Backlink Audit: How to Check Who Links to You, Step by Step, and Why You Probably Will Not Need to Disavow

Good reasons to audit your links, and one that is not

Most businesses never need a formal backlink audit. Junk links arrive on their own: scraper sites copy pages, auto-generated directories list everyone, and spam tools link to anything with a domain. Google's disavow help page says that in most cases Google can assess which links to trust without additional guidance. An audit earns its afternoon when one of these is true:

Set up before you pull a single link

Fifteen minutes of setup prevents a wrong conclusion later. The detail that trips people is the property type. A Search Console Domain property aggregates data for every subdomain and protocol, which makes it the right place to read links. But Google's disavow tool does not support Domain properties: only an owner of a URL-prefix property can upload a list, and each property gets one list. If there is any chance you will need to disavow, verify the URL-prefix version of the site now.

• Verify both property types in Google Search Console: the Domain property through a DNS record, and a URL-prefix property for the version of the site you actually serve, such as the https and www address.
• Look for an existing disavow list. Open the disavow tool for each URL-prefix property. A former agency may have uploaded one, and a new upload replaces the old list entirely, so read it before you overwrite it.
• Open the Manual actions report. It shows a count at the top. Zero means you are auditing for hygiene, not under orders.
• Gather the history: invoices or reports from past link building, the dates of redesigns and migrations, and the dates of any traffic drops.
• Start a spreadsheet with columns for linking domain, example linking URL, your target page, anchor text, data source, pile and action taken.

Working through Search Console's Links report

The Links report is free and drawn from Google's own data, so it is the one source nobody can accuse of guessing at what Google sees. It is also partial on purpose. Google describes it as a sample of internal and external links, caps its on-screen tables at 1,000 rows, and does not say whether a link carries nofollow. Read it with those limits in mind, in this order.

1. 1

   Open External links, then Top linking sites

   This ranks root domains by how many links they send. Protocols, subdomains and subfolders fold into one row per root domain. Scan for domains you do not recognize and topics that have nothing to do with you.

2. 2

   Open Top linked pages

   These are the pages attracting the most links. Look for addresses that no longer exist on the site, and watch the Target URL column, which appears when a link reaches a page through a redirect or a different canonical.

3. 3

   Open Top linking text

   Anchor text shows how links were made. Your business name and plain phrases are normal. A cluster of exact service-and-city phrases that nobody would write naturally is the fingerprint of placed links.

4. 4

   Export the two larger samples

   The export menu offers Latest links, up to 100,000 recently discovered links sorted by date, and More sample links, up to 100,000 from a broader sample. Pull both into the spreadsheet.

5. 5

   Open anything odd before judging it

   Click a linking site to see which of its pages link to which of yours. Google notes some links may have been removed or the page may be gone, so check the live page first.

The same report has an Internal links section. It is not part of a backlink audit, but an important page with almost no internal links pointing at it deserves a note for the internal linking list while you are there.

A second opinion from a crawler that is not Google's

Third-party tools run their own crawlers, so they find links Google's sample leaves out and miss some it includes. Use one to fill gaps, never to overrule Search Console. A small site does not need a subscription for this: two of the options below cost nothing. Prices and limits are as of October 2026, and our link building tools roundup compares more.

Merge the exports by linking domain and delete duplicates. For most small businesses the merged list is short enough to read in an afternoon. If it runs to tens of thousands of rows, sort by domain and work the patterns rather than every line.

Four piles: keep, reclaim, ignore, act

Every linking domain goes into one pile, and the deciding question is how the link came to exist, not what a tool scored it. Google's spam policies define link spam by purpose: links created primarily to manipulate rankings. A junk site that linked to you unprompted is noise. A respectable-looking blog where somebody paid for a followed link is the problem.

The act pile is usually the shortest and the most awkward, because filling it means admitting what an earlier agency did. Google's examples are specific: exchanging money, goods or services for links, excessive link exchanges, automated link building, advertorials whose links pass ranking credit, and optimized anchors in articles and press releases. If your pile matches that list, the guides to buying backlinks and white hat SEO explain the stakes. If the reclaim pile is long after a migration, our team fixes 404 errors and broken links.

