Backlink monitoring buys you a record, not a defense

What a backlink monitor actually measures

A backlink monitor compares what one link index holds today against what it held at some earlier point, and reports the difference. An alert threshold - the rule that decides which of those differences is worth telling you about - is therefore a rule applied to a private, partial dataset, not a reading of your standing with any search engine.

Everything useful and everything misleading about the category follows from a single fact: the index is a sample, and the sample belongs to the tool. A sample here means what a crawler happened to find and chose to keep, which is not the same thing as what exists and is definitely not the same thing as what Google counted.

Sold as the front line of negative SEO defense, monitoring is really a filing system - a mechanism whose product is a retrievable, dated record rather than a decision. That sounds like a demotion. It is not, because the record turns out to be the only thing in this whole subject that cannot be produced after the fact.

Google's own link report tells you it is a sample

Search Console's documentation carries four caveats about the Links report that are almost never quoted, and that between them dismantle the way it is normally used (Google, Links report):

"This report isn't a comprehensive list of every link on your site. It shows a sample of internal and external links to help you understand your site's overall link profile."

"Tables are limited to 1,000 rows, so tables may be truncated in larger or more linked-to sites."

"Some URLs might be omitted for various reasons, such as non-indexed pages or deduped URLs."

"The report includes links that Google has found over time. These links may have since been removed, or a page may no longer exist."

Read together, three conclusions follow, and each one contradicts a common practice.

You cannot count your links. Not here and not anywhere. Every figure available to you is a count of what one crawler found and retained, which makes a backlink count a property of the measuring instrument rather than of your site.

A large campaign truncates. A thousand rows cannot show you spam spread across several thousand throwaway domains. The report will tell you something is happening; it will not tell you how much.

Live and dead links sit in the same table. Links Google found at some point, which may since have gone, are not distinguished from links that are there now. So a month-over-month difference contains real change and retention artifacts - readings produced by the instrument rather than by the world - and nothing inside the report separates them.

Commercial indexes are samples of a different shape, built by different crawlers on different schedules. Two consequences matter for alerting. A referring-domains chart records when a tool discovered links, not when they were created, so a great many spikes are crawl batches rather than events. And because no two crawl frontiers match, agreement between two independent tools is genuinely informative while disagreement is evidence of nothing at all.

The thing no monitor can see

This is the decisive limit, and it deserves stating without hedging: nothing available to a site owner reveals whether Google counted a link.

The hinge was Penguin 4.0. Announcing it on 23 September 2016, Google wrote that "Penguin now devalues spam by adjusting ranking based on spam signals, rather than affecting ranking of the whole site" - a move from demoting sites to discounting links. The December 2022 link spam update restated the mechanism in stronger terms: when Google's systems nullify spammy links, the link credit previously generated is lost.

Devaluation leaves no trace anywhere you can look. A nullified link and a counted link are identical in every report you have access to. So every alert you will ever receive concerns links whose effect on you - most probably zero - is unmeasurable from outside. That is not a gap in the tooling. It is a property of the system being observed, and no product will close it.

The practical consequence is worth being blunt about. If somebody sells you monitoring on the promise that it will show you an attack working, they are selling a capability that does not exist, because "working" is a state inside Google's ranking systems and the monitor is looking at a third party's crawl of the open web.

What Google says the paid version is worth

On 31 January 2023, Google's John Mueller addressed the industry built on this activity directly: "That's all made up & irrelevant. These agencies (both those creating, and those disavowing) are just making stuff up, and cashing in from those who don't know better." His advice was to spend the time elsewhere: "Don't waste your time on it; do things that build up your site instead." Earlier, on 12 May 2020, he had said of the disavow tool that "negative SEO is not a reason we have this tool - and I honestly can't recall a situation where a site ever needed to do a disavow for that." Both were reported by Search Engine Journal, on 2 February 2023 and 14 May 2020.

Take the framing seriously rather than defensively. He is describing monitoring as a trigger for action, and on that framing he is right: an alert that leads to a disavow file is a cost with no demonstrated benefit. I have not been able to find, in any published source, a single documented case where a backlink alert led to an intervention that measurably preserved a site's rankings. That absence is the honest core of this page, and anyone quoting a save rate is quoting their own marketing.

A different case survives, and it is the one worth your fifteen minutes a month.

The evidentiary case: why you keep the record anyway

Link indexes are not archives. They re-crawl, they drop pages, they expire what has died, and Search Console warns in its own documentation that its contents may since have been removed. The profile you will be able to observe in twelve months is therefore not the profile that exists today, and no retrospective query recovers the difference. If you want to be able to state what pointed at your site on a particular date, the only mechanism is to have written it down on that date.

That matters because of what a complaint, a demand letter or an expert report has to contain. Each has to say what appeared, how much of it, and when - a count, a date range, and the anchor text itself - because those are the facts that turn "my rankings fell" into an allegation with a shape. A traffic graph is not that; it is precisely the exhibit the other side explains away with an algorithm update. A monthly export is that, and it is the one artifact a current-view tool cannot manufacture afterwards.

