Toxic backlinks are spammy or manipulative links pointing at your site, but “toxic” is a label SEO tools invented, not a Google term. Google’s own rule is far stricter than any toxicity score: disavow only when you have a considerable number of spammy links and they have caused, or will likely cause, a manual action. In the cleanest public test I know of, disavowing 129 tool-flagged “toxic” URLs was followed by a 7.1% traffic drop, not a gain.
My position after working in SEO since 2012 and placing 15,000+ editorial links: stop auditing for toxicity scores. Audit the links you or a vendor paid for. That is where the real risk sits.
What are toxic backlinks?
A toxic backlink is any inbound link an SEO tool or auditor thinks could hurt your rankings. Google doesn’t use the word. It uses “link spam”, and its spam policies define it as “the practice of creating links to or from a site primarily for the purpose of manipulating search rankings.”
That definition is about intent, not appearance. It splits “toxic” links into three very different groups:
| Type | What it is | What Google does with it | Your job |
|---|---|---|---|
| Spammy (accidental) | Scrapers, mirror sites, random directories that link to you without your input | Ignores most of it | Nothing |
| Manipulative (built or bought) | Paid links that pass ranking credit, PBNs, link exchanges, automated links | Neutralizes it, or issues a manual action for a pattern | Remove, then disavow what you can’t remove |
| Tool-flagged “toxic” | Links scoring high on a vendor’s risk model | Nothing; Google never sees the score | Use it as a review list, not a verdict |
What makes a backlink toxic?
Google’s spam policies list the patterns it treats as link spam. These are the ones that show up in real backlink audits:
- Paid links that pass ranking credit: money, products or services exchanged for a followed link. Google wants paid placements marked
rel="sponsored"orrel="nofollow". - Private blog networks and link farms: sites that exist to sell or swap links. Our guide to PBN backlinks covers why these carry the highest risk.
- Excessive link exchanges and partner pages built only for cross-linking.
- Automated links: programs or services that create links to your site at scale.
- Low-quality directory and bookmark links.
- Widget, footer and template links spread across many sites, often with keyword-rich anchors.
- Forum comments and signatures with optimized anchor text.
Two more sources sit outside your control: hacked sites that inject hidden links, and negative SEO, where someone points spam at you on purpose. Over-optimized anchors are a pattern signal, not a link type; if most of your links use the same money keyword, read our anchor text guide.
Do toxic backlinks actually hurt your rankings?
Random spam: almost never. Links you built to manipulate rankings: yes, and in two ways.
For spam you didn’t build, Google is blunt. Asked in its June 2024 office hours how to report sabotage through toxic links, Gary Illyes answered: “I’d ignore those links.” Google’s help page on site ranking adds that it works “really hard to make sure that competitors can’t negatively affect other sites’ rankings.”
For links you built or bought, the risk is real:
- Algorithmic neutralizing. Google’s December 2022 link spam update said rankings may change “as spammy links are neutralized and any credit passed by these unnatural links are lost.” Nothing is “penalized”, but if paid links were holding up your rankings, the drop looks like a penalty.
- A manual action. Google’s manual actions report lists “Unnatural links to your site” for “a pattern of unnatural, artificial, deceptive, or manipulative links pointing to your site.” This one shows up in Search Console, and it is the only case where Google tells you links are the problem.
Which type of website is most vulnerable to toxic links?
A site with a history of buying links that pass ranking credit, swapping links at scale, or hiring cheap vendors who used networks. Google’s manual action is triggered by a pattern, and you only get a pattern by building one.
In my view, small sites with only a few dozen referring domains should pay the most attention. When a handful of bought links makes up a large share of the profile, the pattern is easy to see. A site with 2,000 referring domains and 40 scraper links has nothing to worry about.
How to find toxic backlinks
Start with Google, then use tools to filter, then judge by hand:
- Check for a manual action. In Search Console, open Security & Manual Actions, then Manual actions. “No issues detected” means you have no link penalty to clean up.
- Export your links. Search Console’s Links report lets you export by top linking sites or by latest links. Google’s manual action instructions tell you to start with the sites linking to you most, or the most recent ones.
- List what you built. Pull every vendor report, guest post list and exchange you ever agreed to. This list matters more than any score, because manipulation needs intent.
- Run a tool as a filter, not a judge. Semrush’s Backlink Audit gives each link a 0 to 100 Toxicity Score built from 45+ “toxic markers”. Semrush’s own guide says higher scores mean links “more likely to be risky”, not harmful. Other tools use different models, so the same link can score clean in one and toxic in another.
- Review by hand. Open the linking page. Ask: did someone pay for this? Does the site sell links openly? Is the anchor a money keyword on an unrelated page?
For the full process, follow our backlink audit checklist.
How to remove or block toxic backlinks
You can’t block a link that lives on someone else’s site. You have three options, in this order:
- Ask for removal. Google’s manual action guidance says to contact the site owner and ask them to “either remove the links or prevent them from passing PageRank” (a
nofolloworsponsoredattribute does that). - Disavow what you can’t remove, if the decision table below says so.
