Toxic Backlinks: Google Says Most Sites Should Never Disavow
The disavow tool was built in 2012 to answer a penalty that stopped existing in September 2016. That was ten years ago this week. An entire cleanup industry is still selling the cure for it.
Google's documentation for the disavow tool contains a section heading that reads, word for word, "Step 0: Decide if this is necessary." The paragraph underneath it says: "In most cases, Google can assess which links to trust without additional guidance, so most sites will not need to use this tool."
That tool is the disavow file, and it is the one every toxic backlinks cleanup service on the market points you toward. So this is the maker of the tool, on the tool's own instruction page, telling the overwhelming majority of readers to close the tab. Two paragraphs earlier the same page warns that the feature "should only be used with caution" and that "if used incorrectly, this feature can potentially harm your site's performance in Google Search results."
Meanwhile a whole category of software renders a red number next to your domain, labels it toxicity, and invites you to clean it up monthly.
Both of those things cannot be right.
This post is the argument that they are not, and that the confusion survives because two completely different situations are wearing one name. In the first, you have a manual action in Search Console, or you bought links and you know it. Disavow is the correct tool and you should use it carefully. In the second, you have a dashboard showing red. This is the overwhelmingly common case, and the correct action is almost always nothing at all.
Conflating those two is how a cleanup industry got built on a tool its maker says you probably do not need.
Toxic is a vendor word, not a Google word#
Search Google's own documentation for "toxic backlinks" and you will not find the phrase, because it is not a concept Google uses. What Google publishes is a spam policy for link spam, and the definition in its first line is doing more work than most people notice:
Link spam is the practice of creating links to or from a site primarily for the purpose of manipulating search rankings.
Creating. Not receiving. Then the page gives examples, and the examples are the real evidence. There are eleven of them at the top level: buying or selling links, excessive link exchanges, using automated programs to create links to your site, requiring a link as a condition of a contract, text ads that do not block ranking credit, advertorials, low-quality directory and bookmark links, keyword-rich links embedded in distributed widgets, widely distributed footer and template links, forum comments with optimised links, and creating low-value content to manipulate linking signals.
I went through them one at a time looking for an example that describes a link arriving at your site without your involvement. There isn't one.
How to handle toxic backlinks in 2026, in five steps#
Nothing is held back for later. This is the whole method, and every step links down to the section that argues it.
- Open Search Console and check Manual Actions first. This one check decides everything that follows. If the report says "No issues detected", you do not have the problem the cleanup industry is describing, and no third-party score changes that. If it shows an unnatural links action, you do, and the rest of this list is for you. The documentation is explicit about this.
- With no manual action, do nothing. Not "monitor monthly", not "disavow the worst ones as insurance". Google's system neutralises unnatural links rather than penalising their target, and a disavow file uploaded on a hunch can remove credit from links that were helping you.
- If there is an action, find the links you actually created. Go through invoices, old agency reports, guest-post outreach, directory submissions, widget campaigns. The reviewer is looking for evidence of a link scheme, and a scheme has a purchase history. Third-party spam scores will not find it for you, because they are not measuring your links at all.
- Try removal before disavow. Google's page asks you to remove what you can first and reach for the file only for what you cannot. This is slow, unglamorous email work, and it is also the part a reviewer can see you did.
- Disavow at domain level, keep the file, and write down why. One line per domain, prefixed
domain:, with#comments recording the date and the reason for each block. Your successor will need that file, and so will you in eighteen months. Then go and earn the links that actually move you, because a cleaner profile and a stronger one are not the same project.
One practical trap before the detail. Google's page carries a line that almost nobody quotes: "The disavow links tool does not support Domain properties. If you have a Domain property, this page does not apply to you." Domain properties are the modern default in Search Console, the ones verified by DNS that cover every subdomain and both protocols at once. If that is how your property is set up, the tool you are being sold a cleanup service for will not accept a file from you.
What Google's disavow page actually says#
The disavow documentation is short, and it is worth reading in the order Google wrote it, because the order is the argument.
It opens with a condition, not an instruction: if you have a manual action for unnatural links, or if you think you are about to get one because of paid links or other schemes, you should try to remove those links. Only if you cannot remove them should you disavow.
Then comes the warning about caution and potential harm. Then Step 0, which is the heading I opened this post with.
Then the criteria, and these are the sentence to memorise, because they are joined by an AND and almost every piece of advice on this keyword quietly drops the second half. You should disavow only if you have a considerable number of spammy, artificial, or low-quality links pointing to your site, and the links have caused a manual action, or likely will cause one.
