Google already ignores most of the spam links pointing at your site, and it has done since 2016. That’s what Penguin 4.0 changed: bad links stopped carrying a penalty and started carrying nothing at all.
So the honest position on toxic backlinks is narrower than the tools selling audits suggest. Most sites have nothing to act on.
What follows is the case where action is warranted and the much larger case where it isn’t. You can tell which one you’re in without paying for a score.
Where the Toxic Score Comes From
You’re looking at a vendor’s own model, because no search engine publishes a toxicity rating. Every number is built from signals that vendor chose, and calibrated against nothing you can inspect.
Two tools will score the same link differently, and neither is reporting a Google opinion. They’re reporting their own.
That doesn’t make the scores useless. It makes them a triage aid rather than a verdict, which matters when a report tells you 40% of your profile is dangerous.
What Google Discounts on Its Own
Link spam that a site did not build is the ordinary condition of the web. Scraper copies, directory dumps, comment spam and auto-generated pages point at almost every domain that has existed for a while.
Treating those as an emergency misreads how the system works. They’re ignored, which is not the same as punished.
| Situation | What happens |
|---|---|
| Scraper sites copying your pages | Discounted, no action needed |
| Spun directory and bookmark links | Discounted, no action needed |
| Blog comment spam pointing at you | Discounted, no action needed |
| A paid link scheme you commissioned | Can trigger a manual action |
| A manual action already in Search Console | Disavow plus a reconsideration request |
The split runs along one line: links you caused, and links that happened to you.
The Narrow Case for Disavowing
Google’s own guidance is that most sites should not use the disavow tool. The cases that survive that filter are few.
- A manual action naming unnatural links. Search Console tells you plainly, and this is the one unambiguous trigger.
- Links you or a past agency built. Where a scheme exists and you know it exists, cleaning it up is honest housekeeping.
- A site you inherited with a known history. An acquired domain carrying someone else’s tactics is worth auditing once.
Outside those, a disavow file is effort spent on links that were already being discounted. Worse, an over-broad file can remove links that were helping you.
If you’re diagnosing a drop rather than responding to a notice, the cause is more often a core update or a technical fault. That path is set out in Google ranking dropped dramatically.
How to Audit Without Buying a Score
You can settle the question with data you already have, in about an hour.
Check Search Console for a manual action first
Open the Manual Actions report before anything else. If it’s clean, no algorithmic penalty is sitting there waiting to be found, because algorithmic discounting doesn’t produce a notice.
Sort your profile by what you recognise
Pull your link list and separate placements you or an agency arranged from everything else. That second pile is the web happening to you, and it’s rarely your problem.
Read a sample rather than a percentage
Open twenty links from the low-scoring pile and look at the pages. Most audits that alarm a client dissolve once someone reads the actual pages instead of the summary number.
Why Negative SEO Rarely Works
It rarely works because the mechanism it relies on is the one Google removed. Pointing spam at a competitor assumed those links would be counted against them, and since 2016 they’ve mostly been discounted instead.
The attacker is buying links that do nothing, aimed at a target that absorbs them. That’s a poor trade even before the cost.
Google has said repeatedly that most sites need not worry about it, and the pattern in practice matches. Sites convinced they’ve been attacked usually turn out to have a core update or a technical fault behind the drop.
What a real attack looks like
The credible version isn’t a link burst at all. It’s content scraping that creates duplicates, or a hacked page injecting links out of your site, and both of those are visible in your own reports.
Look for changes on your side before assuming an attack from outside. An unexpected outbound link on your own pages is a far more serious finding than an unexpected inbound one.
What a Cleanup Cannot Do
A disavow file does not lift rankings that were never suppressed. If discounted links were doing nothing, removing them from consideration also does nothing.
That’s the disappointment behind most cleanup projects. The links were neutral, the ranking problem was elsewhere, and the audit found what it was built to find.
Where a profile genuinely is thin rather than poisoned, the answer is earning placements worth counting. A managed contextual link building programme addresses that, and a link building consultant can tell you which of the two you have.
Frequently Asked Questions
Do toxic backlinks hurt my rankings
Usually not. Google discounts most spam links rather than penalising the target, so links you did not build are unlikely to be the cause of a drop. A manual action is the exception, and it announces itself.
Should I disavow links with a high toxic score
Not on the score alone. The number is a vendor model with no Google equivalent, and disavowing on it risks removing links that were helping. Act on a manual action or on links you know were built.
Can a competitor hurt me with bad links
It’s far harder than the phrase negative SEO suggests. The same discounting that ignores your own spam ignores theirs, which is why Google has repeatedly said most sites need not worry about it.
How do I know if I have a manual action
You open Search Console’s Manual Actions report, which states it directly. There’s no ambiguity and no need to infer it from a score, a drop or a tool’s warning.
Does a disavow file need constant updating
No. It’s a narrow remedy for a specific problem, not routine maintenance. A site adding one every quarter is treating a non-problem as a habit.
Read the Pages Before You Read the Score
The fastest way through a frightening audit is to open the links it flagged. A score describes a model, and the page describes the web, and only one of those is the thing Google looked at.