Sitewide Footer Links

If you are staring at 40,000 new backlinks right now

Read this paragraph before you do anything else. A backlink tool reporting an overnight jump from a few thousand links to forty thousand is almost always reporting one event, not forty thousand: a single hyperlink placed once, in one site's template, on a site that happens to have forty thousand pages. The tool crawled every page, found the link on every page, and counted it every time. That is what the tool is built to do, and it is not what Google's ranking systems do with the same links.

A sitewide link is a hyperlink placed in a site's template — footer, sidebar, header or navigation — so that it appears automatically on every page that template renders. As a negative SEO vector, the attack is to put a link to a target in the footer of a junk property (an expired-domain network, a scraped-content site, a hacked site, a link farm), usually with commercial or keyword-stuffed anchor text, so that the target appears to have acquired an enormous number of low-quality backlinks in one night.

The signal the attacker is trying to manufacture is volume, plus a distorted anchor-text distribution. The entire premise is that volume is what counts — that forty thousand links is forty thousand times one link. That premise is where the attack falls apart, and the rest of this page is the evidence for saying so.

The urgent instruction, then: do not act on the backlink count. Look at the number underneath it.

Backlinks up, referring domains flat

Every commercial backlink tool reports two different numbers, and the panic comes from reading the wrong one.

• Total backlinks counts every page carrying a link to you. A template link on a large site inflates this without limit and without meaning.
• Referring domains counts the distinct sites linking to you. A sitewide injection from one junk property moves this number by exactly one.

That divergence — backlinks up by tens of thousands, referring domains up by one or two — is the definitive signature of a sitewide link. It is also the reassurance, because referring domains is the number that sits closer to what search engines actually weigh.

Then compare with what Google itself shows you. In Search Console, under Links and Top linking sites, sort by linking pages. You will typically find that Google's own report shows a far smaller figure than the third-party tool did, reported conservatively and with lag. That gap is not Google missing something. It is a description of how little the repetition matters to the party whose opinion decides your rankings.

While you are in that report, open Top linking text. The anchor text is the only part of a sitewide injection genuinely worth investigating, and for a reason that has nothing to do with ranking: it is where a legal claim lives, if one lives anywhere. More on that below.

Matt Cutts, 13 November 2012: counted once

The mechanism that kills the volume premise was described by Matt Cutts, then the head of Google's web spam team, in a Google Webmaster Help video dated 13 November 2012. Asked how Google handles repeated links from a single domain, he said that if Google sees a link from a domain it might count it once, and that if it sees fifty links from that domain it still might choose to count it only once.

Link signals are consolidated at the domain level. A sitewide link from one junk domain is closer to one link than to forty thousand. The theatrics of the attack are entirely in the number in the dashboard, and the number in the dashboard measures something Google does not weigh that way.

Now the honest caveats, because a reference that quotes a favorable line and stops is not a reference. Cutts said "might", twice. It was 2012. Google has never restated it in documentation, and whether the consolidation is strictly one-per-domain or a weighted compression of some kind has never been described. It is the best available source on the mechanism and it is not a specification, so do not repeat it as a rule.

Cutts also gave the counterweight in the same video: on manual review, a sitewide link that looks commercial, off-topic, low-quality or spammy can affect the assessment. Read who that describes. It describes a human reviewer looking at the linking site, and at sites that bought such links. It is the reason the verdict on this page is largely neutralized rather than impossible.

What the policy prohibits, and of whom

Google's spam policies list, verbatim, among prohibited link schemes: "Widely distributed links in the footers or templates of various sites". That sentence is quoted constantly to prove this attack works, and it proves nothing of the kind.

Read what it is. It is a description of a link scheme, addressed to the party building one. Google's spam policies define link spam as the practice of creating links for the purpose of manipulating rankings, and the policies contain no provision under which a site is penalized for links it did not create. There is no such provision to point at. People assume one exists because the sentence describes something that looks bad, and looking bad is not the same as being liable for it.

Google addresses the involuntary case directly in a separate help article, "Competitors and your site's ranking", which states that Google works hard to prevent other site owners from being able to harm your ranking or have your site removed from its index. Note what Google recommends if you are worried about another site linking to you: contact that site's owner. Not disavow. Not file anything. Contact them.

That is a hedge and I will name it as one — works hard to prevent is not cannot — but it is also the closest thing in Google's documentation to a direct answer for the reader of this page, and its recommended action is conspicuously mild.

What changed after 2012, twice

The 2012 material above is directionally right and the mechanism has moved twice since, so quoting Cutts alone would date this page badly.

Penguin 1.0, launched in April 2012, demoted sites on the basis of their inbound link profile. That is the architecture that made sitewide junk links genuinely frightening, and it is the architecture people are still reacting to fourteen years later. It ended with Penguin 4.0. In its September 2016 announcement Google described the change this way: "Penguin is now more granular. Penguin now devalues spam by adjusting ranking based on spam signals, rather than affecting ranking of the whole site."

Devalues rather than demotes. Adjusts on the signal rather than on the site. That single sentence removes the mechanism this attack was designed to exploit.

The second change came with the December 2022 link spam update, which put SpamBrain — Google's machine-learning spam detection system — onto link neutralization, extending it to detect both sites buying links and sites existing to pass outgoing links, with the described effect that spammy links are neutralized and the credit they passed is lost. Identify the spam links, discount them, move on. That has been the stated behavior for a decade and the vocabulary has not wavered.