A red dashboard number satisfies neither condition. It is not a count of spammy links, as we are about to see, and it is certainly not a manual action. Google does not tell you which links it distrusts. There is no Search Console report that flags individual bad links, which means that anything presenting itself as a list of links Google has a problem with is a vendor's guess wearing Google's authority.
The page has one more line worth carrying around: after you upload, "it can take a few weeks for Google to incorporate your list into the index as Google recrawls the web." Disavow is not a switch. Anyone offering you a monthly cleanup cycle is selling a cadence faster than the mechanism can respond to.
What a spam score of 62 actually asserts#
Every major tool ships some version of this number. To its credit, one of them documents exactly how it is built, and the documentation dismantles the way the number gets used.
Moz's help page for Spam Score defines it like this:
Spam Score represents the percentage of sites with similar features to the site you're researching which we've found to be penalized or banned by Google.
Read that twice, because the subject of the sentence is not the site you are looking at. The score is built from a machine learning model that found 27 common features across a training set of sites known to have been penalised or banned. When it tells you 62, it is saying: of the sites that share this site's feature profile, 62% turned out badly.
That is a lookalike model. It is the same statistical object as an insurance premium or an ad audience. It describes a population and then attaches the population's base rate to an individual, and the individual's actual status is nowhere in the calculation.
Moz says so plainly, in a sentence that ought to be printed on every backlink audit ever sold: "A high Spam Score for your site, or a site you're looking at, doesn't mean this site is necessarily spammy. It's a sign that you should do some more investigation."
Two more details from the same page finish the job. Asked directly whether Spam Score is a calculation of the Spam Score of sites linking to you, Moz answers: "No, it's not." And the score updates quarterly. Four times a year. Any service billing you monthly to act on it is invoicing three times for a number that has not moved.
How the three big tools score toxic backlinks#
Moz is one vendor. If the scores across the market agreed with each other, the lookalike objection would be a technicality. They do not agree, and the reason is structural: each one is measuring a different thing and saying so in its own documentation.
Semrush publishes a Toxicity Score on a 0 to 100 scale, built from a different object entirely. Its knowledge base states that "there are currently 45+ different toxic markers that Semrush uses in determining the Toxic Score for a backlink," and that during analysis "the tool takes into account each toxic marker's frequency and importance. We also use machine learning and user feedback." The markers are properties of the linking site, described plainly: a non-indexed domain is one where "the link comes from a domain that was potentially penalized by Google", a spam TLD is one where "the link comes from a top-level domain that appears to be a source of spam", and a poor backlink profile means "the source domain has a poor backlink profile. As a result, search engines might evaluate it as a weak source to receive links from."
That is a heuristic checklist of site properties. Moz's number is a base rate from a lookalike population computed across 27 features. Both are reasonable engineering. They are not the same measurement, they do not share a scale, and there is no conversion between them, which is why the same backlink routinely scores clean in one tool and red in another. And Semrush's own page ends where Moz's does, with a caution rather than an instruction: "Manually review with the utmost care each backlink marked as toxic/potentially toxic before starting the removal process."
Ahrefs is the interesting one, because it declines to ship the metric at all. In Toxic Backlinks: SEO Woe or a Load of Baloney?, Joshua Hardwick writes that "as far as 'toxic backlinks,' this is just a term made up by certain SEO tools to describe backlinks they think could hurt your rankings based on several so-called 'markers.'" On using those tools to build a removal list, he is blunter than I have been: "Trusting these can do more harm than good. Way more." The piece cites a site that lost 60% of its traffic after acting on one, and quotes Marie Haynes saying that the genuinely dangerous links "are rarely returned by an SEO tool."
So: two vendors ship a number and both attach a manual-review warning to it, and the third refuses to ship one and calls the category invented. There is no version of the market where the red bar you are looking at is a measurement of risk. It is one company's heuristic, and its maker wants you to check it by hand.
Which raises the practical question the scores are standing in for: how do you actually identify a link that matters? You look at provenance, not properties. Did you or anyone working for you create, buy, exchange or request it? Does a cluster of links share the same commercial anchor text, the same footprint, the same handful of IPs? Those two questions find link schemes, because link schemes have an author and a pattern. A score cannot answer either one, because it never had access to your invoices.
If that lands, then the month you were about to spend subtracting is a month available for the opposite work, and GenLink will run it with one free agent while you decide whether the number ever mattered.
The threat this tool was built for ended in 2016#
Here is the part of the story that explains why so much writing on this keyword feels stuck.
