Toxic Backlinks & Google's Disavow Tool 2026
Learn when Google's disavow tool still matters in 2026, how SpamBrain neutralizes spam links, and when over-disavowing hurts more than helps.
Google processed over 6 times more spam in the year after SpamBrain launched than in all previous years combined — and detection accuracy improved by 500% (LinkedIn / Wildnet Technologies). Yet in the same period, a case study documented a site recovering from a manual penalty in just 32 days by using the disavow tool correctly (Evoluted). Both facts are true. The question in 2026 is not whether the disavow tool exists — it is when it actually matters.
Quick answer
Most sites never need to touch the disavow tool. Google's SpamBrain AI neutralizes the vast majority of spammy links automatically. The disavow tool is reserved for three specific situations: a confirmed manual action in Google Search Console, an overwhelming and provable negative SEO attack, or a legacy of links you built yourself that clearly violate Google's spam policies. Using it outside those situations — especially as routine "spring cleaning" — is more likely to damage your rankings than improve them.
What makes a backlink "toxic" in 2026
The term "toxic backlink" is used loosely in SEO tools and blog posts. The real definition in 2026 is narrower than most people assume.
A backlink is genuinely problematic only when it forms part of a detectable manipulation pattern — not because a third-party tool assigns it a high "toxicity score." Google's algorithms evaluate links as a group, not in isolation (Arctic Leaf).
Red flags that signal a real pattern problem
- Links from known Private Blog Networks (PBNs), link farms, or paid link sellers (Arctic Leaf; Getlinko)
- Links from hacked sites with irrelevant or foreign-language anchor text
- Spam-score above 60% in Ahrefs or SEMrush combined with zero referral traffic and exact-match keyword anchors
- A sudden, unnatural spike in linking domains — e.g., from 700 to 4,000 in a single week (Darkstar Media)
- Links from adult, gambling, or pharma sites with no relevance to your niche
Links that look suspicious but usually are not
- Nofollow, sponsored (rel="sponsored"), UGC links — treated as hints, not directives. Almost never worth disavowing (Getlinko; Stiv.media)
- Comment or forum spam — automatically discounted; not worth action (Arctic Leaf)
- Broken links pointing to 404 pages — deflate naturally as Google recrawls; ignore them (Getlinko)
- Press release links or low-traffic directories — gray area; evaluate for patterns before acting
The critical mental shift: a single bad link from an obscure forum is noise. Fifty links from irrelevant sites all using the same exact-match anchor text is a signal (Arctic Leaf).
How Google actually handles spam links: SpamBrain explained
SpamBrain is Google's AI-based spam detection system, integrated directly into the core ranking pipeline. It evaluates backlinks continuously — not in periodic sweeps like the old Penguin algorithm.
What SpamBrain does
- Identifies both sides of a transaction — it flags sites buying links and sites selling them (pbn.ltd; Marie Haynes)
- Evaluates patterns over time — link velocity, coordination across domains, contextual irrelevance (T-Ranks)
- Neutralizes, not penalizes — for most sites, SpamBrain simply removes the ranking credit from unnatural links without applying a site-wide penalty (Marie Haynes; G-Squared Interactive)
- In 2021, SpamBrain identified 200 times more spam sites than previous systems (SearchXPro)
Penguin is now part of core
Since September 2016, Penguin has been embedded in Google's core algorithm — it runs continuously, not as an occasional update. A pattern of clearly manipulative links can trigger it to discount all of a site's links, not just the bad ones (Marie Haynes).
Recent spam algorithm updates (2025–2026)
| Update | Date | Key Targets |
|---|---|---|
| March 2025 Core | Mar 13–27, 2025 | Thin content, zombie posts, purchased links; Google aimed to cut low-quality results by 40–45% |
| June 2025 Spam | June 2025 | Hidden redirects, cloaking, link schemes |
| August 2025 Spam | Aug 26–Sep 22, 2025 | Scaled content abuse, expired domain abuse, parasite SEO |
| March 2026 Spam | Mar 24, 2026 | Cloaking, link spam, scraped content; completed in under 24 hours |
Sources: Sterling Sky; Ignite Digital; Digital Applied; Google Spam Updates reference
Negative SEO: is it a real threat?
The short answer is: usually not, but under the right (wrong) conditions, yes.
61% of websites have experienced some form of negative SEO attack (Oncrawl). Over 15,000 gigs offering negative SEO services appeared on Fiverr at prices as low as $5 (Uberall).
Google's official line is that its systems prevent competitors from harming your rankings (Google Search Central, October 2012). Marie Haynes echoes this: "If you built a bunch of unnatural links pointing at your competitor... Google would recognize the pattern and neutralize them" (mariehaynes.com).
