How Do You Audit Your Backlinks for Quality and Spam?

The short version: Pull every backlink you have from Google Search Console and a crawler like Ahrefs or Semrush, sort them by spam signals rather than domain authority, and disavow only the links that are toxic, not the ones that simply look low quality. Most sites do not have a spam problem big enough to matter, and chasing every weird-looking link wastes hours you could spend building better ones.

Why most backlink audits go wrong before they start

I see small business owners open a backlink report, panic at a list of 400 domains they have never heard of, and start disavowing links at random. That is the wrong instinct. Google's own John Mueller has said publicly that most sites do not need to use the disavow tool at all, because Google's algorithms already discount spammy links on their own. Spending a Saturday disavowing a few hundred low-quality directory links usually does nothing for your rankings.

The real reason to audit backlinks is not to tidy up a messy-looking list. It is to catch the small number of links that are actively hurting you: paid link schemes you might have bought years ago, negative SEO attacks from a competitor, or leftover links from a dodgy guest post campaign run by an agency you fired in 2023. Those are rare but real, and they are worth two or three hours a year to check for.

Step 1: pull the full list from two sources

Do not rely on one tool. Google Search Console shows you exactly what Google knows about and counts, which is what matters for rankings. Export the full list under Links then Top Linking Sites, and get the raw CSV, not just the summary.

Then run the same domain through Ahrefs or Semrush. Their crawlers find links Google Search Console does not surface clearly, and they give you metrics like Domain Rating or Authority Score that help you prioritise. Say you run a 40-person software company with a domain that has been live for eight years. You might find Search Console shows 1,200 referring domains while Ahrefs shows 2,600. That gap is normal, it just means the two tools crawl differently.

Step 2: filter by spam signals, not by how the domain looks

This is where most audits waste time. People see a.info domain with a name like "besttoolsreview2019" and assume it is spam. Sometimes it is. Sometimes it is a small legitimate blog with an ugly template. Looks are not evidence.

Instead, filter for these specific signals:

• Domain has zero organic traffic according to Ahrefs or Semrush's traffic estimate, combined with dozens of outbound links on the page it links from. A real blog post links to 3 to 8 sources. A link farm page links to 50 to 200.
• The anchor text is an exact-match commercial keyword, not your brand name. "Best accounting software UK" repeated across 30 different low-authority domains pointing at the same page is a classic paid link pattern.
• The linking domain has a Domain Rating under 10 and was registered within the last 18 months, which is common with private blog networks.
• The page linking to you has nothing to do with your industry, for example a site about car insurance linking to your marketing agency with the anchor text "digital marketing services."

Sort your spreadsheet by these columns and you will usually find that out of 1,200 referring domains, maybe 20 to 40 tick two or more of these boxes. That is your actual watchlist, not the 1,200.

Step 3: check manual actions first

Before you touch the disavow file, go into Search Console and check Security & Manual Actions. If there is a manual action for unnatural links, that changes everything, because now you are not doing a precautionary clean-up, you are doing a required one and you will need to submit a reconsideration request afterwards explaining what you removed and why.

If there is no manual action, you are almost certainly fine to be more conservative. Google's systems like Penguin (folded into the core algorithm since 2016) already devalue obvious spam links in real time without you lifting a finger.

Step 4: try to get bad links removed before you disavow

Disavowing is the last step, not the first. For any link that worries you, try contacting the site owner directly and asking for removal. Most won't reply. Some will, especially smaller sites run by individuals rather than agencies. Keep a record of the outreach attempt for your own file, since Google has previously said it likes to see removal attempts alongside a disavow submission, even though it is not strictly required.

Say your watchlist has 30 suspicious domains. Realistically you might get 4 or 5 removed through outreach. The remaining 25 go into your disavow file.

Step 5: build the disavow file correctly

The disavow tool wants a plain text file, one domain or URL per line. Use the domain-level entry (domain:example.com) rather than individual URLs when the whole site looks compromised, since spammy sites often add new junk pages constantly and a URL-level disavow will miss those. Upload it through Search Console under the disavow links tool, which sits slightly buried under the Links report settings.

One uncomfortable truth here that most guides skip over: disavowing does not undo damage instantly, and in a lot of cases it does very little measurable difference at all unless you were hit with a manual action or a serious negative SEO attack. I have watched people disavow aggressively expecting a ranking bump within weeks and get nothing, because the links they removed were already being ignored by the algorithm. The disavow tool is damage limitation for real spam, not a ranking lever you pull to get a quick win.

Step 6: audit on a schedule, not in a panic

Do the full process once a year for most sites. If you are in a competitive niche where negative SEO attacks are more common (gambling-adjacent industries, finance, anything with aggressive competitors), check quarterly. Set a calendar reminder rather than waiting until rankings drop and you are auditing out of fear, because fear-driven audits are when people disavow good links by mistake.

A worked example: say you run an online course business and your organic traffic drops 15% in a month. Before you touch your backlink profile, check Search Console for manual actions, check Google Analytics for which pages or segments dropped, and check whether a core algorithm update rolled out that month (Google announces most of these publicly). Only if none of that explains the drop should backlinks become a suspect, and even then, a sudden spike of 200+ new low-quality links appearing in a single month is the signal to look for, not a slow audit of your entire historical link profile.

What to keep instead of just what to cut

An audit should also flag which links are working well, so you protect them. Look for referring domains with high relevance to your industry and genuine traffic, even if their Domain Rating looks modest. A link from a 50,000-monthly-visitor niche blog in your exact sector is worth more than a link from a 2-million-visitor generic news site that buries you in a long list. If one of your best relationships is a guest post relationship, keep writing for that site rather than chasing new ones every month.

If your backlink profile is thin rather than spammy, which is far more common for small businesses than an actual spam problem, the fix is not an audit at all. It is building more good links through digital PR, guest contributions, and useful content that other sites want to cite. If you want help working out whether your backlink profile needs cleaning up or simply needs building, that is exactly the kind of diagnostic work an AI consultant for small business can walk through with you in a single session rather than you guessing from a spreadsheet.

Frequently asked questions

How often should I audit my backlinks?

Once a year is enough for most small business sites. Do it quarterly if you are in a competitive or high-risk niche where negative SEO attacks are more common, or immediately after a sudden unexplained traffic drop.

Will disavowing bad backlinks improve my rankings?

Usually not noticeably, unless you have a manual action or a genuine negative SEO attack. Google's algorithms already ignore most spam links automatically, so disavowing is damage limitation rather than a ranking boost.

What tools do I need to audit backlinks for spam?

Google Search Console for the links Google counts, plus a crawler like Ahrefs or Semrush for broader coverage and metrics such as Domain Rating, traffic estimates, and anchor text patterns.

Is a low Domain Rating link always spam?

No. A low-authority but relevant and active niche site is often more valuable than it looks. Spam signals are things like dozens of outbound links on one page, exact-match commercial anchor text repeated across unrelated domains, and zero real traffic, not a low score on its own.