Google announced the disavow tool in October 2012, six months after the first Penguin update. Penguin 1.0 worked as an external filter applied to search results, and its effects were coarse: a site could be demoted as a whole because of a link scheme aimed at one section of it, and because the filter only refreshed periodically, the demotion could persist for months after the site was cleaned up. In that world, a disavow file was genuinely load-bearing. It was the only way to say "those are not mine" before the next refresh.
Even then Google framed it narrowly. Webmaster Trends Analyst Jonathan Simon, quoted in Ahrefs' history of the tool: "If you've been notified of a manual spam action based on 'unnatural links' pointing to your site, this tool can help you address the issue. If you haven't gotten this notification, this tool generally isn't something you need to worry about."
Then Penguin 4.0 shipped on 23 September 2016, and Gary Illyes described the change in one sentence: "Penguin now devalues spam by adjusting ranking based on spam signals, rather than affecting ranking of the whole site." Penguin also became real-time, so recovery no longer waited on a refresh. The specific mechanism the disavow tool existed to counter, sitewide demotion that outlived the cleanup, was retired that day. It turned ten years old this week.
Six years after that, Google went further. The December 2022 link spam update announced that it was "leveraging the power of SpamBrain to neutralize the impact of unnatural links on search results," and specified that the system detects "both sites buying links, and sites used for the purpose of passing outgoing links." Buyer and seller. Not the site that happened to be on the receiving end of somebody else's spam network.
Neutralise is the operative word, and it is a very different verb from penalise. A neutralised link passes nothing. It does not subtract. If Google's systems already discount the link, a disavow file that names it changes nothing, which is the mechanical reason the documentation says most sites will not need the tool.
None of this means manual actions stopped existing. They did not. Google still issues them, they still appear in Search Console, and when one lands the disavow tool is exactly the right instrument. What changed is that the algorithmic half of the problem, the half no human ever tells you about, moved from punishment to indifference. That is the half every toxicity dashboard is implicitly about.
The case for disavowing anyway#
There is a real counter-argument and it deserves better than a dismissive paragraph.
The strongest version is not that spam scores are accurate. It is that disavowing is asymmetric insurance. A disavow file is free, takes an hour, and if Google is already ignoring those links then filing them costs you nothing. Against that, the downside if a manual reviewer ever does look at your profile is weeks of lost traffic and a reconsideration request. Under that framing you should file the thing and stop worrying.
Ahrefs, a vendor with every commercial reason to sell you an audit, opens its own guide by answering "should I disavow?" with "it depends", and spends the piece on how hard it is to separate links that help from links that threaten. That honesty is the crack in the insurance argument.
The insurance is not free, because a disavow file is not a list of links Google should ignore for your safety. It is a list of links Google should stop counting, full stop. If your list is assembled from a lookalike score rather than from your own purchase history, some of the domains on it will be sites that linked to you for ordinary reasons and happen to share features with penalised sites: old, small, oddly built, foreign-language, sparsely linked. You will be removing real credit to protect yourself from a penalty you have no evidence you face. Google's own page warns about precisely this outcome when it says incorrect use "can potentially harm your site's performance."
So the honest position is narrower than either camp: disavow is cheap insurance only when you have a specific reason to think you were targeted or that you or a predecessor bought links. A reason is a memory, an invoice, or a message in Search Console. A red number is not a reason.
And there is one more thing I cannot tell you, so I will say it plainly. I do not have first-party data on how many sites with high toxicity scores ever receive a manual action, because nobody outside Google does. Manual action data is not published, not sampled, and not available through any API. Any writer who gives you that conversion rate has invented it. The case in this post rests entirely on what Google documents and what the vendors document about themselves, which is the only evidence available and, as it turns out, enough.
What to do when your profile looks weak#
Most people who land on this keyword are not recovering from a penalty. They are looking at a comparison of their backlink profile against a competitor's, feeling that something is wrong with theirs, and reaching for the only lever the tooling offers: removal.
The feeling is usually correct and the diagnosis is usually backwards. A profile that looks bad next to a competitor's is almost never poisoned. It is thin. The competitor has four hundred referring domains and you have sixty, so yours is dominated by whatever arrived on its own, which is scrapers, aggregators, directories you never submitted to, and the long tail of the web's background noise. Every site accumulates that. On a site with four hundred earned links it is a rounding error. On a site with sixty it is most of the picture.
Deleting the noise does not fix the ratio, because the noise is not what you are missing. There is no version of this where you subtract your way to a strong profile.
The useful version of an audit is not a toxicity sweep. It is the backlink audit that asks which pages on your site have earned links, which of your best pages have earned none, and which sites already link to three of your competitors and not to you. That last list is the actual work: it is finite, it is specific, and unlike a disavow file it has an upside. The rest of the method sits in our deliberate link building plan, which is the same argument at full length.
