Toxic Backlinks: How to Find Them and When to Disavow

Updated October 2026

Toxic backlinks are links pointing at your site from sources that exist to manipulate search rankings: link farms, scraper sites, paid link networks, hacked pages. You find them by exporting your links from Google Search Console, grouping them by referring domain, and looking for one domain or one cluster of domains that supplies a large share. Then you decide. For most sites the decision is to leave them alone, because Google says its systems usually work out which links to trust without help.

What "toxic" means, and what Google says about it

"Toxic" is an industry word. Google's own documentation talks about link spam, which it defines as creating links to or from a site primarily to manipulate search rankings. Its examples include buying or selling links for ranking purposes, excessive link exchanges and automated link creation (spam policies page, last updated August 2026).

Google says it handles most of this itself. In December 2022 it announced a link spam update that uses its SpamBrain system to neutralize the impact of unnatural links, so the credit those links would have passed is lost. Its disavow documentation (checked October 2026) says that in most cases Google can assess which links to trust without additional guidance, so most sites will not need the tool.

John Mueller put it bluntly in a 2022 answer reported by Search Engine Journal: disavowing random links that look weird or that some tool has flagged "is not a good use of your time. It changes nothing." His suggested use of the tool was for situations where you actually paid for links and cannot get them removed.

A link is worth acting on when it belongs to a pattern someone built to game rankings and you cannot remove it at the source. A single odd link from a site you have never heard of is background noise that every site collects.

Our audit: 574 backlinks, 452 from one site

In 2026 we audited the backlinks of one of our own portfolio domains. On paper it had 574 backlinks. A raw count like that sounds healthy until you group the links by source. When we did, 452 of the 574, roughly 79 percent, came from a single scraper site, meaning a site that republishes other people's content automatically. Strip that one source out and 122 links remain.

Separately, the audit turned up a link farm: ten domains hosted on one IP address in Moldova. Ten domains on one address is the kind of footprint a link network leaves behind.

We fixed it with a disavow file. We are not reporting a ranking or traffic result from it, and we are not naming the domain. What carries over is the method: the same two checks, concentration by domain and clustering by hosting, are open to anyone with a Search Console account. Most sites will not need one, and Google's documentation sets a high bar for filing it, which is why much of this post is about when to skip it.

How to find toxic backlinks, step by step

1. Export your links. In Search Console, open the Links report and export. Google's Links report documentation says exports run up to 100,000 rows, the report shows a sample that omits some links, and "Top linking sites" groups data by root domain.
2. Group by referring domain. In Google Sheets or Excel, build a pivot table with the linking domain as the row and a count of links as the value, sorted descending. You want to see whether one domain holds a large slice of the total. In our audit it was 452 of 574.
3. Open the top domains in a browser. Is it a real site with an audience, or scraped text with hundreds of outbound links? Read the linking page. Does the link sit in sensible editorial content or in a list, footer or comment?
4. Check for hosting clusters. Look up the IP address of each suspicious domain. On a Mac or Linux terminal, dig +short yourdomain.com returns it, and on Windows nslookup yourdomain.com does the same. Then paste the address into a free lookup such as IPinfo, which reports the country and the network that owns the address. Several unrelated-looking domains on one address deserve a closer look. Shared hosting puts innocent sites on one IP too, and sites behind a CDN show the CDN's addresses, so treat a shared IP as a lead that needs a second signal, such as identical templates.
5. Judge relevance and provenance. Did you, an agency or a previous owner pay for or arrange these links? Does Search Console's "Top linking text" show one keyword phrase repeated across unrelated sites?
6. Check for a manual action. Open the Manual actions report in Search Console. A green check means Google has not applied one.
7. Decide and write it down. Use the table below and keep a dated note of what you chose.

A paid backlink tool gives you a second dataset, because it crawls on its own schedule and can show links the Search Console sample misses. Semrush's Backlink Audit, for example, reviews up to 500 backlinks per referring domain, and its toxic markers include a "Link Network (by IP)" check for links from the same IP address as other linking domains. Start with the free data.

Why toxicity scores are heuristics

Backlink tools sell a number. Semrush's Toxicity Score runs from 0 to 100 and is built from 45 or more toxic markers, weighted by frequency and importance, with machine learning and user feedback in the mix. Semrush's own documentation tells you to review each flagged backlink manually "with the utmost care" before acting. One marker, "Community error", fires when several Semrush users have already disavowed links from the same domain. That reflects what other tool users did.

Moz's Spam Score follows the same logic. Moz trained a model on domains known to be penalized or banned, found 27 signals correlated with them, and reports how closely a site resembles that group. Moz itself says some signals are weak ones, for example that many spam sites have few pages, "hence the correlation". A small legitimate site can trip the same flags.

Both scores are vendor estimates calculated outside Google. Use them to build a shortlist to open and read, then make the call yourself.

