A backlink audit reads what the links to a site carry, not how many there are. An export says 100 links from 33 domains and not one anchor from a spam vertical, and none of those three numbers answers the questions the audit exists for: whether the profile of a commercial page reads like a manual-review footprint, which links are gone and which are still there and no longer count, and which page that should rank has no one on the web voting for it.
Most of what ranks for this term is a tool walkthrough: export, sort by toxicity, disavow, repeat quarterly. That sequence was reasonable in 2014. Since Penguin went into the core algorithm in September 2016 Google has devalued manipulative links instead of demoting the site that has them, and the link spam update of 14 December 2022 said the same thing about bought and sold links: SpamBrain would neutralize them, and the credit they passed would stop. The backlink audit that matters now is a reading, link by link and page by page, and the output is three findings with an owner; a .txt file comes out of it in two situations, described in Step 8.
A site of a few hundred pages takes two to three days. The external profile gets read for every commercial page separately, then the internal graph, which is what people mean by an SEO link audit when they say it to cover both, then the disavow question last, because on a site that never bought links the answer to that one is no.
What a backlink audit is for, and what it isn’t
The object a backlink audit is looking for has a name in Search Console: Manual actions → “Unnatural links to your site”. It is the only place Google tells a site that its links are the problem, and on most sites the report is empty and stays empty. Everything else the audit finds is read off the profile and the traffic curve without a letter: the footprint a reviewer would act on if one ever looked, the links that are gone, the links that are still there and no longer count, and the money page with nothing pointing at it from outside or from inside the site. That last one is why a link audit has an internal half. What the audit is not is a diagnosis of a traffic drop; that starts from the Performance report and arrives at links only if the dates and the affected pages lead there.
It is also not a search for a toxicity score. The score is a vendor’s model of risk, built from patterns the vendor chose, and Google doesn’t see it. That doesn’t mean links can’t harm a site. It means the harm arrives in two shapes, a footprint that ends in a manual action, or a quiet devaluation that shows at an update, and a backlink audit looks for those two shapes directly instead of sorting by a colour.
Step 1. Export the profile: Search Console, one index, one crawl
Each source shows part of the picture and hides part. Search Console’s Links report is the only one that comes from Google’s own index, and it is also the thinnest: top 1,000 rows per table, no dates, anchors aggregated for the whole site rather than per target page. A third-party index has the dates, the anchors and the lost-link history, and it is somebody else’s crawl, so a link it shows may not be in Google’s index and a link Google counts may not be in the export. The crawl of your own site is for the internal half, and it is the one source you fully control.
| What to read | Where | What it won’t show |
|---|---|---|
| Which pages Google sees links to, from which sites | Search Console → Links → Top linked pages, Top linking sites | Dates, anchors per page, anything past row 1,000 |
| Anchor per link, first seen, lost, target URL | Ahrefs / Semrush backlink export, one row per link | Whether Google indexed the linking page or counts the link |
| Referring domains over time, spikes | Same export, cumulative by month | Why a spike happened; press and a directory burst look the same |
| Internal links per page, depth, orphans | Crawl of your own site, inlink graph | Which pages make money; that comes from analytics |
| Whether a link is being held against you | Search Console → Manual actions | Algorithmic devaluation; that report stays empty |
| Whether a change in the profile changed anything | Performance report against the export dates and update dates | Causation; it shows coincidence in time |
One column in the export matters more than any score: rel. A link marked sponsored or nofollow is the disclosed version of what Step 3 looks for undisclosed, and it was never going to pass credit, so the profile gets filtered to followed links before anything is read, and the disclosed ones are noted as the honest baseline. No source answers two questions, and a backlink audit should say so up front. It can’t tell what share of the links in an export Google counts, and it can’t measure the effect of one link on one ranking. Every read below works around those two gaps instead of pretending they’re closed.
Step 2. Read the backlink profile per target page, not per domain
A domain-level anchor chart averages the blog, which collects editorial links with the brand and the URL as the anchor, together with the three commercial pages where somebody once bought links with the keyword. The average comes out healthy. The commercial pages don’t. The first cut of a backlink audit is therefore by target URL: the pages that sell, each with its own anchor distribution, its own referring domains, its own first-seen dates.
