Backlink Audit: The Step-by-Step Walkthrough We Use (Inventory → Quality Pass → Action)
A backlink audit has four steps: export every link pointing at your site from Google Search Console plus one paid tool, record five baseline numbers, run each significant referring domain through a quality check, then sort every domain into one of three buckets — keep, watch, or disavow. This guide walks through each step with exact Ahrefs click paths.
The method is tool-agnostic — the logic works identically in Semrush, Moz, or Majestic — but the examples use Ahrefs because that's what we vet with. Expect a first audit to take an afternoon for a small site, longer if you've bought links before.
TL;DR:
- A backlink audit is a systematic review of every link pointing at your site to find what's helping, what's dead weight, and what's risky.
- Export from Google Search Console and a paid tool — no single index sees all your links.
- Baseline five numbers first (referring domains, backlinks, dofollow share, anchor mix, velocity) so the next audit has something to compare against.
- Judge domains with the same 6-check SOP used to vet new placements: real DR, organic traffic, relevance, outbound profile, trend, human ownership.
- Sort everything into keep / watch / disavow. Most sites should disavow little or nothing — Google already ignores most junk links.
What is a backlink audit?
A backlink audit is a systematic review of every link pointing at your website to determine which links help your rankings, which do nothing, and which carry risk. It's the same vetting you'd apply before buying a link — applied retroactively to links you already have, including ones you never asked for.
That last part matters. Every site accumulates links it didn't build: scrapers, aggregator sites, spam directories, sometimes a competitor's negative SEO experiment. An audit separates the profile you built from the profile you have, and tells you whether the gap needs action. It also produces a byproduct most people skip past: a list of your most-linked pages and strongest referring domains, which is the raw material for your next link building campaign.
An audit is not the same as ongoing backlink analysis — analysis is the continuous monitoring habit, the audit is the periodic deep clean. You need both, but the audit comes first because it creates the baseline everything else measures against.
How often should you do a backlink audit?
Twice a year covers most sites. Move to quarterly if any of these apply: you're actively buying links, you inherited the site from a previous agency or owner, you recently migrated domains, or you've noticed ranking drops you can't explain with content or technical issues.
There are also event triggers that justify an immediate audit regardless of schedule: a manual action notice in Google Search Console, a sudden spike in referring domains you didn't build (check the referring domains growth chart — organic profiles grow in a rough slope, attacks and bought links grow in cliffs), or before you invest in a serious link building campaign, because new links on top of a compromised profile are money half wasted.
Step 1: Build a complete backlink inventory
No single tool sees every link. Google Search Console shows a sample of what Google itself has found; Ahrefs, Semrush, and Moz each crawl their own index with their own blind spots. For an audit you want the union, so pull at least two sources:
- Google Search Console (free): Links → Top linking sites → Export. This is the closest thing to Google's own view of your profile, and the only source that matters for manual-action risk.
- Ahrefs: Site Explorer → your domain → Referring domains report → Export. Work at the domain level, not the individual-backlink level — a site with 40,000 backlinks might have only 900 referring domains, and 900 rows is an afternoon's work where 40,000 is a month's.
Merge the two exports in a spreadsheet, dedupe by domain, and add three working columns: verdict (keep / watch / disavow), reason, and date checked. That spreadsheet is the audit — everything from here fills it in.
One scoping rule keeps this manageable: you don't need to hand-review every domain. Sort by domain traffic or DR and hand-review the top of the list plus anything that looks anomalous (weird TLDs, foreign-language domains, suspiciously exact-match anchors). The long tail of one-link, zero-traffic domains gets pattern-checked in bulk at Step 4, not reviewed row by row.
Step 2: Baseline your profile with five numbers
Before judging individual links, record the shape of the whole profile. These five numbers take ten minutes to collect and turn your next audit from guesswork into a comparison:
| # | Metric | Where in Ahrefs | What a red flag looks like |
|---|---|---|---|
| 1 | Referring domains | Site Explorer → Overview | Sudden cliff up (bought/attack) or down (lost links) |
| 2 | Total backlinks | Site Explorer → Overview | Backlinks-to-domains ratio in the hundreds (sitewide spam) |
| 3 | Dofollow share | Backlinks report → dofollow filter | No universal target — just note big shifts between audits |
| 4 | Anchor text mix | Site Explorer → Anchors | Exact-match commercial anchors dominating the top of the report |
| 5 | Link velocity | Referring domains growth chart | Spikes you can't tie to a campaign or PR event |
Two of these deserve a closer look while you're there. The Anchors report is the fastest tell of a manipulated profile: healthy profiles are dominated by branded and URL anchors, while profiles built carelessly are dominated by money keywords — our anchor text ratio guide covers what a natural mix looks like. And link velocity — the pace you gain and lose links — is where negative SEO shows up first, usually as a spike of new referring domains with no matching campaign on your side.
While you're in the exports, flag one more thing: your most-linked pages that return 404. Links pointing at dead pages are equity you already earned and are currently throwing away; a 301 redirect to the closest live page reclaims them. In most first audits we run, this is the single highest-ROI fix on the list — it costs nothing and needs no outreach.
Step 3: Run the quality pass with the 6-check SOP
Here's where most audit guides get vague — "identify toxic links" — and where audit tools sell you an automated toxicity score instead. Scores are a shortlisting aid, not a verdict. The verdict comes from checking the domain itself, and the checks are exactly the same six we run before paying for any placement. The full click-by-click version is in our how to check backlink quality guide; here's how each check reads when you point it at your own referring domains:
- Is the DR real? A DR 60 referring domain propped up by a link network is worth nothing and signals nothing good about the neighborhood you're in. Check who links to it.
