Pull a domain's live backlink profile, let AI score every link for penalty risk, then export a Google-format disavow file.
Awaiting target domain. Data source: Semrush backlinks index.
Link auditing has a bad reputation because it is usually done backwards: someone exports every referring domain, sorts by a vendor's toxicity metric, and disavows the bottom third. That approach throws away real links and almost never moves rankings. The useful version is narrower — establish whether link-based risk is your actual problem, look for patterns rather than individual bad neighbours, and produce a small, defensible disavow file you can explain line by line. This page walks through that process using the tool above.
Two things are worth stating plainly up front. First, no third party can see Google's internal link evaluations, so every toxicity score — this one included — is an informed estimate built from observable signals. Second, disavowing is a one-way instruction with no undo period short of re-uploading: links you disavow stop counting, including any equity they were legitimately passing. Precision matters more than coverage.
No single one of these condemns a link. Risk comes from stacking: an unrelated foreign site, with an exact-match money anchor, sitewide in the footer, on a domain that shares a template with forty others, all acquired in the same fortnight.
A natural profile is dominated by brand, bare-URL, and generic anchors. When exact-match commercial phrases — 'cheap car insurance quotes', 'buy backlinks online' — make up a large share of your anchors, that skew is the single strongest statistical fingerprint of link buying.
Links from sites in an unrelated industry, or in a language your business does not operate in, carry almost no editorial meaning. A cluster of them appearing in the same month usually indicates a network rather than genuine coverage.
Pages that link out to hundreds of unrelated destinations — footer blogrolls, 'sponsored resources' walls, scraped aggregator pages — pass no meaningful endorsement and are a common link-farm signature.
One editorial mention in an article is normal. The same link repeated in the header, sidebar, or footer of every page on a domain is a template placement, which is what paid and reciprocal deals look like at scale.
Dozens of referring domains sharing an IP range, a template, a WHOIS pattern, or an identical CMS theme is the classic private blog network shape, even when each individual site looks passable.
A profile that gained a handful of links a month and suddenly gains four hundred deserves scrutiny. Spikes tied to a campaign are fine; spikes with no matching PR, product launch, or content event are not.
Open Search Console and check Security & Manual Actions. A manual action for unnatural links changes everything: you need removals, a disavow file, and a reconsideration request. Without one, treat this as a hygiene review and look for a ranking drop that lines up in time with a link spike.
Enter your root domain and run the audit. The tool normalises every referring page, source domain, anchor, follow status, first-seen date, and authority score into one table so you are comparing like with like.
Sort by risk and work top-down. The score is a triage tool — you are the one who knows that a low-authority industry newsletter is a real link and a high-authority scraper is not. Uncheck anything you recognise as legitimate.
For paid or negotiated links, ask the site owner to remove them and keep a record of the emails. Google expects evidence of genuine effort when you are appealing a manual action. Skip this step for obvious spam networks — nobody is answering.
Toggle each selected row between domain-level and URL-level disavow. Whole spam properties go domain-level; one bad page on a good site goes URL-level.
Export disavow.txt, review it in a text editor, and upload it to Google's disavow tool for the correct property. Uploading replaces the previous file, so always upload the complete list rather than only new additions.
Google's format is deliberately minimal: one directive per line, UTF-8 or 7-bit ASCII, lines beginning with # treated as comments. A domain-level entry is written domain:spam-example.com and covers every URL on that host and its subdomains. A URL-level entry is the full referring URL on its own line. The export from this tool adds a comment header with the audited domain and the audit date so future-you knows where the file came from.
# Disavow file for example.com # Generated 2026-08-17 by Toxic Backlink Auditor domain:link-farm-example.net domain:pbn-cluster-example.org https://legit-publisher.com/user/spam-profile-1234
Upload it at Google's disavow links tool, selecting the exact property that matches the audited domain. The uploaded file is cumulative state, not a diff — each upload replaces the last one entirely, so keep the exported file and re-export the full list whenever you add entries.
A toxic backlink is an inbound link that a search engine is likely to treat as an attempt to manipulate rankings rather than a genuine editorial citation. In practice that means links from private blog networks, hacked pages, expired-domain link farms, scraped directories, comment and forum spam, paid link marketplaces, and sites whose topic has no plausible relationship to yours. A single low-quality link is rarely a problem. Patterns are: hundreds of exact-match commercial anchors, sitewide footer links across unrelated domains, or a sudden spike of links from one hosting neighborhood.
Most sites do not. Google states that its systems ignore the overwhelming majority of low-quality links automatically, and the disavow tool exists mainly for two situations: you have a manual action for unnatural links in Search Console, or you know links were built manipulatively (by you, a past agency, or a negative-SEO campaign) and you cannot get them removed. If neither applies, an audit is still useful as a diagnostic — but the correct output is usually 'no action', not a large disavow file.
Every link is sent to the model with its source domain, referring page, anchor text, follow status, sitewide flag, first-seen date, source authority score, and the number of outbound links on the page. The model returns a 0–100 toxicity score, a risk level, and a one-line reason. Scores of 70+ are high risk, 40–69 medium, below 40 low. The score is a prioritisation signal for human review, not a verdict from Google.
Domain level (domain:example.com) is right when the whole site is the problem — a link farm, a spam directory, an entire PBN property. URL level is right when a legitimate site happens to host one bad page, such as a user-generated profile or a hacked post on an otherwise reputable publisher. When in doubt on a spammy source, go domain level; partial disavows of link farms rarely help.
Disavowed links are honoured as Google recrawls each referring URL, so the file takes effect gradually — typically weeks, sometimes months for rarely-crawled spam pages. If you are clearing a manual action, submit the reconsideration request after the file is uploaded and after you have documented genuine removal attempts.
Backlinks are pulled live from the Semrush backlinks index using the Semrush account connected to this project. The number of rows returned per audit depends on your Semrush subscription tier and remaining API units, so a higher-tier plan produces deeper audits.