- Remove the target page as a last resort, if one URL attracted most of the bad links and has little value of its own.
Removal requests matter most under a manual action. Google warns that “simply disavowing all backlinks without attempting to remove them might lead to rejection of your request.”
How can I disavow toxic backlinks?
Through the disavow links tool in Search Console, with a plain text file. Google’s disavow documentation sets these rules:
| Rule | Google’s requirement |
|---|---|
| Format | Text file, UTF-8 or 7-bit ASCII, name ending in .txt |
| Entries | One URL or domain per line; domain:example.com for a whole domain |
| Comments | Lines starting with # are ignored |
| Limits | 100,000 lines (blank and comment lines count) and 2MB; URLs up to 2,048 characters |
| Property type | Not supported on Domain properties; use a URL-prefix property |
| Timing | “It can take a few weeks” for Google to incorporate the list |
Keep one master file with a comment explaining each entry, so you can undo a mistake later. Our step-by-step guide on how to disavow backlinks walks through the upload screens.
Are backlinks good or bad?
Good, when an editor chose to link because the page deserved it. Google’s help page on site ranking says the way to earn links is to “create unique, compelling content that other people want to link to.” A link turns bad only when it was created mainly to manipulate rankings, so judge each link by why it exists, not by the linking site’s DR or traffic.
What most toxic backlink guides get wrong
They stop at the two-part test instead of turning it into actions
Google’s disavow page says to use the tool only when both are true: you have “a considerable number of spammy, artificial, or low-quality links” pointing to your site, and “the links have caused a manual action, or likely will cause a manual action.” Guides quote it, then leave you to guess what “likely will cause” means. Here is the decision rule I use:
| Your situation | Action |
|---|---|
| Manual action for unnatural links in Search Console | Remove what you can, disavow the rest at domain level, file a reconsideration request with documentation |
| No manual action, but you (or a vendor) bought many followed links or ran exchanges | Ask for removal or rel="sponsored"; disavow the domains that refuse. This is the “likely will cause” case |
| No manual action, links you didn’t build (scrapers, random spam, a tool’s red list) | Do nothing |
| Sudden spike of spam links, no manual action | Do nothing; Google says it ignores these. Recheck Manual actions monthly |
They tell you to disavow URL by URL
One top-ranking guide advises listing single URLs rather than whole domains. Google’s manual action instructions say the opposite: use the domain operator when a site links to you many times. None of the top results mention the other trap: the disavow tool doesn’t work on Domain properties, so you need a URL-prefix property in Search Console to upload at all. Spam sites generate new URLs constantly; a URL-level file misses tomorrow’s pages. Disavow at the domain level unless one good site has a single bad page.
They have no test data, and the tests that exist don’t flatter disavowing
None of the top-ranking pages cite a real test. Two exist:
- Ahrefs, July to August 2024: the team disavowed 129 “toxic” and “potentially toxic” URLs flagged by an SEO tool across three blog posts. Over 20 days, traffic to the three pages fell 7.1% combined; one page gained 12.8% while another lost 12%. Their conclusion: little to no benefit, with a possible downside.
- Zyppy, May to July 2024: Cyrus Shepard disavowed every link to his site, over 10,000 links from 1,473 domains, including links from Moz and Ahrefs. He reported no meaningful harm after nearly two months.
Both are small, short tests, and a Google core update cut the Ahrefs test short. But together they point one way: disavowing links Google already ignores changes little, and you take a risk for no gain. John Mueller said the same in November 2022: disavowing links “that some tool has flagged, is not a good use of your time.”
They don’t tell you where the tool is heading
The disavow tool still works, but Google keeps distancing itself from it. In spring 2024 Mueller wrote on X about the tool: “At some point, I’m sure we’ll remove it.” In April 2025 he said it is “not part of normal site maintenance.” Meanwhile Google ran several spam updates in 2026, most recently in September, and its spam policies page was last updated on 28 August 2026. The direction is clear: Google handles spam itself, and the disavow file is an emergency tool for manual actions, not a monthly chore.
My verdict: what to do about toxic backlinks
If you have no manual action and never bought links that pass ranking credit, ignore toxicity scores. Spend the hours on content and links that earn traffic.
If you bought links, or a past agency did it for you, clean up the paid placements first. Ask publishers to add rel="sponsored", disavow the domains that won’t, and keep a commented master file.
The cheapest fix is upstream. When I vet a site for a placement, I check for at least 2,000 real monthly organic visitors, a human editor and a clean outbound profile, and we never use PBNs or link farms. Links placed that way don’t end up in a disavow file. If an agency won’t show you the site list before you pay, walk; our guide to link building scams lists the other red flags, and our editorial link building page shows how we work.
Not sure whether old vendor links put your site at risk? Ask for a free audit, or see what clean, vetted links cost on our link building pricing page.