- Does it have organic traffic? A linking site with zero organic visits isn't sending you referral value and isn't trusted by Google either. Sort your referring domains report by domain traffic — the zero-traffic band at the bottom is where your watch and disavow candidates live.
- Is it relevant to your niche? Links from sites in your topic area count more; a profile made mostly of off-topic links is the classic footprint of bought placements.
- What does its outbound profile look like? If the site links out to casinos, essay mills, and crypto exchanges alongside you, it's selling links — that's a link farm pattern, whatever its DR says.
- Is its traffic trend stable? A referring domain that lost most of its traffic in a core update was probably devalued; the link likely passes little.
- Does a human run it? No named authors, thin AI posts on every topic, no contact page — the standard farm footprint.
A domain doesn't need to ace all six to keep — most legitimate small sites fail check 2's traffic bar. What you're looking for is domains that fail multiple checks in the pattern of link schemes, because Google's spam policies target exactly those patterns: paid links passing ranking credit, link networks, and large-scale automated placements.
Step 4: Sort every domain into keep, watch, or disavow
Every row in your spreadsheet gets one of three verdicts. This triage is the deliverable of the whole audit:
| Verdict | Criteria | Action |
|---|---|---|
| Keep | Passes the SOP, or is an ordinary harmless site (small blogs, directories with some editorial standard, forums, scrapers copying your content) | Nothing. Note your best domains — they're outreach models for future campaigns |
| Watch | Fails 1–2 checks but shows no scheme pattern: zero-traffic blogs, odd but single foreign links, borderline directories | Recheck next audit. Google ignores most of these on its own |
| Disavow | Clear scheme patterns at scale: link networks, farms with commercial exact-match anchors, hacked-site spam, or paid links you can't get removed | Removal request first if the volume is small; disavow file for the rest |
The distribution matters more than any single row. In a healthy profile, keep dominates, watch is a modest tail, and disavow is nearly empty. If disavow is a large share of your profile — typically the aftermath of cheap bought links or a previous agency's shortcuts — the audit has told you something bigger than a cleanup task: the profile needs rebuilding with vetted links, not just pruning.
For the watch bucket, resist the urge to promote entries to disavow "just in case." Since Penguin became part of Google's core systems, the default handling for garden-variety spam links is to ignore them, not penalize you for them. Acting on links Google already ignores is work with no upside and some downside.
When should you actually disavow?
Rarely, and Google says so itself. The disavow documentation is explicit that the tool is for sites with a manual action for unnatural links, or a likely incoming one because of large-scale paid or scheme links — and that most sites should never need it. Disavowing normal low-quality links doesn't help rankings; it just risks disavowing something that was quietly passing value.
If you do meet the bar, the mechanics are simple: a plain-text file, one domain:example.com line per domain (domain-level beats URL-level — spam sites shuffle URLs), uploaded through the disavow tool in Search Console. Keep the file under version control, because uploads replace the previous file entirely. Expect effects, if any, to take weeks to months as Google recrawls the disavowed pages. Our toxic backlinks guide covers the judgment calls — including why tool "toxicity scores" flag far more links than Google actually cares about.
The one scenario where disavow is urgent rather than optional: a manual action notice in Search Console. Then the disavow file plus a documented removal effort is your reconsideration-request evidence, and speed matters.
What do you do with the audit after it's done?
Three outputs are worth acting on the same week. First, redirect the 404 pages that hold links — the free equity reclaim. Second, take your keep-bucket standouts and note why they linked; that's your template for earning more of the same. Third, if the audit exposed a thin or damaged profile, fix the inflow problem before the next audit: every new link should pass the same six checks the audit judged the old ones by.
That last step is the difference between auditing once and auditing forever. A profile built from vetted placements — real traffic, real relevance, real sites — barely generates disavow candidates in the first place. That's the entire premise of how we build links: every niche edit and guest post placement passes the 6-check SOP before you pay, with the Ahrefs data shown as proof.
FAQ
How long does a backlink audit take? For a site with a few hundred referring domains, plan half a day: an hour for exports and baseline numbers, a few hours for the quality pass on your top domains, and an hour for triage and actions. Sites with tens of thousands of referring domains need the pattern-based bulk approach and can take several days.
Can I do a backlink audit for free? Mostly, for your own site. Google Search Console exports your linking sites free, and Ahrefs Webmaster Tools shows backlinks, anchors, and referring domains for verified sites at no cost. What free tooling lacks is depth on the linking domains — their traffic, keywords, and outbound profiles — which is what the quality pass needs.
What percentage of bad backlinks is dangerous? There's no published threshold, and isolated junk links are normal — every site has them and Google ignores them. Risk comes from patterns, not percentages: a profile where scheme-type links (networks, farms, paid exact-match anchors) form a visible share of the whole is what triggers manual actions.
Will disavowing links improve my rankings? Usually not directly. Disavow removes (potential) negatives; it doesn't add positives. Sites recovering from manual actions or genuine large-scale link spam can see rankings recover after cleanup, but a site with an ordinary profile disavowing "toxic-scored" links typically sees no change at all.
What's the difference between a backlink audit and backlink monitoring? An audit is a periodic full review — inventory, baseline, quality pass, triage — done a couple of times a year. Monitoring is the ongoing habit of watching new and lost links weekly or monthly so problems surface between audits. The audit sets the baseline; monitoring guards it.
Want a profile that never needs a painful cleanup? See our pricing — every link we place passes the same 6-check SOP this audit uses, and you see the proof before you pay.