When negative SEO can still hurt
The risk increases when:
- The attack is sophisticated — mimicking natural patterns (varied anchor text, mix of CMS, hacked legitimate sites) rather than obvious bulk spam
- The target domain is relatively new or has a thin link profile — making pattern detection harder
- Scale is extreme — a jewelry site documented in a well-known case study was hit with approximately 600,000 spam backlinks and required three reconsideration requests over several months to recover (Eliav Lankri, Medium)
Michael Cottam's controlled experiment provides the clearest modern evidence that bad links can matter. Removing his disavow file caused a ranking drop from position 23 to approximately position 80. Restoring it brought him back to position 19. He repeated the test twice with the same result (Michael Cottam).
The takeaway: for most sites experiencing a few hundred spammy links, SpamBrain handles it. For sites under sustained, sophisticated attack, monitoring and selective disavowal remain valid tools.
When the disavow tool actually helps
Google's own guidance, reinforced by Gary Illyes at Pubcon, is direct: "If you do not have a manual action then you do not need to submit a disavow" (G-Squared Interactive; Search Engine Roundtable).
There are three situations where disavowing is the right call.
1. Confirmed manual action in Google Search Console
You have a "Manual Action" notification for "Unnatural inbound links." This is the only officially supported reason to use the disavow tool. You must:
- Attempt to remove links manually (contact webmasters, document all outreach)
- Disavow what you cannot remove
- Submit a reconsideration request with evidence of your cleanup effort
The Google Search Console Help and Google's spam policies explain the full process.
Recovery example: An Evoluted client in health/fitness with a manual action analyzed 1,014 referring domains and 7,585 backlinks from UK-based link sellers. Recovery took 32 days from the initial notification to manual action revocation (Evoluted).
2. Overwhelming, verifiable negative SEO attack
The threshold is a sudden, dramatic, documented spike in low-quality links — not just a high toxicity score in a tool. Examples: links jumping from 700 to 4,000 overnight, or bulk anchor-text spam appearing from hundreds of identical domains in days. Set up automated alerts in Ahrefs or SEMrush to catch these fast (Darkstar Media).
Recovery example: A local pool cleaning business had a 404 page accumulating toxic links. After disavowing just over 200 domains, impressions jumped 4x within 24 hours. Following a domain migration, total impressions increased 16x (SEO Gets).
3. Your own legacy of link-building violations
If a previous SEO — or you — built links through PBNs, paid link schemes, or other tactics that clearly violate Google's spam policies, the disavow tool is the safest way to cut the association. Manual removal attempts should come first; disavowal covers what you cannot get taken down.
When the disavow tool hurts: the over-disavowing problem
This is the most underreported risk in SEO. Over-disavowing is at least as common as under-disavowing — and the damage is harder to reverse.
The G-Squared Interactive case study is the clearest cautionary example on record:
- A site had accumulated over 15,000+ domains in its disavow file, added over time out of fear of junk links
- The site's rankings had dropped 70–80%
- After removing the disavow file entirely in March 2023, the site surged 140% following the April 2023 reviews update, with 31,000+ keywords improving in position
- Conclusion: the disavow file had been stripping link equity from legitimate sources for years
Gary Illyes put it plainly: "The number of sites who shot themselves in the foot with [the disavow tool] is higher than the number of sites he thought would have benefited from a disavow file" (G-Squared Interactive).
What to never disavow
- Links you didn't build and don't have a manual action over
- Links flagged only by a third-party tool's "toxicity score" — Semrush and Moz flag plenty of harmless links (Reddit/SEMrush)
- Nofollow, sponsored, or UGC links
- Links from low-authority sites where there is no clear pattern of manipulation
- Every link that arrived after a core algorithm update that hurt your rankings — core update drops are almost always about content quality, not links (Reddit/SEO)
How to audit a backlink profile in 2026
A modern audit looks for patterns, not individual bad links. Here is the framework.
Tools
- Ahrefs Site Explorer — industry-standard link discovery; 35 trillion-link database (StyleFactoryProductions)
- SEMrush Backlink Analytics — 43 trillion links; factors organic traffic into Authority Score
- Moz Link Explorer — good for Domain Authority benchmarking; 44.8 trillion-link database
- LinkResearchTools (LRT) Link Detox — specialized disavow file creation with algorithmic scoring (iMarket Solutions)
Key metrics to evaluate
| Metric | What to look for |
|---|---|
| Referring domains | Total unique linking domains — more important than raw link count |
| Anchor text distribution | Branded + naked URL + generic should dominate; keyword-rich anchors ideally under 10–15% of profile |
| Link velocity | Sudden spikes are suspicious; healthy sites gain links from new domains at 5–14.5% per month (Ahrefs, via Colabdxb) |
| Topical relevance | Are linking domains in your niche or a related one? |
| Spam score + DR | Links from domains under DR 30 with high spam scores showed zero correlation with ranking improvements in 2025 updates (SEMrush 2025, via Nuxt SEO) |
Audit cadence
- Quarterly minimum for most sites
- Monthly for sites actively building links or in competitive niches
- Set up automated new-link alerts in Ahrefs or SEMrush — catching a negative SEO attack within days is far easier than cleaning up months later (Outreach Monks)
How to create and submit a disavow file
If you have verified that disavowing is the right call, here is exactly how to do it.