That is where the hour goes, and it is worth knowing what replaces it.
A disavow file takes an afternoon to assemble and a few weeks for Google to maybe act on, and when it finishes, your profile is exactly as strong as it was before you started. That is the trade this keyword keeps hiding. GenLink spends the same hours on the other side of the ledger: it replaces the prospecting spreadsheet, the email-finder tab you never close, the cold domain that gets you filtered before a word is read, and the follow-up that was always going out tomorrow. It finds relevant sites, finds the person, writes the pitch, sends it from a mailbox with real sending history, and triages the replies. The free tier runs one agent, so you can point it at a single page before you decide anything.
A last note on the links you genuinely do not want credit from. If you control the page, or the relationship, the right instrument is usually not disavow at all: it is the rel attribute on the link itself. Google's spam policy says explicitly that buying and selling links "is a normal part of the economy of the web for advertising and sponsorship purposes" and is not a violation "as long as they are qualified" with nofollow or sponsored. Qualification is the sanctioned route. Disavow is the emergency one.
The shape of the whole thing#
Strip out the industry and the sequence is short.
Google has no concept called a toxic backlink. Its link spam policy describes eleven things you might do and nothing that might be done to you. Its ranking systems have neutralised rather than punished unnatural inbound links for ten years. Its disavow documentation opens by asking whether you need the tool at all and answers, for most sites, no. And the number that sends people looking for the tool is a vendor's honest attempt to describe a population, which the industry then repackages as a verdict on an individual, on a monthly cycle, for a metric that updates four times a year.
None of which means you should be relaxed about your backlinks. It means the anxiety is pointed at the wrong end of the problem. Check for a manual action, because that check is free and decisive. If there isn't one, close the audit and go and find the twelve sites that link to your competitors and not to you.
Checking for a manual action takes thirty seconds. Earning the links you are actually missing is the part that takes a year, and it is the only part that changes the number you care about. Hand that part to GenLink and what leaves your stack is the prospect list you keep meaning to build, the contact-finding tab, the unwarmed sending domain, and the second email nobody sent. What stays with you is the judgement: which of your pages deserve to rank. Start free with one agent and watch it work a single page end to end.
Frequently asked questions#
Are toxic backlinks real? The links are real. The category is not. There are links from low-quality sites, and there are links built to manipulate rankings, and Google has policies about the second kind. What does not exist is a Google-recognised class of inbound link that damages a site that did not create it. "Toxic" is a label attached by tools that need a threshold to draw a red bar at.
Can a competitor hurt my rankings by pointing bad links at me? This is what people mean by negative SEO, and it is the honest worry underneath the whole keyword. Google's position, implemented in Penguin 4.0 and restated in the 2022 SpamBrain update, is that unnatural links are neutralised rather than counted against the target, and its documentation says Google "works very hard to make sure that actions on third-party sites do not negatively affect a website." That is a design goal, not a guarantee, and no system is perfect. But if you suspect you are being targeted specifically, that is one of the few situations where a disavow file is a reasonable precaution.
Should I disavow the links Google flagged? Google does not flag links. There is no report in Search Console that identifies individual links Google distrusts, and the Links report lists what points at you without any judgement attached. Every list presented to you as flagged links is a third-party model's output. Treat it as a research starting point, never as an instruction.
How do I know if I have a manual action? Search Console, left sidebar, Security and Manual Actions, then Manual actions. It either says "No issues detected" or it describes the problem and the affected scope. There is no ambiguity and no interpretation required, which is why it should be the first thing you look at and not the last.
Does a high spam score mean I will be penalised? No, and the vendors say so themselves. The score reports the share of sites with a similar feature profile that were found to have been penalised. Being similar to sites that got penalised is not the same as having done anything, in the same way that living in a high-claim postcode is not the same as having crashed your car.
Should I disavow at URL level or domain level?
Domain level, in almost every case where disavowing is warranted at all. Spam networks generate URLs faster than you can list them, so a URL list goes stale within weeks, while domain:example.com covers the subdomain and everything under it. Keep comment lines in the file recording the date and the reason for each entry, because in a year you will not remember.
How long does a disavow file take to work? Google says it can take a few weeks, because the file only takes effect as Google recrawls and reprocesses the pages involved. There is no confirmation event and no report that tells you it worked. That lag is worth holding onto when someone offers you a monthly toxic-link cleanup: the mechanism cannot respond at the speed the service is billed at.
