A good share of the sites that come to us arrive carrying somebody else’s link building. Usually the story is the same: an agency promised volume, delivered it, the site did well for a while, and then a core update took back more than it gave.
The work of cleaning that up is methodical rather than clever. Here is the process, and the parts of it people usually get wrong.
First, confirm links are actually the problem
This step gets skipped constantly. Traffic can fall for many reasons: a redesign that broke internal linking, a migration that lost redirects, a competitor improving, a seasonal cycle, or a core update that reassessed content quality rather than links.
Line the traffic drop up against known update dates, against your own release history, and against the pages that lost the most. If the losses are concentrated on pages that were aggressively linked, links are a plausible cause. If they are spread evenly across the site including pages nobody ever linked to, look elsewhere first.
Also check Search Console for a manual action. A manual action is a completely different situation from an algorithmic one, and it comes with a reconsideration process.
Manual action or algorithmic? The two are not the same job
It is worth being precise about this, because the two situations call for different work and different expectations.
A manual action means a person at Google reviewed your site and applied a penalty. It appears in Search Console under Manual Actions, it names what triggered it, and it does not go away on its own. Removal effort genuinely matters here: you will be writing a reconsideration request, and it needs to show what you did rather than assert that you are sorry.
An algorithmic problem is quieter. Nothing appears in Search Console at all. The system simply stops counting links it does not trust, and whatever those links were holding up settles back down. There is no request to submit and nobody to appeal to — the recovery happens through recrawling, which is why it takes as long as it does.
Most sites we see are in the second category. That is better news than it sounds: there is no penalty to serve, only an inflated position to earn back honestly.
Build a complete picture of the profile
No single tool sees every link. Export from Search Console, which is authoritative for what Google knows, and from at least one third-party index for the detail Search Console does not give you. Deduplicate by referring domain — you are going to make decisions at domain level, not link level.
Classify by hand, at domain level
Automated “toxicity scores” are a starting point and nothing more. We have seen them flag legitimate industry publications and pass obvious link farms. Sort by referring domain and put each into one of three buckets:
- Keep. Real sites with real audiences, whether or not the link is doing much for you.
- Remove. Clear manipulation: link networks, sites that exist only to sell placements, irrelevant foreign-language directories, comment and forum spam, sitewide footer links across unrelated domains.
- Unsure. Low quality but plausibly organic. Leave these alone on the first pass.
The “unsure” bucket matters. Over-disavowing is a real risk, and it is one you cannot easily see, because you never find out what the removed links were contributing.
When not to disavow at all
Worth saying plainly, because the file gets reached for far too readily: most sites do not need one.
Search engines have spent years getting better at simply ignoring links they do not trust, rather than punishing the site those links point at. If nobody working on your site ever bought links, and there is no manual action, a handful of scrapers and spam directories in your profile is normal and requires nothing from you. Every site has them.
The disavow file is for the case where something deliberate was done — by you, by an agency you hired, or by somebody attacking you. Outside that, uploading one is at best a placebo and at worst a way to remove links that were quietly helping.
Try removal before disavowal
For a manual action, Google wants evidence of genuine removal effort, so email the sites and keep records. For an algorithmic problem it matters less, and chasing removals from spam networks is largely wasted time.
Either way, keep a log of what you asked and what happened. It costs nothing and it is the only proof you have.
Disavow carefully
Disavow at domain level with domain: entries rather than listing individual URLs — spam sites generate new URLs faster than you can list them. Upload one file containing everything you want disavowed; each upload replaces the previous file entirely, so it must be cumulative.
Keep the file in version control or somewhere you will still have it in two years. The number of sites that have lost their own disavow file is remarkable.
A realistic timeline
This is the question every client asks, and a vague answer helps nobody. Broadly, for an algorithmic situation:
- Weeks one to four. Nothing visible. The file has been accepted; the domains in it have not been recrawled yet.
- Months two to four. The first movement, usually uneven — some pages recover before others, and a few may dip further as the profile is reassessed.
- Months four to nine. Where most of the recovery actually lands, assuming legitimate work has been running alongside it.
A manual action can resolve faster once a reconsideration request is accepted, sometimes within weeks — but only if the request is convincing, and a rejected one costs you another round.
And an honest caveat: the site may not return to where it was. If the previous position was built on links that should never have counted, the recovered position is the real one. That is a difficult conversation to have and a necessary one.
Then be patient, and rebuild
Do not upload a file, see no change in a fortnight, and start adding more domains out of frustration — that is how sites end up over-disavowed.
Meanwhile, do the constructive half. A profile recovers faster when legitimate links are arriving alongside the cleanup, and the content and technical work you do during the wait is what the site will rank on afterwards. Our standard for what counts as legitimate is set out in why link quality still beats link quantity.
We run this audit as the first stage of any off-page SEO engagement where a site has history. If you are not sure what you have inherited, ask us for a free review.