Key Takeaways - Only 4% of SEO professionals regularly disavow suspicious backlinks — Google's SpamBrain neutralizes most spam automatically - The disavow tool has two legitimate use cases: confirmed manual actions for unnatural links, and provably harmful spam you cannot get removed manually - Always attempt manual link removal first — a removed link is gone permanently; a disavowed link still exists and requires ongoing file maintenance - Over-disavowing is a documented ranking risk: disavowing legitimate editorial links strips real equity from your profile - A quarterly backlink audit is sufficient for most sites; use Semrush Backlink Audit (45+ toxicity markers) or Ahrefs for systematic triage
The $40K Lesson a Toxic Link Campaign Almost Cost One SaaS
In late 2024, a B2B SaaS company in the project management space watched their primary commercial keyword rankings collapse — falling from position 4 to position 23 over six weeks. When their SEO team pulled a backlink report, they found 4,200 new links added in 30 days, almost exclusively from Russian pharmaceutical sites, payday loan directories, and online casino networks.
This was a textbook negative SEO campaign. But before they could act, they had to answer the harder question: *which* of those links actually needed action, and which could Google handle automatically?
The answer reshaped their entire approach to link auditing — and the principles apply to any site dealing with toxic backlinks, whether from an attack, a legacy black-hat agency relationship, or years of accumulated link rot.
This guide walks through the exact cleanup process, from first backlink export to final disavow file submission.
What Actually Makes a Backlink "Bad"
The term "bad backlink" gets used loosely. From an SEO standpoint, there are four distinct risk categories:
1. Actively penalized links. Links from domains or pages Google has manually or algorithmically penalized for link schemes. Highest risk category.
2. Spam-network links. Links from known link farms, PBN networks, and low-quality directory mass submissions. Google's SpamBrain AI system is specifically trained to neutralize these.
3. Irrelevant low-quality links. Links from sites completely unrelated to your niche with zero organic traffic. These rarely harm rankings — Google typically ignores them — but they inflate link counts without adding equity.
4. Anchor text manipulation. Links using over-optimized, keyword-stuffed anchors that create an unnatural distribution. Per Semrush's 2024 Backlink Analysis Benchmark Report, a healthy anchor profile has 60–70% branded/URL anchors and no more than 5–10% exact-match keyword anchors.
Categories 1 and 4 are your genuine risk exposure. Categories 2 and 3 are largely handled algorithmically, and disavowing them provides minimal incremental benefit in most cases.
Step 1: Build Your Complete Backlink Inventory
You cannot audit what you haven't found. Start with a full backlink export from at minimum two sources — tools have different crawl coverage, and you want comprehensive data.
Google Search Console (free, highest authority): Navigate to Search Console → Links → External Links → Export. This is Google's actual view of your backlink profile — the most authoritative source available.
Ahrefs or Semrush (paid, broader crawl): Ahrefs indexes over 35 trillion links; Semrush indexes 43 trillion. In a standardized comparison test, Semrush found more backlinks than Ahrefs for 87% of test sites, making it the stronger choice for comprehensive audits. Export all backlinks with their metrics: Domain Rating/Authority Score, organic traffic to the linking domain, anchor text, and follow/nofollow status.
Combine both exports into a single spreadsheet and remove duplicates. You're looking for the union of what Google sees and what the tools crawl. For sites under 100K backlinks, this full export takes under 30 minutes.
Step 2: Systematic Toxicity Triage
Running Automated Toxic Analysis
Semrush Backlink Audit applies 45+ toxicity markers per link and assigns a Toxicity Score (0–100). Links scoring 60+ warrant manual review; links scoring 80+ should typically be actioned. The tool integrates directly with Google Search Console for one-click disavow file export.
Ahrefs doesn't have a dedicated toxicity score, but the combination of URL Rating (UR) and Domain Rating (DR) is useful: a link from a DR 3 domain with zero organic traffic is a low-quality signal regardless of other characteristics.
Manual Triage Criteria
Automated scores are a starting point, not a verdict. Manual review should focus on these signals — the same criteria Google's quality raters use:
| Signal | Red Flag Threshold | Action Priority | |---|---|---| | Anchor text | Exact-match keywords, pharmaceutical or adult terms | Priority review | | Domain organic traffic | 0 monthly visits (Semrush/Ahrefs) | Likely spam | | Language mismatch | Foreign-language site with no translated content | Low unless high volume | | Page placement | Footer, sidebar, comment section only | Lower quality, rarely harmful | | Domain age | Registered within last 90 days, no real content | Higher risk | | Link velocity | 500+ links from same domain within 30 days | Investigate pattern |
Per Google Search Central documentation on link schemes, the patterns that trigger manual actions include: links with optimized anchor text distributed across many sites, sitewide links embedded in widgets, and links not editorially placed by the page's owner.
Step 3: Manual Removal Requests — Always First
Before using the disavow tool, attempt manual removal of the most toxic links. The rationale is clear: a manually removed link is gone permanently. A disavowed link still exists in your profile, still appears in exports, and your disavow file requires ongoing maintenance.
The contact workflow: 1. Find the contact email for the linking domain (WHOIS, site contact page, or LinkedIn for the domain owner). 2. Send a brief, professional removal request — "Please remove the link at [URL] pointing to [your URL]. Thank you." is sufficient. 3. Follow up once after 10 days if no response. 4. If still no response after the second attempt, document the effort and proceed to disavow.