Links get read by what they carry. A domain rating says the linking site is strong and nothing about whether the link is relevant, in context, or worth anything to the page it points at. The anchor distribution per page is the first thing that is both readable and comparable; it’s the same read that sits in Step 7 of the B2B SEO audit, applied to every page that sells. The ranges the report works from are these:
| Anchor type | Working range (Backlink Profile report) | What sits outside it |
|---|---|---|
| Branded | 25–60% | Below 20%: nobody names the company when they link |
| Naked URL | 10–30% | Above 50%: scraped or directory profile |
| Generic (“here”, “this guide”) | 5–20% | |
| Exact match | 1–10% | Above 15%: the footprint a reviewer reads first |
| Commercial (“buy”, “price”, “best”) | 0–5% | Above 5% on a page that sells |
| Money anchors (exact + commercial together) | ≤ 15% | Above 15%: the page reads as optimized before any link is opened |
| Links per referring domain (domain level) | 1.5–2.5 | Above 3: sitewide links from a few domains |
The profile above shows how the two levels disagree. Domain-wide it is small and quiet: 100 links from 33 domains, zero anchors from spam verticals, thirteen new links a month and falling. The anchor mix is where it stops being quiet. Money anchors, exact match and commercial together, are 34% of the profile against a working ceiling of 15%; exact match alone is 30% against 1–10%; branded is 10% against 25–60%; generic is 0%. Naked URLs at 41% would read as a directory profile if the rest were the brand, and the rest is the keyword.
Per page it is sharper still: nine URLs flagged, five of them critical, and they are the pages that sell, /villas-for-sale/bali, /beachfront-property-for-sale/bali, /property-for-sale/seminyak, /bali-real-estate-agents, with two blog posts beside them. Three links per domain says a few hosts link more than once.
Nothing in that profile is toxic by any tool’s definition; the spam-topic count is zero and a toxicity filter passes it. A reviewer looking at /villas-for-sale/bali on its own does not, because nearly a third of everything pointing at the site is the term its pages sell and one link in ten is the company’s name, which is a shape no site acquires by accident. That is the read a domain score and a toxicity filter both miss, and it’s the first finding of most backlink audits I’ve written.
Step 3. Anchors, context, neighbours: the footprint test
Once the pages are sorted, the links on the flagged ones get read one at a time, and the question for each is whether the paragraph around it would exist without the link. The two sentences on either side of the anchor are the test. An editorial link sits in a sentence that was going somewhere anyway; a placed link sits in a sentence written to hold it, usually with a buying word next to the keyword and nothing before or after that needed the reference.
Then the host. A domain that publishes gambling on Monday, dental implants on Tuesday and your category on Wednesday is a host that sells pages, and Google’s site reputation abuse policy, enforced from November 2024, exists for the stronger version of the same thing: a reputable domain renting a section out. A linking page that isn’t in Google’s index is simpler still. Search its title in quotes; if it doesn’t come back, the link doesn’t exist for ranking purposes, whatever the export says.
| Sign on one link | On its own |
|---|---|
| Exact-match or commercial anchor on a page that sells | Flag; editors do this sometimes |
| The surrounding sentence exists only to hold the link | Flag |
| Host publishes any topic; neighbours on the same domain are pharma, casino, payday | Flag |
| Anchor from a spam vertical pointing at a non-spam site | Flag, often negative SEO or a hacked host |
| Linking page not in Google’s index | The link doesn’t count either way |
| Same link text from many unrelated domains in one month | Flag; a campaign, paid or not |
| Link arrives through a 301 from an expired domain | Flag; somebody bought the domain for its links |
| Three or more of the above on the same link | Verdict: a placed link. A commercial page where most links carry three or more is what a manual review is built to find |
A score adds the flags and hands back a number. The reading asks whether the flags land on the same links, because one exact-match anchor from a clean editorial host is noise, and the same anchor from a host that sells pages, in a sentence built to carry it, is the footprint. Which pages carry links of the second kind, and how many, is the finding. Where none are found, the answer to disavow is no and the audit moves on; where they are, Step 8’s second row applies.
Step 4. Lost, broken and neutralized links: the part of a backlink audit the export can’t show
A backlink tool reports lost links as a list with dates, and most of the list is neutral: a page was removed, a site folded, a widget was replaced. The ones that matter are few and specific, a link from a page that itself ranks and sends visits, lost on a date that sits against the traffic curve. Broken is the easy case: the link exists, the target URL on your side returns 404 after a redesign, and a 301 recovers it once the linking page is recrawled. Both get counted, and then the backlink audit looks for the third class, which the export can’t show.
