sites with numerous spammy links that have caused, or are likely to cause, a manual action, and in most cases, sites won't need it at all.

That framing matters because it inverts how most SEOs approach disavow. The default assumption should be that you don't need it. The disavow tool earns its use in two specific situations:

You have a confirmed manual action for unnatural links in Search Console's Security & Manual Actions report, and disavowing the offending links is a required part of your reconsideration request.
You can point to a specific, sustained pattern of spam links you were unable to get removed through direct outreach, and you have a defensible reason to believe they carry real risk rather than a merely low score.

Outside of those two cases, submitting a disavow file is far more likely to remove equity from a link that was quietly helping you than to fix a problem that didn't exist in the first place.

A flagged link only reaches the disavow file after removal has failed and a manual action confirms real risk.

Building and Submitting the Disavow File

If a link genuinely qualifies, the mechanics are straightforward, but the format requirements are strict:

[ ] List one URL or domain per line in a plain .txt file
[ ] Prefix an entire domain with domain: (for example, domain:spamsite.com) if you want to disavow every link from that source rather than a single URL
[ ] Save the file in UTF-8 or 7-bit ASCII encoding
[ ] Keep individual URLs under 2,048 characters and the full file under 100,000 lines and 2MB
[ ] Upload the file through the disavow links tool in Search Console for the specific property (it does not currently support Domain properties)
[ ] Expect a processing delay of a few weeks before Google incorporates the list, and note that disavowed links will still appear in your Links report afterward
[ ] Re-upload the full list, not an incremental addition, any time you update it. A new upload replaces the previous file entirely

Detecting and Responding to a Negative SEO Link Attack

Negative SEO, a deliberate campaign to flood your profile with toxic links to trigger a penalty, is more common than most site owners assume. Over 422,000 websites were hit with some form of negative SEO spam in 2024, according to data cited by Search Engine Land. SpamBrain absorbs most of these silently, but a concentrated attack can still cause short-term volatility, particularly on newer or lower-authority domains without a large base of legitimate links to dilute the noise.

Signs of an Active Attack

A sudden, sharp spike in new referring domains that you did not build and cannot trace to any campaign
Heavy concentration of exact-match commercial anchor text across the new links
New links clustered on known spam networks, expired-domain PBNs, or scraped-content sites
A ranking drop that coincides closely with the timing of the link spike, rather than a broader algorithm update

Response Checklist

Confirm the pattern in Search Console's Links report and cross-reference the new-domain timeline against your ranking history
Check Security & Manual Actions for an active penalty before doing anything else. If there is no manual action, Google is very likely already discounting the attack on its own
Document the spike with dated screenshots and exports in case you need to reference it later
Disavow the specific cluster only if it is large, clearly coordinated, and either tied to a manual action or showing a measurable ranking correlation
Continue monitoring for 60 to 90 days. Most negative SEO campaigns are one-time bursts, not sustained efforts, and rankings typically stabilize once SpamBrain reprocesses the new data

Strengthening your legitimate E-E-A-T signals during and after an attack gives Google's systems more genuine authority context to weigh against the noise, which is a more durable defense than reactive disavowing alone.

Common Mistakes That Turn a Cleanup Into a Ranking Problem

Disavowing based purely on a tool's toxicity score. Ahrefs, Semrush, and Moz scores are filters, not verdicts. Sites have removed genuinely helpful links this way and quietly lost rankings they never understood they'd given up.
Disavowing without ever checking for a manual action. If there's no penalty and no clearly unremovable spam pattern, there is usually nothing to fix. Google's own guidance is explicit that most sites don't need the tool at all.
Skipping outreach and going straight to disavow. Removal actually deletes the link. Disavowal only tells Google to ignore it, the link itself stays live on the web.
Disavowing an entire domain when a single URL was the problem. The domain: prefix is powerful and should be reserved for sources that are spam through and through, not a single bad placement on an otherwise legitimate site.
Never updating an old disavow file. Files uploaded years ago sometimes still contain domains that changed ownership or went offline. Stale entries rarely cause harm, but review the file each quarter.
Treating the audit as a one-time project. A link profile is not static, new spam links and negative SEO attempts argue for a quarterly cadence rather than a single pass.

Backlink hygiene is one piece of a broader authority picture that also includes how discoverable and citable your best content is. If your audit surfaces gaps in how your site earns links in the first place, building a profile that survives future spam updates is the natural next step, and Guru's GEO scoring can show you how the same authority signals carry over into AI citation visibility. If you'd rather have this process run on a recurring schedule with an approval record for every action taken, see how Guru's platform handles it.

Frequently Asked Questions

How often should I run a backlink audit?

Quarterly is the standard cadence for most sites. Run it monthly if you're in a competitive niche, actively building links, or recovering from a prior link-related issue. After any confirmed Google spam update, a review within two weeks of the rollout completing is worth the time.

Do I need to disavow links even without a manual action?

Almost never. Google's own guidance states most sites will not need the disavow tool at all, since automated systems already discount low-quality links. Reserve it for confirmed manual actions or spam patterns you genuinely cannot get removed and can defend as real risk.

What toxic or spam score should trigger a closer look?

There's no universal number Google recognizes, since the term "toxic" comes from tool vendors, not Google. A common starting filter is a spam score above 30 to 40% or very low authority paired with zero organic traffic, but always manually review before acting on the score alone.

Can disavowing a link ever hurt my rankings?

Yes. Disavowing a link that was actually providing legitimate equity removes that benefit just as effectively as a penalty would. This is the single most common way sites damage themselves during a "cleanup," which is why manual review before disavowing matters so much.

How long does it take for a disavow file to take effect?

Google states it can take a few weeks for a submitted disavow file to be incorporated into its index. Disavowed links will continue to appear in your Search Console Links report even after processing, since the report shows what Google has found, not what it's ignoring.

Can a competitor actually hurt my rankings with negative SEO?

It's uncommon but not impossible. SpamBrain absorbs most negative SEO attempts automatically, but a large, concentrated attack with matching anchor patterns can cause short-term volatility, especially on newer or lower-authority sites. Confirm any suspected attack against your Search Console data before reacting.

Which tool gives the most accurate toxic link data?

None of them are individually authoritative, since each uses a different proprietary scoring model and none can see what Google actually weighs. Cross-reference at least two link tools against your Google Search Console Links report, which is the only source showing what Google has actually processed.

Should I disavow an entire domain or just one URL?

Use the domain: prefix only when the entire source is spam, such as a PBN or scraper site with no legitimate content. If just one placement on an otherwise real site is the problem, disavow that specific URL so you don't risk cutting off other, unrelated pages on the same domain.