One more piece of context for anyone being sold a monitoring subscription. John Mueller of Google said on X on 4 May 2024 that Google will remove the disavow tool "at some point" — which is a strange thing to say about an instrument that a whole industry describes as essential protection.

The variant that is a real problem, and it points the other way

There is one case filed under this heading that is genuinely serious, and it is the opposite of the one everyone worries about.

If your own site has been compromised and now carries injected outbound links in its templates, that is a hacked-content problem you own, it is penalizable, and it presents in exactly the same tools as "sitewide links". In my experience it is by far the most common real problem that arrives described as a sitewide link attack.

The distinguishing check takes minutes. Crawl your own templates and read your own outbound links. Ask whether anything is linking out that nobody at the company chose. Then look at whether the links are in the raw HTML or injected by script, and whether they are visible to a browser at all — injected links are often hidden from human visitors and served only in source.

If you find them, this is an intrusion, not an SEO matter: clean the injection, patch the way in, rotate credentials, and then request review of any hacked-content manual action. Do not start with the link profile.

The other narrow conditions where an inbound sitewide link can matter are worth stating precisely, because "largely neutralized" is not "impossible". A brand-new domain with almost no other links faces a proportion problem rather than a volume problem, and proportion is the one thing volume can affect when there is no baseline to dilute it. A site already carrying an unnatural-links manual action has a human reading its profile, and new junk complicates a cleanup narrative even if it did not cause the action. And Bing and other engines set their own tolerances and maintain their own disavow facilities, so nothing filed with Google applies there.

Working through it, in order

1. Check Search Console, Security and Manual actions. In the overwhelming majority of cases there is no manual action, and that is the answer. A manual action is a penalty applied by a human reviewer at Google and shown to you in writing here; if it is not here, it did not happen.
2. Confirm the referring-domain count, not the backlink count. If referring domains barely moved, nothing meaningful happened, whatever the headline number says.
3. Compare organic performance against the date the links appeared, and against the published algorithm update calendar. Establish that something actually changed before treating anything as damage. Very often nothing did.
4. Do nothing. On an established site, with no manual action, this is the correct answer and the one Google's own documentation points toward. Record the finding, keep monitoring, move on.
5. If the anchor text is defamatory or ties the brand to illegal content, treat it as a legal and reputation matter and preserve dated evidence now.
6. Only against an actual unnatural-links manual action does a disavow file enter the picture, and then at domain level, for the specific offending domains only. Google restricts the tool to considerable spammy links that caused or likely will cause a manual action, and warns that used incorrectly it "can potentially harm your site's performance in Google Search results."
7. If the template links are outbound from your own site, go to the intrusion, not to the link profile.

What does not help: emailing the junk site to request removal, which usually goes unanswered and confirms to whoever placed the link that you noticed; disavowing thousands of unrelated domains; rebuilding or migrating the site; or buying link-detox services against a link count.

When the anchor text is the injury

A sitewide junk link with neutral anchor text has neither an SEO problem nor a legal one. Change the anchor text and only the second of those changes.

Where the anchor uses a registered mark in a way likely to confuse, the Lanham Act, 15 U.S.C. section 1125, is the frame: section 1125(a)(1)(A) for false designation of origin and false association, and section 1125(a)(1)(B) for a false or misleading statement of fact about "the nature, characteristics, qualities, or geographic origin" of goods or services in commercial advertising or promotion. Standing comes from Lexmark Int'l, Inc. v. Static Control Components, Inc., 572 U.S. 118 (2014): an injury to a commercial interest in reputation or sales, proximately caused by the deception, with no requirement that the parties be direct competitors. Defamation is the alternative where the anchor or surrounding content asserts a false fact about the business.

Notice what every element of that turns on. A false or confusing statement. The actionable harm is in the words, not in the count — which is the same conclusion the search analysis reaches by a completely different route, and I find that convergence persuasive. No decided case applying either branch to sitewide footer links is cited here, and none was located; these are the statutory elements and the standing test, not precedent.

On platform recourse: a Google spam report can be filed against the linking site under the link spam policy and specifically the footers-and-templates clause. The realistic outcome is nothing visible, and no effect on your own rankings, because your rankings were not the problem. One practical warning, from Google's current documentation on the process: the submission text is relayed verbatim to the site owner. Include no personal information and no accusations. Host and registrar abuse reports are the more productive route where the linking site is hacked or sits on a compliant host.

The errors that turn a non-event into a real one

• Reacting to the backlink count instead of the referring domain count. This one error drives most of the panic on this vector and most of the money wasted on it.
• Quoting the 2012 Cutts video as though it were current without also citing Penguin 4.0 and the 2022 SpamBrain update. The 2012 statement is directionally right and the mechanism has changed twice since.
• Treating a vendor toxic score as a Google signal. It is not one, and no third-party tool has any input into Google's systems.
• Mass-disavowing on suspicion, which is the most reliable way to turn a non-event into an actual traffic loss.
• Missing that the links are outbound from a compromised template of their own, which is the case that actually needed the work.
• Blocking crawlers or referrers, which does nothing to a link that exists on someone else's server and can harm your own indexing.
• Paying for monthly disavow maintenance or "negative SEO protection" against a vector Google consolidates away. John Mueller said on X on 31 January 2023 that the agencies on both sides of this — those creating the links and those disavowing them — are "just making stuff up, and cashing in from those who don't know better." On this particular vector I would go further: the product being sold is protection from a number in a dashboard.

Frequently asked questions