Realistic expectations: Per Ahrefs' outreach benchmark data, removal request response rates average 5–10% for cold outreach to random webmasters. This low rate is expected — the disavow tool was created specifically because manual removal is often impossible. For low-authority, zero-traffic spam sites, don't invest more than 15 minutes per link on removal attempts before moving to disavow.
Step 4: Creating and Uploading Your Disavow File
Once manual removal attempts are exhausted, build your disavow file. This is a plain text (.txt) file following Google's exact specification.
Domain-level disavow (recommended when the entire domain is spammy):
domain:spamsite.com domain:linkfarm.net
URL-level disavow (for specific problematic pages on otherwise legitimate sites):
https://legitimate-site.com/spam-directory/your-link-page.html
Best practice: Always disavow at the domain level when the entire domain is problematic. Note that this also disavows any *good* links from that domain — for general authority sites where only one page is problematic, URL-level is safer.
Per Google Search Central disavow documentation: disavowing an entire domain is appropriate when you have reason to believe the entire domain is problematic. Processing takes 2–6 weeks as Google recrawls the disavowed source pages — there is no way to accelerate this.
Upload via the Disavow Tool in Google Search Console: select your property, upload the .txt file, and confirm the successful upload notification.
What Absolutely NOT to Disavow
This is where link audits go wrong. According to a 2026 survey of SEO professionals, 61% of practitioners don't use the disavow tool at all — and the subset most likely to harm their sites are those applying it too aggressively.
Never disavow: - Competitor press coverage, even from low-DA publications - Forum mentions from legitimate communities (even nofollow) - Human-reviewed directory listings with real organic traffic - Links with branded anchor text, even from low-authority sites - Any link that passes a manual review as editorially placed
The disavow tool was designed for unambiguous spam and link scheme links. When in doubt, the risk of disavowing a legitimate link (losing real equity) substantially exceeds the risk of leaving a borderline link in place.
Google's John Mueller has stated repeatedly that for most sites, the disavow tool provides no benefit — Google's algorithms handle spam signals without webmaster input. Per Search Central: "Google's systems generally ignore low-quality links, so in most cases, it's not necessary to disavow them."
Setting Up Ongoing Backlink Monitoring
A one-time cleanup establishes a clean baseline. The challenge is maintaining it.
Monthly monitoring: Set Google Search Console email alerts for manual action notifications — these fire within hours of a manual penalty being applied. For proactive detection, configure Ahrefs or Backlynk's backlink analyzer to alert on link velocity spikes above 50 new referring domains in a 7-day window.
Quarterly full audits: Run a complete Semrush Backlink Audit quarterly and export any new links scoring 60+ toxicity for review. Most sites accumulate 10–30 borderline links per quarter from comment spam and automated link tools — a quarterly cycle keeps this manageable.
Annual disavow file review: Disavow files accumulate entries for expired domains over time. Annually, remove entries for domains that are now expired or parked — these add no protective value and large disavow files are harder to maintain accurately.
Recovery Timeline: What to Expect
After disavow submission, recovery follows a predictable arc. Google recrawls continuously: small sites with under 10K pages are typically reprocessed within 2–4 weeks; large sites take longer. Ranking movement typically appears 4–8 weeks after disavow processing.
The SaaS case study mentioned at the top: their disavow file covered 3,800 domains and was submitted six weeks after the attack began. Rankings recovered to within one position of baseline at week 14. A two-position residual gap persisted — a reminder that trust recovery after link manipulation signals isn't always 100% complete.
---
FAQ: Removing Bad Backlinks
Does the disavow tool actually work? Yes, for its intended use cases: confirmed manual actions for unnatural links and provably harmful spam you cannot remove manually. Per Google Search Central documentation, Google's algorithms automatically handle most spam, making disavow unnecessary for the majority of sites. It's most effective when used surgically post-manual-action.
How do I check if I have a manual action for bad links? Go to Google Search Console → Security & Manual Actions → Manual Actions. Any active manual action appears here with a description. Google also sends email notifications to verified Search Console users when a manual action is applied.
How many backlinks should I disavow? There's no target number. Sites with no history of paid link building and no active attack may need zero entries. Sites recovering from aggressive link schemes may need hundreds of domain-level entries. Precision matters more than volume — the quality of triage determines outcomes.
How long does the disavow tool take to work? Google incorporates disavow files as it recrawls source pages, typically 2–6 weeks. Ranking changes appear 4–8 weeks after processing, per documented recovery data. There is no way to force-process a disavow file faster.
Can removing bad backlinks hurt my rankings? Yes — disavowing links incorrectly classified as spammy strips real equity and can measurably harm rankings. This is why the disavow tool is for confirmed spam, not anything with a low authority score.
Do I need to disavow links from expired domains? Expired domains typically become zero-value sources (no crawl, no PageRank flow) without disavow action. They require disavow only if they are actively redirecting to live spam sites and still passing links.
What's the difference between disavow and nofollow? Disavow is a request to Google from the *receiving* site — asking Google to ignore an inbound link. Nofollow is a directive placed by the *sending* site on outbound links. They operate at opposite ends of the same link.
Should I use a third-party tool or do this manually? Third-party tools like Semrush Backlink Audit and Backlynk's analyzer dramatically reduce audit time by automating toxicity scoring. Manual review is still required for edge cases — automated tools have false positive rates that can cause over-disavowing if used without human triage.
---
*The fastest path to a clean backlink profile is prevention: building only on vetted, editorial sources from the start. Audit your current profile with Backlynk's backlink analyzer to get a baseline toxicity assessment, then explore our directory network for legitimate referring domain opportunities that never require cleanup.*