Authority
Backlink audit: how to tell if your site's link profile has become a liability
A backlink audit is the process of mapping every link pointing to a domain and classifying each one by source, topical relevance, language, anchor pattern and acquisition pace. The goal is to separate legitimate links from manipulated ones (PBNs, bulk directories, hacked sites), decide what to remove or reject via disavow, and define what to rebuild with press coverage and genuine mentions.
If your site has ever gone through a cheap link package, switched agencies more than once or inherited an old domain, there is a real chance you are ranking on the back of links you cannot trace. And a vendor who refuses to show the full list is, on its own, reason enough to audit.
This guide shows what a serious audit examines, when a disavow makes sense and when it is unnecessary.
What a backlink audit is
A backlink audit is the process of inventorying every domain pointing to a site, classifying each link by quality, topical relevance and source, and deciding what happens to each one: keep, monitor, attempt removal or disavow. The final deliverable is a risk map of the link profile, listing the problematic domains, the reason behind each classification and the order of attack.
It exists for a simple reason. Your link profile accumulates history, including the part you did not create.
Every link building effort leaves a trail, and good trails sit alongside bad ones in the same report. That 500-link package bought by a manager who no longer works at the company is still there. The old domain you inherited in the merger brought its links along. The blog network a vendor used in 2019 may have turned into a casino farm by 2024.
The audit separates three things that are usually treated as one: the good link (keep and protect), the irrelevant link (ignore, since Google already does that on its own in most cases) and the manipulative link (that one does require an active decision).
This distinction matters because the wrong reaction is expensive. Mass-disavowing out of panic destroys legitimate authority. Ignoring a clear manipulation pattern leaves the site exposed to a manual action.
In the next sections, I go through the warning signs and the step-by-step process. First, it helps to understand when a profile truly becomes a risk.
Signs your site's link profile has become a risk
Most sites with a toxic profile have no idea they carry one. The problem shows up disguised as "SEO stopped working," and the team spends months tinkering with content when the cause sits in the links.
These are the symptoms that come up most often in diagnostics:
- A sharp drop after a Google update, with no technical change on the site. If nothing changed on the server or the pages, the algorithm may have reassessed your links.
- A manual action notice in Search Console. The most serious signal. At this point, the audit stops being optional.
- Bulk backlinks from domains you never hired. Leftovers from an old package, domain inheritance or negative SEO from a competitor.
- Exact-match anchors repeated beyond anything natural. A healthy profile mixes brand, URL and generic phrases. Hundreds of links with the same commercial keyword expose manipulation.
- Links from sites in unrelated languages or niches. A casino blog pointing to a Brazilian B2B manufacturer breeds suspicion, never authority.
- Step-shaped growth. Forty new domains in one month, two the next. Natural links grow in a curve; bulk purchases spike.
- A vendor who will not show the source URL of each link. A report without sources is a red flag by definition.
Checked two or more? It is worth running the audit before the next algorithm update, and the next section shows how.
How to run a backlink audit in practice
Extract the complete dataset
No single tool sees everything. Cross-reference the Google Search Console export with Ahrefs, Semrush or Majestic and merge the data into a single spreadsheet, with no duplicates.
Consolidate by domain, not by URL
Five hundred links from the same blog count as one referring domain. The decision is always made at the domain level: topical relevance, language, country and whether that site exists for any purpose beyond selling links.
Classify into four columns
Keep, monitor, remove or disavow. Objective criteria: commercial exact-match anchors out of context, site networks sharing the same template (a PBN pattern), bulk comments and directories, casino pages or hacked sites pointing to you.
An irrelevant but honest link goes into monitoring. Disavow is reserved for what was built to manipulate.
Check what is still live
Tools cache data. Before taking any action, confirm the link actually exists: part of the list has usually dropped off on its own.
Compare against who owns the SERP
Pull the profiles of the three competitors ranking for your main keywords. If they have press coverage and you have directories, cleaning up solves half the problem. The other half is rebuilding, typical work for a link building agency.
Removal, disavow and profile rebuilding
With the risk map in hand, each toxic domain follows one of three paths: removal, disavow or simple monitoring.
When to request removal and when it is not worth the effort
Removal is worth it when there is a real owner on the other side: a hacked site that injected your link, a portal with a contact form, an active blog. Abandoned directories and bulk comments do not answer emails. Log the attempt and move on.
Disavowing without hurting yourself
Google states that it ignores most bad links on its own. The disavow tool is for two scenarios: a manual action reported in Search Console or a clear history of manipulation, such as purchased packages and PBNs. Disavow at the domain level (domain:example.com), never link by link. And be careful: rejecting a good domain takes down positions you earned legitimately.
What real-time Penguin changed
Since 2016, Penguin devalues the bad link instead of penalizing the entire site, and it runs with every crawl. Cleanup takes effect gradually, with no need to wait for an annual update.
