Removing negative SEO links, starting with whether to bother

Start with whether to do anything at all

If a backlink tool has just shown you a wave of junk domains pointing at your site, the useful first question is not how to get rid of them. It is whether anything has happened. For the great majority of sites the answer is that nothing has, that no intervention — any deliberate action taken to change what Google counts toward your site — is warranted, and that the correct response is to record what you found, keep watching, and stop there.

Recovery from negative SEO is what I am paid for, so read that paragraph with the appropriate suspicion and check it against the primary sources below. A page on a recovery site that told every reader they needed recovery would be worth nothing.

The phrase removing negative SEO links covers three separate actions that are habitually spoken of as one thing. The order in which they are presented is the entire argument of this page:

• Outreach removal. Emailing the owner of a linking site and asking them to take the link down, or to add rel="nofollow" to it so that it stops passing a ranking signal.
• Disavowal. Uploading a plain-text file to Google Search Console that asks Google to ignore specified links. It removes nothing from the web; it asks a system to discount a signal. The format, limits and failure modes are in the disavow file guide.
• Deliberate inaction. Exporting the evidence, dating it, monitoring, and declining to act because the evidence says the links are already being ignored.

Three words are used as synonyms in this field and are not synonyms. Removal means the link ceases to exist. Disavowal means the link exists and Google is asked not to count it. Devaluation means Google already ignores it and was never asked. Almost every conversation about the first is really a conversation about the third.

What Google publishes about acting on hostile links

Google's disavow documentation — the Search Console help article that is the only official description of the tool anywhere — is the most direct statement Google publishes on third-party link attacks, and it is written to discourage action rather than to enable it. Four sentences from Google's help page on disavowing backlinks, verbatim:

Google works very hard to make sure that actions on third-party sites do not negatively affect a website.

This is an advanced feature and should only be used with caution. If used incorrectly, this feature can potentially harm your site's performance in Google Search results.

In most cases, Google can assess which links to trust without additional guidance, so most sites will not need to use this tool.

You should disavow backlinks only if: 1. You have a considerable number of spammy, artificial, or low-quality links pointing to your site, AND 2. The links have caused a manual action, or likely will cause a manual action, on your site.

Read the criteria as written. They are joined by AND, not or. A site with no manual action — a penalty applied by a human reviewer at Google and shown to the owner in Search Console — and no realistic prospect of one fails the second condition outright, and is therefore outside the intended use of the only tool Google offers.

Note also how the page is structured. The instructions do not open with create your file. The first heading in the procedure is Step 0: Decide if this is necessary, and the sentence about most sites not needing the tool sits inside it. Google numbered the decision not to act as step zero of acting. That is the single most quotable fact on this subject and almost nobody who files a disavow file has read it.

The date the calculus changed: 23 September 2016

Hostile links used to work, and the reason they largely stopped has a date on it. Announcing that Penguin had become part of the core ranking system on 23 September 2016, Google wrote in its Search Central announcement that "Penguin now devalues spam by adjusting ranking based on spam signals, rather than affecting ranking of the whole site," and that Penguin's data is "refreshed in real time, so changes will be visible much faster, typically taking effect shortly after we recrawl and reindex a page."

That single sentence moved the default outcome of a link attack from demotion to discount — from something a site owner must undo to something that undoes itself on the next crawl. Before it, a site could be demoted as a whole on the strength of its inbound profile, which is precisely the mechanism a link attack was betting on. After it, the spam signal is set aside instead of being charged to the recipient.

The December 2022 link spam update extended the same machinery. Google described SpamBrain, its machine-learning spam detection system, as able to "detect both sites buying links, and sites used for the purpose of passing outgoing links," with the effect that those links are nullified rather than counted against the site they point at. That update began rolling out on 14 December 2022 and finished on 12 January 2023, per Google's own announcement and Search Engine Land's reporting of the completion date.

Both facts carry dates for a reason: a 2013 statement about link attacks, repeated in the present tense today, is a wrong statement.

Named Google staff, on the record and against interest

John Mueller is a Search Advocate at Google and one of a small number of named staff who answer public questions about ranking systems; his statements are the closest thing to on-record Google comment that exists outside the documentation. Mueller, 12 May 2020: "negative SEO is not a reason we have this tool — and I honestly can't recall a situation where a site ever needed to do a disavow for that."

Gary Illyes, speaking at Pubcon Florida in March 2019, was blunter about inbound spam anchors: "If you have a bunch of unnatural porn links pointing at your site, don't worry about it... The worst thing that would happen is that you might rank better."

Mueller returned to the subject on 31 January 2023, aiming at both halves of the industry built on this fear, in remarks reported by Search Engine Journal: "That's all made up & irrelevant. These agencies (both those creating, and those disavowing) are just making stuff up, and cashing in from those who don't know better." His alternative was one clause long: "Don't waste your time on it; do things that build up your site instead."

Now the counterweight, because a page that quotes only the reassuring half of the record is a sales page written backwards. In a Google Search Central video reported on 1 November 2021, Mueller said that for the most part Google recognizes a spammy link and tries to ignore it, and then added a qualification that is Google's position too: "If our systems recognize that they can't isolate and ignore these links across a website, if we see a very strong pattern there, then it can happen that our algorithms say well we really have kind of lost trust with this website..."

That residual case is narrow: a site whose entire profile is indistinguishable from spam, with nothing legitimate left to isolate the spam from. It describes a site with no genuine links, not a site with genuine links plus an attack.