Neutralized is a link that is still in the export, still on the page, and no longer counts. Penguin 4.0 made that Google’s default response to manipulative links in September 2016, and the 14 December 2022 announcement said it for bought and sold links specifically. There is no notification and no manual action; the table below is how the two classes tell themselves apart.
| Lost | Neutralized | |
|---|---|---|
| In the export | Marked lost, with a date | Still live, nothing changes |
| In Search Console | Drops out of Links after the next crawl | Stays in Links; Manual actions stays empty |
| In the rankings | A slide on one page, if the link mattered | A step down across the pages the links pointed at, dated to an update |
| How to read it | Export date against the curve; recover if the source page still ranks | Update date against the curve; the profile of the affected pages against Step 3 |
| What fixes it | Outreach, a 301, or nothing | Links of the other kind, over quarters; removing the dead ones changes nothing |
A second site, not the one in Step 2, shows the second column on a traffic chart. Organic traffic rose from around 115,000 to 176,000 visits a month between August and October 2025, on a profile that was mostly placed articles with keyword anchors. The December 2025 core update rolled out from 11 December over eighteen days, and by February the same site was at 50,000, where it still was in April. The links are still in the export. No manual action arrived.
Two things need saying plainly. That was a core update, not a link spam update, and Google said nothing about links; the connection is my reading, from the fact that the pages that fell were the pages those links pointed at, and from the shape of the profile two months earlier.
Step 5. Velocity and spikes: a campaign, a press hit or someone else’s
The curve comes from the export: group links by first-seen month, count distinct referring domains, plot the running total. It should look like the business, steady with a step when something happened, and the step I stop on is a month that adds more domains than the previous six put together. Spikes get read in context. A press pickup produces a few dozen domains in a week with branded anchors and the article’s own URL; a directory burst produces the company name and a city; a bought campaign produces the same keyword anchor pointing at the same commercial URL from domains that have nothing else in common. The third one is Step 3’s footprint arriving in a lump, and it’s the spike a backlink audit stops on.
A spike you didn’t cause, from hosts in verticals nothing to do with yours, is usually noise aimed at you or at the host. Google’s own disavow documentation says it works to keep third-party actions from harming a site, and the audit takes that at its word: the spike goes in the log with the date, and comes back only if a manual action names it. Links per referring domain is the quieter velocity signal: the profile in Step 2 sits at 3.0 against the report’s 1.5–2.5 working range, which means a few domains link more than once, and a sitewide footer link from a partner counts as one vote repeated, not three hundred.
Step 6. The competitor profile: the search set, not the sales set
The competitor set in a backlink audit is the domains that out-rank you, and it gets built from data rather than from the sales team: the twenty non-brand queries that bring the most impressions in Search Console, and the domains that sit in the top five for most of them. On most sites that set has a publisher, a marketplace or a review platform in it that nobody in sales has ever mentioned. Their profiles answer one question per commercial page: which referring domains link to two or more of them and not to you. That intersection, filtered to linking pages that have organic traffic of their own in the index you’re using, is the acquisition list, and the filter is what keeps it short. It is context for whoever builds links, not one of the three findings; their domain rating and their total link count get one line in the report.
Step 7. The internal link audit: inlinks per template against revenue
The second half of an SEO link audit is the site’s own graph, and the standard reads apply: orphans, depth from the home page, broken internal links, anchor text that is the same word everywhere. The one that moves rankings most, on the sites I’ve read, is simpler and rarely run. Count the internal inlinks to each template, set them beside the revenue or the leads each template produces, and look at the ratio. The usual result on a commercial site is a blog that holds most of the internal equity because every post links to every other, and a set of solution or category pages that make the money and are linked from the navigation and nowhere else.
The fix is build work, a dozen in-body links from the posts that rank to the pages that sell, with the anchor the page should rank for, and it moves faster than any external link will. The mechanics of the crawl, depth and the inlink graph are in the technical SEO audit guide; the authority-by-section version for large sites is in the enterprise audit. In the backlink audit report the internal half gets one table: template, inlinks, share of revenue, and the gap.
Step 8. Disavow: a decision at the end of the backlink audit, not a step in it
The disavow tool is still in Search Console, and its history explains why it shouldn’t be a default step in a backlink audit. Penguin 4.0 in 2016 moved Google to devaluing bad links rather than punishing the site. Gary Illyes said in 2023 that the tool hurts more sites than it helps. John Mueller said in 2024 that most sites don’t need it and that Google would eventually remove it, and in September 2026 that it is still worthwhile in certain cases and takes a few months to take effect. Put those together and the decision has three rows.
| Situation | Disavow? | Why |
|---|---|---|
| A manual action for unnatural links in Search Console | Yes, domains not URLs, then the reconsideration request | This is the case the tool was built for, and the reviewer expects the file |
| No action, but the site bought links or ran a network and the footprint from Step 3 is on the commercial pages | Usually yes, for the placed links only | Google is likely already ignoring them, so the file won’t move rankings; it removes the footprint a future review would read |
| No action, no history; spammy links arrived on their own | No | Google devalues them; a broad file risks disavowing links that count, and Illyes’s warning is about exactly this case |
Two practical notes. A domain line is almost always right where a URL line is tempting, because a host that sold one page sold others. And the file doesn’t bring rankings back; what Google already neutralized stays neutralized, and the file’s job is to take the footprint out of a future review. I don’t have an observed interval between a disavow and a ranking change on any site I’ve worked on; Mueller’s “a few months” is the only number I can give, and it’s his.
