Toxic Backlinks and Disavow: What Google Actually Says (and What Tools Mean by Toxic)
Google says most sites will never need the disavow tool. Toxic is a vendor score, not a Google signal. What the disavow doc and the spam policies say, how Semrush, Moz and Ahrefs each define a toxic or spammy link, how to read a dropped domain's link profile before you use it, and the two conditions under which disavowing makes sense.
Toxic backlinks is a phrase from SEO tools, not from Google. Google's own disavow documentation says "in most cases, Google can assess which links to trust without additional guidance, so most sites will not need to use this tool." The tools that sell a toxicity score have a different view, and the gap between the two is where most bad decisions about spammy backlinks get made. This page sets out what Google says, what each tool means by toxic, how to read a dropped domain's link profile before you build on it, and when disavowing is the right call.
What does Google say about disavowing backlinks?
The disavow doc opens with the case it is for: "If you have a manual action against your site for unnatural links to your site, or if you think you're about to get such a manual action (because of paid links or other link schemes that violate our spam policies), you should try to remove the links from the other site to your site." Disavow is the fallback when removal fails. Google then says the feature "is an advanced feature and should only be used with caution. If used incorrectly, this feature can potentially harm your site's performance in Google Search results."
Then the two conditions. Google says you should disavow "only if" you have "a considerable number of spammy, artificial, or low-quality links pointing to your site, AND the links have caused a manual action, or likely will cause a manual action, on your site." Both. A pile of low-quality links with no manual action does not meet the test. The doc adds that "Google works very hard to make sure that actions on third-party sites do not negatively affect a website."
That has been the position since the tool launched. The 2012 announcement answered "Will most sites need to use this tool?" with "No. The vast, vast majority of sites do not need to use this tool in any way." The December 2022 link spam update described how Google handles the links you would otherwise disavow: SpamBrain "can now detect both sites buying links, and sites used for the purpose of passing outgoing links," and "ranking may change as spammy links are neutralized and any credit passed by these unnatural links are lost." Neutralised, not penalised. The link stops counting.
A manual action is the exception, and it is visible. Google's manual actions report in Search Console lists any action against a verified property, including unnatural links to the site. If that report is empty, the first of Google's two conditions might hold but the second does not.
What Google means by link spam
The spam policies define link spam as "the practice of creating links to or from a site primarily for the purpose of manipulating search rankings." The examples are things someone did on purpose: "buying or selling links for ranking purposes," including "exchanging money for links, or posts that contain links," excessive link exchanges, and automated link programs. The definition is about intent and creation. A scraper site that copied your page and kept the link, a spam directory that listed you without asking, a comment bot that dropped your URL on a forum: none of those were created by you to manipulate rankings, and none match the policy text.
This is the distinction Ahrefs draws in its toxic backlinks article, which separates spammy links from manipulative ones. Its position is that "Toxic backlinks are links that some SEO tools say could hurt your website's Google rankings," and that low-quality links a site attracted without building them are "not 'manipulative' by definition." The links Google's policy targets are the ones built to move rankings. The links tools flag are often just ugly.
What "toxic" means in each tool
Every vendor that reports a toxicity or spam figure computes it from its own index with its own model, and none of them has access to Google's classifier. The number is a vendor's guess at a probability.
| Tool | Metric | What the vendor says it measures | Scale |
|---|---|---|---|
| Moz | Spam Score | "the percentage of sites with similar features to the site you're researching which we've found to be penalized or banned by Google" | 0 to 100 percent, 27 features |
| Semrush | Toxicity Score | An overall score on the Backlinks Overview report that opens a Backlink Audit and a disavow file | 0 to 100 |
| Ahrefs | None | Ahrefs publishes no toxicity metric and argues in its own blog that most "toxic" links are harmless | Not applicable |
| None published | Manual actions report shows an action if one exists; SpamBrain neutralises unnatural links without notice | Present or absent |
Moz is the most explicit about what its number is and is not. Its Spam Score help page says the score "is based on our machine learning model which identified 27 common features among the millions of banned or penalized sites in the data we fed it," that "a score of 1%-30% is considered a Low Spam Score," 31% to 60% medium and 61% to 100% high, and that "Spam Score updates quarterly." Asked whether the score is calculated from the sites linking to you, Moz answers "No, it's not. Spam Score shows you the percentage of sites with similar features that have been penalized by Google." It is a resemblance score. A site can look like penalised sites and be fine, and a penalised site can look clean.
Semrush's Backlinks Overview manual says the report shows the domain's "overall toxicity score," and that clicking it "will open your existing Backlink Audit or help you set up a new Backlink Audit for this domain," which produces a disavow file. The score is the entry point to a workflow that ends in a file Google says most sites should never upload. Read the score, but read Google's two conditions before you act on it.
