How Can I Determine Which Backlinks Are Hurting My Site?

The short version: most "toxic backlinks" aren't hurting you, Google mostly ignores spam rather than penalising you for it, so stop panic-disavowing and start checking for actual ranking drops, manual actions, and weird link patterns before you touch anything. If you've had a real traffic cliff, cross-reference your Search Console data against your link profile and look for the handful of links that are doing real damage rather than the thousands that are just noise.

The uncomfortable bit nobody tells you first

Here's what most backlink audit guides won't say upfront: in 2026, the vast majority of spammy links pointing at your site are doing precisely nothing. Google's algorithms, from Penguin onward, are built to devalue bad links rather than punish you for them. That means the 4,000 Russian casino links some content scraper built against your blog ten years ago are probably just sitting there, worthless but harmless.

I say this because so many business owners come to me convinced their rankings tanked because of "toxic backlinks" when the real cause is a content update, a site migration gone wrong, or a competitor simply outranking them with better pages. Chasing bad links is often a way of avoiding the harder question of whether your content and site structure are any good.

That said, bad links can still hurt you, just less often than people think. There are three real scenarios worth checking for.

When backlinks cause damage

• Manual action for unnatural links. Check Google Search Console under Security & Manual Actions. If there's nothing listed, Google has not penalised you for your link profile. This is the single most important check and it takes thirty seconds.
• Algorithmic devaluation tied to a link scheme you participated in. This usually follows obvious patterns: you bought links, ran a link exchange network, or got a bulk guest post package from a vendor promising "50 high DA backlinks for £99." If you've done any of that, those links are the ones worth examining first, not random spam you never asked for.
• Negative SEO attacks. Rare but real, usually aimed at smaller or newer sites in competitive niches. A sudden spike of thousands of low-quality links appearing in a short window, often from the same few hosting providers or link networks, is the tell.

Step by step: how to check

Here's the process I'd run through if I suspected a real problem, not a phantom one.

1. Check Search Console first. Go to Security & Manual Actions. No manual action means Google hasn't flagged your links specifically. This rules out the scariest scenario immediately.
2. Overlay your traffic graph with your link growth graph. Pull your organic traffic from Search Console or Google Analytics and your backlink acquisition timeline from a tool like Ahrefs or Semrush. If you see a traffic drop that lines up with a spike in low-quality link acquisition, you have a correlation worth investigating. If your traffic dropped and your link profile looks the same as always, the links probably aren't your problem.
3. Export your full backlink list. Use Ahrefs, Semrush, or Google Search Console's own links report (free, and useful, just less detailed on metrics). Get every referring domain, not just the first page.
4. Filter for the real red flags. Look for: domains with zero organic traffic of their own, sites in languages completely unrelated to your niche, anchor text stuffed with unrelated commercial keywords (think "cheap loans" linking into a bakery blog), and domains that host hundreds of outbound links on a single page.
5. Check domain rating trends, not just domain rating itself. A site with DR 40 that's been sliding toward zero traffic for two years is a dying or abandoned domain, often repurposed for spam. A fresh DR 15 blog that's growing steadily is probably fine even though the number looks lower.
6. Spot-check manually. Pick twenty of your most suspicious links and visit the pages. Tools estimate quality; your eyes confirm it. If the page is a wall of auto-generated text with no real audience, that's your answer.

A worked example

Say you run a mid-sized accountancy firm's website and your organic traffic drops 30% over six weeks. Before touching your link profile, you check Search Console: no manual action. You overlay your traffic and link data and notice nothing unusual in your backlinks during that window, but you do notice you published four new blog posts that cannibalised your highest-ranking service page's keywords. That's your actual problem, not links at all.

Now say instead the same firm had hired a cut-price SEO agency eighteen months earlier that built 300 links from Indonesian gambling blogs and Pakistani forum profiles with anchor text like "best accountant london cheap." Traffic has been flat, not dropping, but a new in-house marketer spots this during an audit. In this case, those 300 links are a liability worth cleaning up, specifically because they were built through a scheme, not organically acquired, and the anchor text pattern is the kind Google's spam systems are built to catch eventually even if nothing has happened yet.

The difference between these two scenarios is the whole point: one is link paranoia distracting from a real content issue, the other is a genuine, identifiable risk created by a specific bad decision.

What counts as "hurting" you

Be precise about what damage looks like, because "hurting" gets used loosely.

• A manual action notice in Search Console is unambiguous damage.
• A sustained ranking drop for the exact pages that received the suspicious links, not your whole site, suggests algorithmic devaluation tied to those links.
• A pile of spammy links sitting there with no traffic impact at all is not currently hurting you, whatever a vendor's toxicity score tool tells you.

Third-party toxicity scores from link checking tools are a useful starting filter, not a verdict. I've seen tools flag legitimate niche forums and small industry blogs as "toxic" purely because their domain rating is low, while missing spammy link farms with inflated metrics. Treat the score as a prompt to investigate, never as the final word.

What to do once you've found genuine problem links

1. Try removal first. Email the site owner and ask them to take the link down. This works more often than people expect, particularly with smaller sites or directories, and it's cleaner than disavowing because the link disappears rather than just being ignored.
2. Keep records. Save screenshots and dates of your removal requests. If you later need to submit a disavow file, Google wants evidence you tried the direct route first.
3. Use the disavow tool as a last resort, not a first step. It's a sledgehammer. Disavowing links that weren't hurting you can occasionally remove positive link equity you didn't realise you had. Only disavow domains you've identified as part of a spam scheme or negative SEO attack, not every link under a DR of 20.
4. Reassess after 60 to 90 days. Algorithmic link devaluations aren't instant. Give it time before deciding your cleanup worked or didn't.

Where this fits into the bigger picture

If you're spending more time auditing backlinks than publishing content or fixing technical issues, you've got your priorities backwards. For most small and mid-sized sites, a link audit is a once- or twice-a-year health check, not a weekly task. If you suspect you've been hit by a negative SEO attack or a messy legacy link building campaign and you're not confident doing the diagnosis yourself, that's a reasonable moment to bring in outside help rather than guessing, and it's one of the more common reasons businesses end up working with an AI consultant who can also read the data rather than just running a scan and handing you a scary-looking PDF.

The businesses that get this wrong usually fall into one of two camps: the ones who never check at all and let an actual manual action sit unresolved for months, and the ones who disavow obsessively every quarter and waste hours chasing links that were never doing anything. Neither is a strategy. Check Search Console, look for correlation between traffic and link spikes, verify manually, and only act on what you can prove is connected to a drop.

Frequently asked questions

How do I know if a specific backlink is hurting my rankings?

Check whether the page that received the link has dropped in rankings at the same time the link appeared, and confirm there's no manual action in Search Console. A single link rarely causes damage on its own unless it's part of a wider pattern of spammy, manipulative link building.

Should I disavow every low-quality backlink I find?

No. Disavowing is for links tied to manipulative schemes or negative SEO attacks, not for every low domain rating site in your profile. Most low-quality links are simply ignored by Google and disavowing them unnecessarily can occasionally remove link equity you didn't know you had.

Can a competitor hurt my site by building spammy links to it?

It's possible through negative SEO, but it's rarer than most site owners assume. Google is generally good at recognising that a site didn't build the spammy links pointing at it itself, so a sudden spike alone usually isn't enough to cause harm without other red flags.

What's the fastest way to check if backlinks are the real problem?

Go to Google Search Console's manual actions report first, it takes seconds and rules out the most serious scenario immediately. Then overlay your traffic timeline with your backlink acquisition timeline to see if a real correlation exists before you spend hours auditing links that were never the issue.