The report and the cadence
The report is three findings, ordered by the money the page behind each one makes, each with the page, the evidence and the owner. A commercial page with a placed-link footprint is one finding, and the owner is whoever buys links. A template with, say, a twentieth of the internal inlinks and half the revenue is one finding, and the owner is content. A page that lost its best referring link to a 404 after a redesign is one finding, and the owner is engineering. Everything else, the directory bursts and the spam-vertical anchors and the twelve links a tool scored red, goes in an appendix with the date it was read.
Cadence: one full backlink audit when the site is first read or when the site is rebuilt, then a quarterly export compared against the last one, because what’s new and what’s lost since the previous quarter is a one-hour read and the full profile is not. A traffic step at an update triggers an unscheduled one, and the first thing it checks is whether the pages that moved share a link profile.
Backlink audit checklist
One row per step: what gets read, where, and what counts as a finding.
| Step | What’s read | Where | Finding |
|---|---|---|---|
| 1. Export | GSC Links, one index export, one crawl, manual actions | Search Console; Ahrefs / Semrush; crawler | A manual action; a source missing |
| 2. Per page | Anchor distribution and referring domains per commercial URL | Export filtered by target | A page outside the ranges in Step 2 |
| 3. Footprint | Anchor, sentence, host, index status per link on flagged pages | By hand; title search for index status | Links with three or more signs |
| 4. Lost / broken / neutralized | Lost list with dates; 404 targets; ranking steps at updates | Export; crawl; Performance against update dates | A lost link from a ranking page; a 404 target; a dated step with no event |
| 5. Velocity | Cumulative referring domains; links per domain | Export by month | A spike with one anchor and one target; sitewide links counted as many |
| 6. Competitors | Domains linking to two or more search competitors and not to you | Export intersection | The short acquisition list |
| 7. Internal | Inlinks per template against revenue per template | Crawl inlink graph × analytics | A money template starved of inlinks |
| 8. Disavow | Which of the three rows the site is in | Manual actions; Step 3 | A file, or a written decision not to |
| Report | Three findings with owners; appendix dated | ||
| Cadence | Quarterly diff; full read on rebuild or an update step |
Backlink audit FAQ
What does the quarterly backlink audit compare?
Four fields between this export and the last one: referring domains gained and lost, with the lost ones checked against pages that rank; the anchor mix per commercial URL, for any drift toward exact match; links per referring domain, for a new sitewide link; and the first-seen month, for a spike. An hour’s work, and the full read in the steps above is only for a rebuild or a step on an update date.
What does a toxic score mean in a backlink audit?
It means the vendor’s model found patterns it associates with risk on that link: the host’s topic, the anchor, the link count from the same domain. It is not a Google signal and Google doesn’t use it. A profile can score clean and still carry the footprint in Step 3, and a profile can score red on a hundred links Google ignored years ago. Read the score as a sort order for the manual pass in a backlink audit, and nothing more.
Do I still need to disavow links?
Only in the first two rows of the table in Step 8: a manual action, or a history of placed links on commercial pages. With neither, no, and a broad file is more likely to remove links that count than to fix anything.
How long until a disavow takes effect?
Google’s John Mueller put it at a few months in September 2026. I don’t have an observed interval of my own to set beside that, because the sites I’ve read mostly didn’t need the file.
Do backlinks matter for AI answers?
I haven’t seen anything published that shows a separate link signal in ChatGPT, Perplexity or AI Overviews. What’s observable is that the pages they cite are overwhelmingly pages that are indexed and rank, and links are part of why a page ranks. I don’t have a number of my own for how much, and I’d distrust anyone who gives one this early.
The link profile a site has is a record of what it did and what was done to it, and a backlink audit is the act of reading that record page by page instead of scoring it. Three findings with owners, the lost links worth recovering, the pages nobody votes for, and a one-line decision on disavow, usually no. If you’d rather have that reading done than do it, it’s part of our SEO audit services.