The duty to have kept it starts earlier than most people expect. Federal Rule of Civil Procedure 37(e) addresses electronically stored information that should have been preserved in the anticipation or conduct of litigation, was lost because reasonable steps were not taken, and cannot be restored or replaced through additional discovery (Cornell LII, FRCP 37). The trigger there is anticipation, not filing - and a link profile is exactly the kind of material that cannot be recovered later, since no vendor keeps an immutable history you could subpoena.

Capture it so it can be authenticated, not merely saved. Federal Rule of Evidence 901(b)(9) contemplates evidence describing a process or system shown to produce an accurate result, and Rules 902(13) and 902(14) allow records generated by an electronic process, and data identified by hash value, to be certified rather than proved through a live witness. In practice that means a raw export rather than a screenshot of a chart, recorded with the tool, the timestamp, the filter settings, the account that ran it and a hash taken at capture - on a schedule, so the record is a series and not two isolated points. A vendor's file is still a third party's record and is not self-proving. Preserving the evidence carries the chain-of-custody detail.

Be clear about what this argument does not rest on. It does not require proving that Google demoted anything, which is a fact inside Google that no claimant can reach. It is about the words and the dates: what was placed against your name, and when. And it is reasoning from the rules and from what a pleading has to contain - I am not aware of a published evidentiary ruling testing a self-collected link export, and nobody should imply one.

Setting a threshold that is not noise

Most alert configurations fire constantly and are consequently ignored, which is worse than having no alerting at all. Four rules make one survivable.

1. Alert on referring domains, not on links. A single spam page can carry hundreds of links and one footer injection produces thousands from one host, so link counts swing by orders of magnitude for reasons that mean nothing. New referring domains is the stabler series.
2. Make the threshold relative to your own baseline. "Alert at 100 new domains" is meaningless until you know whether the site normally acquires two a month or two hundred. Take the trailing median of new referring domains per week across the last six months and trigger at a multiple of it. Something around five times that median is a defensible starting point - tuned down if it never fires, up if it fires weekly. That figure is my reasoning from the failure modes, not a sourced standard. No primary source specifies a threshold, and anyone quoting one as authoritative invented it.
3. Require persistence. Fire only when the condition holds across two consecutive checks. This one rule removes most crawl-batch artifacts, which appear once and then revert.
4. Watch anchor character, and weight it above volume. The most informative single view is the top linking text report. A volume spike with ordinary anchors is a curiosity; a spike carrying pharmaceutical, gambling or adult vocabulary alongside your brand name is a different event with a different remediation path and a different legal profile. If you can only monitor one thing, monitor the anchors. See anchor text poisoning.

What not to threshold on: any vendor toxicity or spam score. Google publishes no such metric and never has, so an alert built on one is an alert on a competitor's opinion of a domain.

Things routinely mistaken for an attack: a scraper network republishing one of your pages together with its outbound links, a syndication partner going live, a genuine press hit, your own campaign, and a hosting or content-delivery change that altered how a tool crawls you. See link velocity spike.

When an alert fires, the answer is usually nothing

Say that out loud, because no vendor will. The correct response to the large majority of alerts is to record and move on. In order:

1. Read the Manual actions report. "No issues detected" means no human reviewer at Google has acted against you, and nothing in the alert changes that. Most incidents end at this step.
2. Read the Security issues report. Rule out the possibility that the "link attack" is your own compromised site emitting links, which is a different and much more serious problem. See hacked site injection.
3. Check the update calendar. If rankings moved, compare the date against published core and spam update dates before attributing anything to links. A drop that lands on an update date is an update.
4. Look at the anchors. Clean anchors: a curiosity. Poisoned anchors naming your brand: record them carefully.
5. Export and archive with the date preserved. This is the entire product of the exercise.
6. Do nothing else - not because action is unlikely to help, but because Google's documented behavior is to nullify these links, and every action available to you carries a cost.
7. Disavow only if both limbs of Google's test are met: "only if: 1. You have a considerable number of spammy, artificial, or low-quality links pointing to your site, AND 2. The links have caused a manual action, or likely will cause a manual action, on your site." Both, not either. Google labels the tool an advanced feature that can harm a site's performance if used incorrectly, and says most sites will never need it (Google, Disavow links to your site).
8. If the pattern persists and the anchors are defamatory, involve counsel - and hand over the dated exports. That is what they were collected for.

What people get wrong

• Treating the monitor as a trigger rather than a recorder, and disavowing on suspicion. A wide file discards earned links along with the noise, and that damage reverses slowly.
• Paying a subscription for toxicity scoring, which is exactly the practice Mueller characterized in January 2023 as cashing in on people who do not know better.
• Reading a commercial tool's discovery spike as an event without checking it against Search Console.
• Setting an absolute threshold with no reference to the site's own history, then either drowning in alerts or never firing one.
• Alerting on link count rather than referring domains.
• Never exporting anything, so that when a pattern finally becomes legally interesting there is no dated record and no way to build one retroactively.
• Storing exports with the dates stripped, which destroys their value as thoroughly as never taking them.
• Concluding from Search Console's silence that nothing is happening, or from its thousand rows that whatever is happening is small.
• Naming a suspected competitor in public, which converts a search problem into a defamation exposure while the link problem remains hypothetical.

Frequently asked questions