Most spam backlinks do nothing to your rankings and need no action, because Google's spam systems ignore links they recognize as manipulative rather than counting them against you. The disavow tool exists for two situations: a manual action for unnatural links reported in Search Console, or a known history of paid or manipulative link building that you want to cut off before it is found. This guide covers how to tell which situation you are in, how to audit your backlinks from Search Console and a backlink tool, what to do with each kind of link, and the exact format of a disavow file if you decide you need one.
Definition: a spam backlink is a link to your site from a page that exists to manipulate rankings, host hacked content, or scrape and republish, rather than to send a reader to you. Toxic is a score some tools assign; it is not a Google label and Google never sees it.
Do spam backlinks hurt your rankings?.
Every site that has been online for a few years collects them: links from scraper sites that copy your content, from foreign-language blogs stuffed with outbound links, from hacked pages, from directories nobody has visited since they were built. When owners see these in a backlink tool, often flagged in red with a toxicity score, the instinct is to disavow everything and feel safer.
Google's stated position, repeated for years, is that its systems are good at ignoring links like these and that most sites never need the disavow tool at all. Our experience across a large portfolio of sites matches that. We have watched sites accumulate large numbers of junk referring domains with no movement in rankings, and we have watched sites that disavowed aggressively gain nothing from it. The link graph is noisy for everyone; Google's job is to filter it, and it mostly does.
The exception is links you or a previous agency bought or built, because those are the ones Google's systems are designed to find and act on, and the action can be a manual penalty that removes pages or the whole site from results until it is lifted.
When the disavow tool is the right call.
Two triggers, and only two.
- A manual action. Open Search Console, then Security and Manual Actions, then Manual Actions. If it reports unnatural links to your site, Google has a human reviewer's finding on record, and the path back is cleanup, disavow, and a reconsideration request that explains what you did.
- A known history of paid, exchanged or built links. If a previous agency ran a link-buying program, a private blog network, or a guest post scheme with money changing hands, those links are a liability whether or not a penalty has arrived. Disavowing them in advance is cheaper than a manual action later.
Absent one of those, a large volume of ugly links is not a reason to disavow. A sudden drop in rankings that coincides with an algorithm update is also not a reason on its own; algorithmic link devaluation is invisible and the disavow tool does not undo it. The right response to that drop is to look at the content and the pages that lost, which is where most of the work in our SEO engagements actually happens, not in the backlink profile.
How to audit your backlinks.
Link types and what to do with each.
The categories below cover nearly everything that shows up in a real audit. Two of them, directories and sites you cannot evaluate, are the ones people get wrong most often, and in both cases the wrong move is a disavow. Local citations in particular are part of the local SEO foundation, and cutting them because a tool colored them red does measurable harm to map and local rankings.
| Link type | What it looks like | Action |
|---|---|---|
| Scraper and syndication copies | Your own content republished with the original links intact | Ignore; Google recognizes the original source |
| Foreign-language spam blogs | Unrelated language, dozens of outbound links per post, no readers | Ignore unless they are part of a network you or a vendor built |
| Hacked pages | A legitimate site with an injected page of pharmaceutical or gambling text | Ignore; Google discounts hacked content and the owner will remove it |
| Link farm or private blog network | Bursts of domains with similar templates, exact-match anchors, thin posts | Disavow at the domain level, especially if money changed hands |
| Paid guest posts and sponsored placements | Real sites, articles written to carry a followed commercial link | Request removal or a nofollow first; disavow if the owner refuses and the volume is material |
| Directories and local citations | Business listings with name, address, phone and a link | Keep; they support local search and are not spam |
| Forum profiles and comment spam | Links in signatures or comments, usually automated | Ignore; almost always nofollowed and discounted |
| Sites you cannot evaluate | No obvious pattern, unfamiliar language, unclear purpose | Keep; never disavow what you cannot judge |
How to write and upload a disavow file.