Rebuilding with real authority
A clean profile is half the job. The other half is occupying that space with a link building strategy based on press coverage and editorial mentions, the very signals ChatGPT, Gemini and Perplexity use to decide who to cite as a source.
Frequency, monitoring and the cost of not auditing
A full audit is not a one-off event. A stable site with no history of buying links can get by with an annual review. Anyone who has bought a cheap package, inherited an old domain or operates in an aggressive niche (finance, betting, health) needs to review the profile every six months, at minimum.
And always before a migration or a domain purchase. Auditing afterward means inheriting the problem with the deed already signed.
Between audits, the work is surveillance: alerts for every new domain pointing to the site, tracking anchor distribution (a sudden spike in exact-match anchors you did not build deserves immediate investigation) and a monthly Search Console check for manual actions. In the Netlinks App this monitoring runs live, with link building reports and citations across dozens of AI platforms in the same dashboard.
The cost of finding out late does not show up on an invoice, it shows up in the pipeline. Every month with an active toxic profile is a month of positions lost to competitors, of longer recovery afterward and of AI systems learning to cite someone else in your place. Reversing a manual action takes weeks in the best case; winning back the trust that sustained your positions takes far longer.
Before investing in one more link, look at the ones you already have
If you got this far suspicious of that cheap package bought in 2021 or the domain inherited in the merger, the suspicion is well founded. A toxic link profile gives no warning when it arrives, it sends the bill when Google updates.
What all of this boils down to fits into three principles:
- An audit is an inventory with decisions attached. Every referring domain gets an outcome: keep, monitor, remove or disavow. Without an action list, it is just a tool report.
- Disavow is the exception. Google ignores most bad links on its own. Disavow only genuine manipulation, such as PBNs, mass exact-match anchors and hacked sites.
- Cleaning without rebuilding keeps the site weak. A healthy profile is restored with press coverage, legitimate mentions and strategic link building, the same foundation AI systems use to decide who to cite as a source.
Tomorrow's practical step: export the links from Search Console, cross-reference them with a backlink tool and count your unique referring domains. Then filter for commercial keyword exact-match anchors. If they dominate the distribution, you already have your answer.
And if you would rather have someone who has been doing this since 2017 look at your case, Talk to an Expert and get a diagnosis of your link profile, with no obligation, including the risk map and the priorities for the first 90 days.
Whoever does not know where their links come from does not control their authority, they only rent it.
Frequently asked questions
What is a backlink audit?
It is the complete inventory of every domain pointing to your site, with each one classified by quality, topical relevance and source. The result is a risk map: which links to keep, which to monitor, which to try to remove and which to disavow. The goal is to know exactly what supports (or sabotages) your authority on Google and in AI answers.
How do I know if my site has toxic backlinks?
The most common signs: a sharp traffic drop right after a Google update with nothing having changed on the site, a manual action notice in Search Console, artificial link spikes in the history, an excess of commercial exact-match anchors and a link building vendor who never showed where the links come from. Any one of these symptoms already justifies opening an audit.
Can a bad backlink hurt a site's rankings?
It depends on the type. Google states that it ignores most low-quality links on its own, so a random directory pointing to you rarely causes damage. The real risk lies in manipulation patterns: private blog networks, mass exact-match anchors, links from hacked sites or from niches like casinos. That pattern can trigger a manual action or an algorithmic drop.
What is disavow and when should I use it?
Disavow is Google's tool for rejecting links you cannot remove. It tells the search engine: do not consider these domains when evaluating my site. Use it only when there is genuine manipulation in the history (purchased packages, PBNs, a manual action received). Submitting a disavow as a precaution, with no evidence of a problem, can discard links that were helping.
What is the difference between a bad link and an irrelevant link?
A bad link comes from a scheme: a site built solely to sell links, a hacked page, an automated comment. That one goes on the removal or disavow list. An irrelevant link comes from a legitimate site that simply has no connection to your topic, like a recipe blog mentioning a manufacturer. It does not help much, but it does not call for action either. The audit exists to tell the two apart.
How often should I run a backlink audit?
A stable site with no history of buying links can get by with an annual review. Anyone who has bought a cheap package, inherited an old domain or works in a competitive niche (finance, health, betting) should audit every six months. And always before two critical moments: a site migration and a domain purchase, because you inherit the link profile along with the address.
Does a backlink audit influence how AI systems cite my brand?
Yes. ChatGPT, Gemini and Perplexity prioritize sources that search engines already treat as trustworthy, and the link profile is central to that calculation. A site associated with link networks and manipulated anchors loses credibility as a source. Cleaning up the profile and rebuilding with press coverage and legitimate mentions increases the chance of the brand appearing in generated answers.