Decision checklist

Signal	What to check	Action
Manual action for unnatural links	Manual actions report in Search Console	Try removal first, disavow what remains, then request a review
You, an agency or a past owner paid for links	Old invoices, outreach emails, agency reports	Ask for removal, then disavow what stays up
One domain supplies a large share of links	Pivot of the export by referring domain; open the site	Judgment call. Google's Links report documentation says it typically ignores links from known spam sites, so log it and monitor. Disavow if it also fits a paid or scheme pattern
Several domains on one IP, similar templates, same outbound links	IP lookup, view each site, compare pages	Treat as a link network. Disavow at the domain level if removal fails
Same keyword anchor across many unrelated sites	Top linking text report	Find who built them. Remove or disavow if a scheme is confirmed
Small, relevant blog, local directory or forum	Read the page and the site	Leave it
High score in a tool, nothing else	Open the links and read the markers	No action until a human finds a pattern
Sudden spike of new links	Latest links export, anchors, source sites	Document it, watch for a manual action, act only on a confirmed pattern

When a disavow file is warranted, and the downside

Google's documentation gives two conditions that must both hold: you have a considerable number of spammy, artificial or low-quality links pointing at your site, and those links have caused a manual action or likely will. It also warns that the tool is advanced and that, if used incorrectly, it can potentially harm your site's performance in Google Search.

The harm comes from disavowing links that were helping you. A low-authority link from a relevant local blog still counts for something, and a tool score cannot see that. Google's manual actions guidance says outright: make sure you do not disavow organic links to your site, and simply disavowing all backlinks without trying to remove them might lead to rejection of your reconsideration request.

The order is remove first, disavow what you cannot remove, and keep the file short enough to justify every line.

The disavow file format

Save the following as a plain text file ending in .txt, encoded in UTF-8 or 7-bit ASCII. These domains are invented examples; replace them with your own. Each line below is one line in the file.

# Disavow file for example.com, reviewed October 2026
# Content scraper supplying most of the links
domain:example-scraper.com
# Suspected link network, same IP address
domain:example-linkfarm-one.net
domain:example-linkfarm-two.net
# One page on an otherwise fine site
https://example-blog.com/sponsored-post.html

The rules from Google's documentation: one URL or domain per line, a domain: prefix to cover a whole domain or subdomain, lines starting with # are ignored, a maximum of 100,000 lines and 2 MB, and you cannot disavow a subpath such as a folder. For a link farm, domain lines save you from chasing individual pages.

How to submit it in Google's disavow tool

1. You must be an owner of the property. The tool does not support Domain properties, so if you have one, add a URL-prefix property for the same site. Mueller gave the same advice in the answer quoted earlier.
2. Go to the disavow links tool page and pick the property.
3. Upload your .txt file. If it has errors, Google lists them immediately and keeps your old list.
4. Wait. Google says it can take a few weeks to incorporate the list as it recrawls the web, and disavowed links still show in the Links report.

A new upload replaces the old list, so edit your saved master file and upload the whole thing each time. Cancel Disavowals on the same page removes everything. Google's full steps are in its disavow documentation.

What not to do

• Buy a "500 backlinks for $99" package. Google lists buying links for ranking purposes, and using automated programs to create links, as link spam. Sponsorship and advertising links are fine when they carry rel="sponsored" or rel="nofollow".
• Mass-disavow by score. Pasting every link above a threshold into a file is the pattern Google's own guidance warns against.
• Blame links for every ranking drop. Check your content and technical health before concluding that backlinks caused it.

If your real worry is a thin link profile, earning links beats cleaning them. For a local business that usually starts with accurate listings and genuine local mentions, covered in our local SEO guide for small businesses. A one-off backlink review is an afternoon of spreadsheet work for most small sites. If link cleanup is one part of a wider organic plan, our SEO service begins with a baseline audit, and the SEO cost breakdown for Canada shows what to budget.

Frequently asked questions

What are toxic backlinks?

Links from sources built to manipulate rankings, such as link farms, paid link networks and scraper sites. The term comes from SEO tools, and Google's own term is link spam.

How do I check backlinks for free?

Use the Links report in Google Search Console. It shows top linking sites and top linking text, and exports up to 100,000 rows. It is a sample that omits some links, so a paid tool can fill gaps.

Should I disavow bad backlinks?

Usually no. Google says most sites do not need the tool. Consider it when you hold a manual action for unnatural links, or when you know of paid or scheme links you cannot get removed.

How many backlinks is too many?

Google publishes no limit, and the total count says little. Concentration matters more. In our audit, 452 of 574 links came from one source, and that share was the finding.

What is a link farm?

A group of sites controlled by one party to generate links to other sites and pass ranking credit. Semrush describes a link network as sites controlled by the same person or company for the sole purpose of generating a high number of links. Shared IP addresses and identical templates are common footprints.