How to read a dropped domain's link profile before you use it
The toxicity question turns around when the domain is one you are about to register. You are not defending a site from links you did not build. You are choosing whether to take on a link profile someone else built. The checks are the same as for any expired domain, with the spam signals read first.
Start with the spam band. Every listing in the Revised directory carries a Moz Spam Score band at the time of check, one of two: low, meaning 0 to 30 percent, or moderate, meaning 31 to 50. A moderate band is not a rejection. It means the site had some of the 27 features Moz associates with penalised sites, which can be as mundane as a thin page count or a long domain name. Read it beside the rest.
Then the anchor text. Our backlink checker lists, for each referring domain, one page that carries the link and the anchor text it uses. Anchors that are the brand name, the URL, or a topical phrase are what a site earns by being cited. A run of identical commercial anchors from unrelated sites, or anchors in a language the site never published in, is what a site gets from a link seller. This is the clearest single signal of built links, and no toxicity score reads it as well as your own eyes do.
Then the sources. Each listing names its notable linking sources. A university, a government body, a newspaper, an encyclopedia, a code host: these are sites that link when someone there judged the domain useful. Directories, profile pages, and expired-domain sellers link for other reasons. The source hubs group listings by these sources, and the edu backlinks hub is the smallest of them because a university citation is the hardest to fake.
Then the history. Evaluate an expired domain's link history covers the Wayback Machine read: whether the links were earned by the site that published under the name, or by a later owner who ran a casino or a pharmacy on it. Links earned by a spam era are the ones that carry real risk, because the domain may have been part of a scheme that SpamBrain already neutralised, in which case the links you are counting have already stopped counting.
Then the fit. Google's spam policies define expired domain abuse as a domain "purchased and repurposed primarily to manipulate search rankings by hosting content that provides little to no value to users." That is a rule about what you publish next, not about the links. Expired domain abuse and Google's policy has the full text and a two-part test.
| Signal on the listing | Read it as |
|---|---|
| Spam band moderate | Resemblance to penalised sites on Moz's 27 features. Check the others before deciding |
| Anchor text mostly commercial | Built links. Assume a link seller was involved, and that Google has probably discounted them already |
| Sources all directories | High count, low value. The referring domain band overstates the profile |
| Archive gap or subject change | Links may belong to a different site than the one that earned them. Check which era the linking pages cite |
| Named editorial sources | Earned links. Confirm the linking pages still exist and still point at the domain |
When should you disavow?
When Google's two conditions both hold, and not before. You have a considerable number of links that were built to manipulate rankings, and there is a manual action in Search Console or a specific reason to expect one. A newly registered expired domain can meet that test. If the previous owner bought links and Google issued a manual action against the site, the manual actions report for that property shows it once you verify the domain. Verify it before you build, open the manual actions report, and if there is an unnatural links action, that is the case the disavow tool exists for. Clean up the links you can, disavow the rest, and request reconsideration.
If the report is empty, do nothing. Uploading a disavow file for links that were already neutralised removes nothing Google was counting and can remove links it was. Google's own warning is that the tool "can potentially harm your site's performance." That is the point of a tool that works by telling Google to ignore things.
The stronger move for a dropped domain is to not register the one with the problem. A directory with the spam band, the anchors and the sources on every row makes that a sort rather than an audit. The high authority expired domains hub is the set with a Revised Score of 65 or more, and every row still shows its spam band, so a high score with a moderate band stands out before you reveal it. For a name you already hold, the domain authority checker gives the score and the backlink checker gives the anchors and the sources.
FAQ
What are toxic backlinks? Links that an SEO tool's model flags as likely to hurt rankings. The phrase is not Google's. Google's policies describe link spam, which is links created to manipulate rankings, and Google says it neutralises those without the site owner doing anything.
Do spammy backlinks hurt SEO? Google says most do not, because it ignores them. Its disavow doc says "most sites will not need to use this tool" and that it works to make sure actions on third-party sites do not affect yours. The exception is links you or a previous owner built, at a scale that draws a manual action.
How do I find toxic backlinks? Run the domain through a backlink checker and read the anchor text and the sources rather than the score. Identical commercial anchors from unrelated sites and links from directories or link sellers are built links. Moz's Spam Score and Semrush's Toxicity Score give a model's estimate; neither reads Google's classifier.
Should I disavow links on an expired domain I just bought? Only if Search Console shows a manual action for unnatural links after you verify the domain, or the profile makes one likely. Otherwise no. Google's tool can harm a site when used without cause, and links Google already neutralised gain nothing from being disavowed.
Does Google penalise you for bad backlinks? Through a manual action, when links were built at scale to manipulate rankings. That action is listed in the Search Console manual actions report. Without one, Google's stated behaviour is to discount the links and move on.
To pick a dropped domain by its link profile rather than audit one after the fact, browse the directory of expired domains with backlinks. Read the spam band, the named sources and the archive history on each listing, and reveal a name only when the links were earned by the site that published under it.