File format requirements (Google Search Console Help)
- Plain text (.txt), UTF-8 or 7-bit ASCII encoding
- Maximum 2 MB file size
- Maximum 100,000 rows
- Maximum URL length: 2,048 characters
- One URL or domain per line
- Use
domain:example.comto disavow an entire domain - Lines starting with
#are comments
Example:
# Disavow file - mysite.com - June 2026
# Manual action recovery - unnatural inbound links
domain:spammy-link-network.com
domain:pbn-seller-site.net
https://irrelevant-foreign-site.ru/guest-post-for-hire.html
Submission steps
- Navigate to search.google.com/search-console/disavow-links
- Select your Search Console property
- Upload the
.txtfile - Monitor your backlink profile monthly — new spam may appear after submission
- To add entries later, download the current file, append new domains, and re-upload (the new file replaces the old one entirely)
- To remove all disavowals: go to the Disavow Tool, select your property, and click Cancel Disavowals
Processing typically takes several weeks to months — there is no official guarantee of timeline.
Google's official stance vs. practitioner consensus
| Source | Position |
|---|---|
| Gary Illyes (Google) | "If you do not have a manual action then you do not need to submit a disavow" (Search Engine Roundtable) |
| John Mueller (Google) | "Most websites do not need to worry about toxic links. Our systems will primarily ignore them" (Zaid SEO) |
| Marie Haynes | "SpamBrain neutralizes unnatural links rather than penalizing sites. Algorithmic suppression from link building is not common." (mariehaynes.com) |
| Glenn Gabe (G-Squared) | "Unless you actively set up unnatural links to try and game Google's algorithms, you should never have to touch the disavow tool." (gsqi.com) |
| Michael Cottam | Controlled experiment shows bad links can suppress rankings; disavow file demonstrably helps in targeted attacks (michaelcottam.com) |
The consensus in 2026: the tool exists, it works for its designed purpose, and its designed purpose is narrow. Treating it as a general-purpose "link cleanup" tool is a mistake Google's own team has warned against repeatedly.
For a broader look at building a link profile that doesn't require constant firefighting, see Link Building & Off-Page SEO.
Frequently asked questions
Does Google still penalize sites for bad backlinks in 2026?
Rarely, and almost never algorithmically. SpamBrain's primary mechanism is neutralization — it removes ranking credit from unnatural links without penalizing the site. Manual penalties for "unnatural inbound links" still exist and appear in Google Search Console, but they require a pattern serious enough that a human reviewer flags it. For the overwhelming majority of sites, bad links are simply ignored rather than penalized (Marie Haynes; Google Spam Policies).
Should I disavow links if my rankings dropped after a core update?
No. Core update ranking changes are driven by content quality and E-E-A-T signals, not backlink profiles. Disavowing links after a core update is one of the most common and damaging mistakes SEOs make — it removes link equity without addressing the actual cause of the drop (Reddit/SEO; Arctic Leaf).
How long does the disavow tool take to work?
Google does not publish an official timeline. In practice, practitioners report anywhere from a few weeks to several months depending on how frequently Google crawls the linking domains. The 32-day recovery in the Evoluted case study (Evoluted) is on the faster end; complex manual action cases can take longer.
Can I delete my disavow file to recover lost rankings?
Yes — if you suspect over-disavowing, you can cancel the file entirely via Google Search Console. The G-Squared Interactive case study documented a 140% rankings surge after removing a bloated disavow file (gsqi.com). The effect is not immediate; Google needs to recrawl and re-evaluate the previously disavowed links.
Do third-party "toxic link" scores from Ahrefs or SEMrush require action?
Not on their own. These scores are useful for flagging links worth investigating, but they are not Google's assessment — they are the tool's proprietary model. A high toxicity score with no manual action in Google Search Console is not a reason to disavow. Acting on tool scores alone is one of the most common causes of over-disavowing (Reddit/SEMrush; Semrush guide).
Originally published in the EcomExperts SEO library.