Toxic Backlinks: What Google Actually Says

Name: Web60
Address: Block B, Maynooth Business Campus, Straffan Rd, Maynooth, Co. Kildare, W23 W5X7, IE
Price range: €60/year

Your website has toxic backlinks, and unless somebody finds them and disavows them, Google will push you down the rankings. That is the myth. The pitch arrives as a friendly free audit, a red warning in an SEO dashboard, or a cold email offering a clean-up for a monthly fee. It sounds technical, urgent and plausible.

Mostly, it is wrong.

This autumn gave it fresh legs. Google's September 2026 spam update finished rolling out in early October, rankings wobbled for some sites, and the scare emails followed the wobble the way they always do. So it is a good moment to take the myth apart one piece at a time, using what Google itself has said rather than what anyone selling a clean-up says on its behalf.

Myth One: Google Keeps a Toxic Score on Your Site

It does not. "Toxic" is not a Google term at all. It is a label invented by third-party SEO tools, which crawl the web, guess which of the links pointing at you look low quality, and give each one a score.

Google's John Mueller has been unusually blunt about this. In May 2024, Search Engine Roundtable reported his reply to a site owner on Reddit who had been told by one of these tools that roughly a quarter of their backlinks were toxic. "The concept of toxic links is made up by SEO tools so that you pay them regularly," he wrote. That was not a one-off remark either. In December 2024, the same publication reported Mueller describing the disavowing of links flagged as toxic by some SEO toolsets as a billable waste of time.

Google's own help page for the disavow tool says the same thing in calmer language: "In most cases, Google can assess which links to trust without additional guidance, so most sites will not need to use this tool." What does that mean for you? The red number in the report is a vendor's opinion. It is not a reading taken from inside Google, and nobody at Google is looking at it.

Myth Two: Spammy Links Drag You Down

The fear makes intuitive sense. A dodgy directory in another country links to your site, so surely some of the dodginess rubs off on you? Google built its systems around the opposite assumption. When it launched the December 2022 link spam update, the Search Central blog explained that SpamBrain, its AI-based spam-prevention system, would be used "to neutralize the impact of unnatural links on search results." Neutralise is the operative word. The link is not held against you. It is ignored, and whatever value it might have passed is thrown away.

Every website that has been online for a few years collects junk links. Scraper sites copy your pages. Directories list you without asking. Spam blogs link to everything in sight. That noise is the background hum of the web, and filtering it out is precisely what SpamBrain was built to do.

In practical terms, the worst case for nearly all the junk pointing at a small business site is that it counts for nothing. You lose nothing by leaving it alone. You can lose quite a lot by panicking about it, which brings us to the part of the myth that actually costs money.

Myth Three: Disavowing Is Harmless Housekeeping

The disavow tool lets a site owner upload a list of links and ask Google to ignore them. It sits inside Search Console, behind a warning that is easy to scroll straight past. Google's help page is plain about the risk: "This is an advanced feature and should only be used with caution. If used incorrectly, this feature can potentially harm your site's performance in Google Search results."

That harm is not theoretical. In September 2026, Search Engine Roundtable covered a Reddit thread from a site owner who had accidentally disavowed valuable backlinks and then watched their rankings fall. Mueller's reply was measured. The tool "has its place & time, it does have effects," he wrote, and he suggested cutting the file back to only what is genuinely needed, even if that means leaving it empty. He was also fair about scale: "disavowing a handful of links is not going to make your site drop out of search." The damage comes when the list is long, or when it contains the links that were quietly doing the work.

How it goes wrong for a local business

Consider a hypothetical physiotherapy clinic in Mayo. Over the years it has picked up a few genuinely useful links: a local radio station's page about a sports injury segment, the sponsors page of the GAA club whose jerseys carry its logo, a regional health directory. To an automated tool, a page crowded with sponsor logos and a small directory can both look suspicious. They land on the toxic list. A contractor uploads the list.

Nothing happens at first, because Google says a disavow file can take a few weeks to be processed. Then the clinic slips on the searches that bring in new patients, and booking enquiries thin out just as the winter football injuries start arriving. Nobody connects the two. By then the disavow file is one forgotten line on an invoice.

The links the tool called toxic were the best links the clinic had.

A disavow file cannot tell a junk link from a good one. It removes whatever is on the list.

Myth Four: September's Spam Update Was About Your Links

The timing of the scare emails is no accident. Google released the September 2026 spam update on 24 September, saying it "applies globally and to all languages" and that the rollout "may take up to two weeks to complete." Its Search Status Dashboard shows it running for just under a fortnight, which puts the finish at around 7 October. According to Search Engine Roundtable's coverage, it was not a link spam update.

That matters if your traffic dipped in late September. The pitch will tell you bad links caused it. Spam updates sharpen Google's automated detection of practices that break its spam policies, and those policies do list link schemes that would genuinely put a site at risk, buying or selling links for ranking purposes among them. A stranger linking to you is not on that list. If you have not been running a scheme, a drop in that window is more likely to be coincidence, a seasonal dip or a technical fault.

Mueller's advice in the September thread pointed the same way: look for broader updates and rule out major technical problems first, such as accidentally blocking the whole site from search. He also warned that recovering from algorithmic changes can take many months. For a wider look at how these large ranking updates land on smaller sites, see what happened when Google's March 2026 core update finished rolling out.