A junk link that found you on its own is weather. A link somebody paid for in your name is a liability.

When the disavow tool is warranted, and how to write the file

Google sets two conditions, and both have to hold: a considerable number of spammy, artificial or low-quality links point to your site, and those links have caused a manual action or likely will. It calls the tool an advanced feature to use with caution, and warns that it can potentially harm a site's performance in Google Search. A few dozen junk links from sites you never contacted rarely meet either condition. When both do hold, work in this order:

1. 1.Try removal first. Google's instruction is to get links taken down at the source where you can, and disavow only what you cannot remove.
2. 2.Write a plain .txt file encoded in UTF-8 or 7-bit ASCII, with one URL or domain per line.
3. 3.Disavow whole domains with a domain: prefix. You cannot disavow a subpath; an entry is either a single URL or the entire domain.
4. 4.Record your reasoning on lines that start with #, so whoever opens the file next knows why each entry is there.
5. 5.Stay inside the limits: 100,000 lines counting blanks and comments, 2MB, and no URL longer than 2,048 characters.
6. 6.Upload the complete list every time. A new file replaces the previous one, so merge any entries you mean to keep.
7. 7.Give it weeks. Google says incorporating a list can take a few weeks, and disavowed links keep appearing in the Links report, so seeing them there does not mean the upload failed.

Changed your mind? The tool's Cancel disavowals option removes the list for that property, and that also takes a few weeks to register. Bing retired its own disavow feature in October 2023, so there is nothing to upload there.

If the Manual actions report says "Unnatural links to your site"

This notice means Google detected a pattern of unnatural, artificial, deceptive or manipulative links pointing to the site. The action can cover part of the site or all of it, and Google says fixing only some pages will not earn a partial return. The Manual actions help page sets out the repair, and it is more work than uploading a file.

1. 1

   Read the policy, then export

   Review Google's link spam policy, then export links from Search Console by top linking sites or by latest links. Start with the domains that link most often and the most recent links.

2. 2

   Write to the site owners

   Ask each one to remove the link or change it so it no longer passes PageRank. Keep every email and reply; they are your evidence.

3. 3

   Disavow what is left

   Only links you could not get removed. Google says blindly adding all backlinks to the disavow file is not considered a good-faith effort.

4. 4

   Request review

   Choose Request Review in the Manual actions report. Explain the exact issue, describe the steps you took, and document the outcome of those efforts.

5. 5

   Wait, and do not resubmit

   Google says most reconsideration reviews take several days or weeks and link cases can take longer. Results arrive in Search Console and by email.

Lifting the action does not restore whatever the bought links were doing. Google's spam updates documentation says that once its systems discount spammy links, any ranking benefit they produced is lost, and that improvement can take months while its systems learn the site complies. Those rankings have to be earned again, which is where how to get backlinks begins. A separate action, "Unnatural links from your site," targets sites that sold links; the fix there is removing them or making them stop passing PageRank. When a penalty or a drop is beyond what an owner can untangle, our SEO visibility recovery work takes it on.

Twenty minutes a quarter after the first audit

Once the audit is done, keeping it done is small work. Each quarter, export Latest links, scan the new domains, redirect any fresh links to dead pages, and add real new links to the keep pile with a note on how each was earned. That last column quietly becomes a link building strategy: the pattern of who links to you already is the best map of who else might.

Hand it off when there is a manual action, when the act pile is long and the owners will not reply, or when the audit uncovers a migration's worth of broken links. Cleanup and link earning are part of DataCram's monthly SEO programs, with a defined scope and no long contract, from $625 a month; most local businesses fall between $625 and $2,250, per our SEO pricing page. The link building hub covers the earning side, high quality backlinks shows what a healthy keep pile looks like, and the free website audit checks whether the pages those links reach are ready for visitors.