Nobody has ever published a removal success rate

This deserves stating plainly because its absence is load-bearing. No search engine has ever published a success rate for link-removal outreach, and no study with a disclosed method is available to cite for one. Every percentage in circulation — the ninety-day cleanup, the two-thirds-removed campaign report — is vendor marketing with no published method behind it.

What can be said without inventing a number is structural. The sites hosting an attack link are, by construction, sites that accept automated links: abandoned forums, hacked pages, scraper mirrors, expired-domain networks. Most have no monitored contact address, no reason to answer, and in some cases a commercial interest in not answering, because a link they can be paid to remove is worth more to them than a link they remove for free. That is the pattern documented on the link removal extortion page, and it is why a removal demand should be treated as evidence rather than as an invoice.

Outreach to one bad link on a real publisher's site is a different and tractable job: there is an editor, an inbox and a reason to care. Outreach to a mass-generated cluster of thousands of junk domains — throwaway hosts that exist only to carry automated links — is not that job wearing a bigger hat, and anyone quoting a removal percentage for the second kind is quoting a number they made up.

Establishing whether anything happened, in order

Work through these in sequence and stop at the first one that comes back clean. Most cases end at the first check.

1. Search Console, Manual actions report. If it reads "No issues detected," there is no penalty. Nothing has been done to you by Google, and there is nothing for a reconsideration request or a disavow file to reverse. The mechanics of why that is dispositive are set out in the guide to manual actions and reconsideration requests.
2. Search Console, Performance, compared on a date. Plot clicks and impressions by day. A real event has a day. A gradual slope over months is not an attack; it is competition, seasonality or decay. If it is a step change, write down the exact date before you look at anything else.
3. Which queries lost. A broad loss across every query in a category is almost always algorithmic. A loss confined to a handful of pages is usually about those pages.
4. Only now, the links. Export referring domains with first-seen dates. What matters is whether a cluster of new domains appeared before the traffic date. Links discovered after the drop cannot have caused it, and this one comparison disposes of a large share of suspected attacks.

What it is commonly mistaken for, in rough order of frequency: a core update, a Search Console property or analytics change, a migration with unreconciled redirects, an expired certificate, a noindex shipped by accident, and a competitor who simply got better. Every one of those is more common than a successful link attack, and every one of them is cheaper to check.

If there is a manual action, the order of the work

The remainder of this page applies to the minority of readers whose Manual actions report is not clean, and specifically to the action type Unnatural links to your site. If your action is for thin content, user-generated spam or cloaking, inbound link work does nothing for it.

1. Preserve the evidence before it changes. Export the referring-domain list with first-seen dates, the anchor-text distribution, and a dated Search Console performance export, to files, today. Backlink indexes rewrite themselves continuously; a screenshot taken in month three is not evidence of month one. If the matter ever becomes a legal one, that export is the case.

2. Read the action's stated scope. A manual action names what it covers and whether it applies to the whole site or to specific URLs. The remedy follows the stated scope, not your theory of what happened.

3. Attempt removal only where removal is plausible. Real publishers with monitored inboxes: ask once, politely, in writing, and keep the record — the record is what a reviewer will read. Do not pay. There is no public case of a payer obtaining verified removal, and payment marks the address as responsive.

4. Disavow the remainder against Google's two-part test, not on suspicion. Keep the file scoped to the identified cluster and its dates. Every entry that is not part of the attack is a legitimate link you have volunteered to discard.

5. File the reconsideration request. A disavow file alone does not lift a manual action; only a review does.

And for readers with no manual action, step five is the whole page: leave the links alone and build. Strengthening the profile you control means that when the spam is discarded there is plenty left behind. Mueller's "do things that build up your site instead" is not a platitude — it is the only response on this list with an upside rather than a downside.

What does not help, and why people try it anyway

• Treating a tool's toxicity score as a finding. No search engine publishes such a score or endorses one. It is an opinion sold as a metric, and it is the input to most bad disavow files.
• Disavowing at domain level in bulk from a tool export, which discards real links along with junk and is not meaningfully reversible.
• Filing a reconsideration request with no manual action outstanding. There is nothing to reconsider, and the control to file one does not exist.
• Acting before dating the drop. Remediation aimed at the wrong month cannot work even when it is technically sound.
• Rewriting or deleting your own pages because the attack's anchor text mentions them. The anchors are the attacker's copy, not yours, and deleting your pages completes the job for them.
• Blocking the linking sites at the firewall. They are not visiting you: a link is text on someone else's page, not a request to your server.
• Buying continuous toxic-link monitoring, which produces a monthly list of links Google has already discarded.
• Asking Google to reset your link profile. No such request exists.

What recourse exists, and what does not

Google operates no complaint process for "someone is pointing links at me." The disavow tool is the only product surface that responds to inbound links at all, and it is an instruction to ignore, not a report to be read. The spam report form reports the linking sites' behavior rather than your injury, and Google's own description of what happens next is deliberately non-committal: it says only that it may use the report to take manual action against violations. Treat it as evidence building, not as remedy.

Where a link campaign is part of a broader course of conduct, the theories under which negative SEO has actually been litigated in the United States — tortious interference, defamation, and the Lanham Act at 15 U.S.C. 1125(a) — are set out with their elements on the spam link attack page. Pointing links at a site does not access that site's systems, so the Computer Fraud and Abuse Act is not in play for link-pointing alone. An accompanying payment demand is a different and far stronger matter, and belongs with law enforcement rather than with a disavow file.

The honest summary of the whole subject: the industry that sells removal outlived the mechanism that made removal necessary. Check for a manual action, date the drop, keep the evidence, and spend the budget on the site.

Frequently asked questions