When Disavowing Is Genuinely the Right Call

None of this makes the tool useless. Google describes exactly when it applies, and the bar is specific. Disavowing makes sense when you have a considerable number of spammy, artificial or low-quality links pointing at your site, and those links have caused, or are likely to cause, a manual action. Even then, Google says to try to get the links removed at source first.

A manual action is a human reviewer at Google deciding that your site breaks the spam policies. Nobody has to guess whether one exists. The Manual actions report in Search Console names it, and Google sends a message to the Search Console message centre as well. The one that concerns links is called "Unnatural links to your site."

Who genuinely needs one

That leads to the honest concession. If you, or a marketing contractor you once hired, paid for links in bulk, you may well have a problem worth cleaning up. We have written about why buying backlinks usually costs small businesses twice, and a business that went far down that road, particularly a larger site with an in-house marketing team running years of link-building campaigns, may need a carefully maintained disavow file and a competent specialist to manage it. That is a real job. It is just not the job most local businesses have.

One limitation is worth stating plainly. No hosting company can do anything about links on other people's websites, us included. Hosting looks after your site. The web of links pointing at it belongs to everyone else.

Verify Before You Pay Anyone

When the next audit email lands, three free checks will tell you most of what you need to know:

Open the Manual actions report. It sits under Security and Manual Actions in Google Search Console. Google says a site with no manual actions sees a green check mark, and a green check mark means there is nothing for a disavow file to fix.
Look at who actually links to you. The Links report in Search Console lists your top linking sites. If you recognise local press, suppliers, associations and clubs, those are assets. Do not let anyone put them on a list.
Ask the sender one question. Which manual action does my site have? If the answer is a toxicity score instead of a Search Console screenshot, you have learned what you needed to.

Where the Money Is Better Spent

Links still matter. The useful ones come from being worth linking to: a supplier listing you as a stockist, a local paper covering your expansion, a trade association directory you belong to. None of that needs a disavow file. It needs a website people are happy to send visitors to.

There is one link problem you can genuinely control, and it lives on your own site. Google's spam policies describe hackers injecting hidden links into compromised sites, links that search engines can see but owners miss. A site carrying hidden spam links for months has a real ranking problem, and a backlink audit will not flag it, because those links point away from you. That is how a small business website ends up properly tangled up with spam: not through who links to it, but because somebody broke in and used it.

What to expect from your host

The standard to hold any host to is prevention plus a clean way back: a hardened server, intrusion blocking, routine malware scanning and verified backups you can roll back to. Web60 is built to that standard, with server-level security hardening, fail2ban intrusion prevention, automatic malware scanning and nightly backups with one-click restore, all inside Web60's €60/year all-inclusive hosting with no separate security add-on. In plain terms, if something does get in, you roll back to last night's clean copy instead of finding out from a Search Console email weeks later.

It is also full WordPress, the platform W3Techs counts on roughly four in ten of all websites, so the site is yours to inspect and change whenever you like. If you are starting from scratch, the AI builder takes a description of your business and produces a fully designed WordPress site in under a minute, and the money you did not spend on a link clean-up stays in the business.

The Upshot

The word toxic does a lot of work in those emails. It turns ordinary web noise into contamination, and it turns a free Google report into something you apparently need to pay someone to read. Google has said, repeatedly and in writing, that most sites never need to disavow anything and that the tool can hurt the very site it is meant to protect.

So when the next report tells you hundreds of your links are toxic, open Search Console first. If the Manual actions report shows a green check mark, you can close the email, leave the links alone and spend that time giving people a better reason to link to you.

Frequently Asked Questions

What are toxic backlinks?

Toxic backlinks is a label used by third-party SEO tools for links they judge to be low quality or spammy. It is not a Google term. Google's John Mueller has said the concept of toxic links is made up by SEO tools, and Google's own documentation says its systems can usually work out which links to trust without any help from the site owner.

Should I disavow toxic backlinks?

Usually not. Google's disavow documentation says most sites will not need the tool and warns that using it incorrectly can harm your performance in search. It is meant for sites with a considerable number of spammy or artificial links that have caused, or are likely to cause, a manual action, typically because links were bought or built through a scheme.

How do I know if my site has a manual action from Google?

Open Google Search Console and go to the Manual actions report under Security and Manual Actions. If there are no manual actions, Google shows a green check mark. If there is one, the report names it, and Google also sends a message to the Search Console message centre. The action that concerns links is called Unnatural links to your site.

Can a competitor hurt my rankings by pointing bad links at my site?

Since its December 2022 link spam update, Google has used its SpamBrain system to neutralise the impact of unnatural links, which means they are ignored rather than counted. If you ever see a manual action for unnatural links appear in Search Console, that is the point to act. Without one, leaving strange links alone is normally the right call.

Did the September 2026 spam update affect small business websites?

Google said it applied globally and to all languages, so every site was in scope, and its status dashboard shows it ran from 24 September 2026 for just under a fortnight. Coverage of the update indicated it was not a link spam update. If your traffic fell in that window, check Search Console for manual actions and technical errors before assuming links were the cause.

Toxic Backlinks and the Disavow Tool: What Google Actually Says