A good share of the sites that come to us arrive carrying somebody else’s link building. Usually the story is the same: an agency promised volume, delivered it, the site did well for a while, and then a core update took back more than it gave.
The work of cleaning that up is methodical rather than clever. Here is the process, and the parts of it people usually get wrong.
First, confirm links are actually the problem
This step gets skipped constantly. Traffic can fall for many reasons: a redesign that broke internal linking, a migration that lost redirects, a competitor improving, a seasonal cycle, or a core update that reassessed content quality rather than links.
Line the traffic drop up against known update dates, against your own release history, and against the pages that lost the most. If the losses are concentrated on pages that were aggressively linked, links are a plausible cause. If they are spread evenly across the site including pages nobody ever linked to, look elsewhere first.
Also check Search Console for a manual action. A manual action is a completely different situation from an algorithmic one, and it comes with a reconsideration process.
Build a complete picture of the profile
No single tool sees every link. Export from Search Console, which is authoritative for what Google knows, and from at least one third-party index for the detail Search Console does not give you. Deduplicate by referring domain — you are going to make decisions at domain level, not link level.
Classify by hand, at domain level
Automated “toxicity scores” are a starting point and nothing more. We have seen them flag legitimate industry publications and pass obvious link farms. Sort by referring domain and put each into one of three buckets:
- Keep. Real sites with real audiences, whether or not the link is doing much for you.
- Remove. Clear manipulation: link networks, sites that exist only to sell placements, irrelevant foreign-language directories, comment and forum spam, sitewide footer links across unrelated domains.
- Unsure. Low quality but plausibly organic. Leave these alone on the first pass.
The “unsure” bucket matters. Over-disavowing is a real risk, and it is one you cannot easily see, because you never find out what the removed links were contributing.
Try removal before disavowal
For a manual action, Google wants evidence of genuine removal effort, so email the sites and keep records. For an algorithmic problem it matters less, and chasing removals from spam networks is largely wasted time.
Either way, keep a log of what you asked and what happened. It costs nothing and it is the only proof you have.
Disavow carefully
Disavow at domain level with domain: entries rather than listing individual URLs — spam sites generate new URLs faster than you can list them. Upload one file containing everything you want disavowed; each upload replaces the previous file entirely, so it must be cumulative.
Keep the file in version control or somewhere you will still have it in two years. The number of sites that have lost their own disavow file is remarkable.
Then be patient, and rebuild
Algorithmic recovery is slow. Google has to recrawl the disavowed domains before the file has full effect, which takes months rather than weeks. Do not upload a file, see no change in a fortnight, and start adding more domains out of frustration — that is how sites end up over-disavowed.
Meanwhile, do the constructive half. A profile recovers faster when legitimate links are arriving alongside the cleanup, and the content and technical work you do during the wait is what the site will rank on afterwards.
We run this audit as the first stage of any off-page SEO engagement where a site has history. If you are not sure what you have inherited, ask us for a free review.