The file is plain text, UTF-8 or 7-bit ASCII, with one entry per line. A line beginning with domain: excludes every link from that domain and all of its subdomains. A line that is a full URL excludes only that page. Lines beginning with # are comments and are ignored, which is where you record why each entry is there and when it was added. The file must be no larger than 2 MB and no longer than 100,000 lines, including blank and comment lines.
Use domain-level lines for networks and farms. URL-level lines are for a single bad page on an otherwise fine site, which is rare. A short file with the right shape looks like this, one line each:
- # Paid placements from a 2024 vendor campaign
- domain:example-network-one.com
- domain:example-network-two.net
- # Single sponsored article, owner declined removal
- https://example-magazine.com/sponsored/best-roofers
Upload it through the disavow links tool at search.google.com/search-console/disavow-links. Choose the property, upload the file, and confirm. One file per property; uploading a new file replaces the previous one entirely, so keep the master file under version control and always upload the complete list, never a diff. A domain property and a URL-prefix property for the same site are separate uploads, and the tool only accepts properties where you are an owner.
Then wait. Google applies the disavow as it recrawls the linking pages, which takes weeks and, for slow-crawled spam pages, can take months. If a manual action was the trigger, submit the reconsideration request only after the file is uploaded and removal requests have been sent, and document both in the request with dates and counts. Reviewers respond to evidence of effort, not to a file alone.
“If you cannot say why a link is manipulative, you have no business telling Google to ignore it.”
Negative SEO: what actually happens.
Negative SEO, in the sense of a competitor pointing a flood of spam links at your site to get it penalized, is a real tactic and a largely ineffective one. Google's systems are built on the assumption that anyone can link to anyone, which means an attacker cannot easily convert that into a penalty against you. We have seen sites take on sudden waves of junk links from abroad with no ranking effect at all. The correct response is to note it, keep the export for the record, and do nothing unless a manual action arrives, which it almost never does.
Where negative tactics do bite is different: scraped copies outranking the original on a weak site, fake reviews on your business profile, and hacked pages on your own domain. Those are content, reputation and security problems. The disavow tool does nothing for any of them, and the review side in particular needs its own response rather than a link audit.
Mistakes that turn a non-problem into a problem.
- Disavowing on the strength of a toxicity score. The score is the tool's opinion; Google never sees it and does not agree with it.
- Disavowing directories, chamber of commerce listings, local citations and industry associations, which support local rankings and are the opposite of spam.
- Uploading a partial file and wiping out the previous list, because each upload replaces the last one completely.
- Using URL lines for whole networks, which leaves every other page on those domains live and counting.
- Filing a reconsideration request before removals and the disavow are done, which burns a review cycle and delays the next one.
- Spending a week on a backlink audit when rankings fell because a competitor wrote a better page.
Do spam backlinks hurt SEO?
Usually not. Google's systems are designed to ignore links they identify as manipulative, and most sites with ugly backlink profiles rank exactly as they would without them. The links that carry risk are the ones you or a previous agency paid for or built in bulk, because those are the pattern Google's reviewers act on with a manual action.
When should I use the Google disavow tool?
In two cases: Search Console shows a manual action for unnatural links to your site, or you know of a history of paid, exchanged or network-built links and want to cut them off before they are found. Outside those cases, Google's own guidance is that the tool is unnecessary, and using it on links you cannot evaluate can remove real signals.
What is the format of a disavow file?
A plain text file, UTF-8 or 7-bit ASCII, one entry per line. Use domain:example.com to disavow every link from a domain and its subdomains, or a full URL to disavow a single page. Lines starting with # are comments. The file is limited to 2 MB and 100,000 lines, is uploaded per Search Console property, and each upload replaces the last.
Can a competitor hurt my rankings with negative SEO backlinks?
Rarely. Google's ranking systems assume anyone can link to anyone, so a wave of junk links pointed at your site is almost always ignored. Keep an export for the record and take no action unless a manual action appears. The negative tactics that do cause harm are scraped copies, fake reviews and hacked pages, and none of those are fixed by a disavow.