How to run a backlink audit

Four triggers justify a full backlink audit. A manual action for unnatural links makes it mandatory. Buying a domain or site makes it due diligence: you are acquiring the link profile, including whatever a previous owner bought. Taking over from a vendor whose methods you cannot verify is the third, especially if their reporting never let you check individual links. The fourth is a traffic decline that coincides with a confirmed link spam update.

What does not justify one: routine anxiety about "toxic links." Toxicity scores are tool inventions, and Google's systems already ignore most spam pointed at most sites.

No single index sees everything. Start with Search Console's Links report and its exports, because they reflect what Google itself has crawled. Add a commercial crawl: Ahrefs Site Explorer's backlinks export is the most complete single source, with Semrush and Moz Link Explorer as alternatives. Export both, then deduplicate by referring domain rather than by individual URL.

Working at the domain level keeps the job tractable. A profile with 40,000 backlinks might resolve to 900 referring domains, and 900 rows is an afternoon's classification work.

Five buckets cover nearly everything: earned editorial (news, blogs, and resource pages that chose to link), directories and profiles (fine in moderation, ignorable), syndication and scrapers (copies of your coverage, mostly harmless noise), paid or sponsored placements (which should carry rel="sponsored", and are a risk when they do not), and manipulative patterns such as PBNs, link farms, and hacked-site injections.

Speed matters more than perfection. Sort by domain rating or traffic, eyeball each domain for a few seconds, and flag only genuine concerns. The quality checklist covers the per-link checks, and the footprints described in PBN detection identify the manipulative bucket: repeated templates, no organic traffic, outbound links to unrelated commercial sites.

Since the December 2022 link spam update, Google's stated approach is to neutralize spam links algorithmically rather than penalize sites for them. SpamBrain devalues the link and your site keeps ranking on its merits. The practical consequence: disavow files are for two situations only. First, an active manual action, where a disavow plus a reconsideration request is the recovery path. Second, a documented history of paid links you cannot get removed, where the disavow is insurance.

Everything else is better left alone. Over-disavowing real links causes real harm, tool-generated toxicity lists are unreliable, and Google has said repeatedly that most sites should never touch the tool. If you do file one, use domain: entries, keep a change log, and upload it through Search Console's disavow tool.

The audit's real output is usually not a disavow file. It is a map of where authority is missing: money pages with two referring domains competing against rivals with forty, whole topic clusters with no editorial coverage, anchors skewed brand-only because nothing was ever earned for commercial pages. Run the same exports on two or three competitors and the gaps price themselves.

From there the work shifts from pruning to earning, which is the budget conversation covered in how many backlinks you need.