What spam backlinks look like on a small-business site (and what to do first)

By Keith Motte, Topofmind.AI. Former AWS Enterprise Support Manager (Healthcare and Life Sciences). Last updated Nov 4, 2026.

Short answer: a pile of strange websites linking to you is common, and it usually does not mean Google has punished your site. Google says that for known spam sites it "typically will ignore the links." [1] This week, export your links, sort them into patterns, check the Manual actions report, and write down what you found before you touch anything like a disavow file. [1][2]

What is a backlink, and why do I suddenly have so many bad ones?

A backlink is a link on another website that points to a page on your site. [1] Most local businesses, whether an HVAC company, a med spa, a realtor or a contractor, have a modest number of real ones: the chamber of commerce, a supplier, a local news story, a few directories.

Then one day you open Google Search Console (Google's free dashboard for your site) or a paid SEO tool, and the list of "referring domains" (separate websites linking to you) has jumped. Say, for illustration, from 40 to over 1,000. Most of the new names look like gibberish.

This happens to plenty of small sites. Spam networks link to huge numbers of sites automatically, scrapers copy pages that already link to you, and some tools count every copy as a new domain. You probably didn't cause it, and most of it isn't aimed at you.

What do spam backlinks look like?

These are the patterns worth flagging when you scroll the list. One of them alone proves nothing. Several together on the same domain are a good sign it's junk.

Foreign or unrelated domains. Sites in languages or countries you don't serve, or with no connection to your trade. A San Diego plumber linked from a foreign gambling blog is a mismatch, not a referral.
Odd anchor text. Anchor text is the clickable words in a link. Real links usually use your business name or your web address. Spam often uses exact keyword phrases like "best HVAC repair cheap" or wording that has nothing to do with you. Search Console's Top linking text report shows this, and Google suggests you check that the text is "not spammy." [1]
Private blog networks (PBNs). A PBN is a group of sites run by one owner mainly to create links. Look for many domains with the same template, thin posts, and links going out to every kind of business. Google's spam policies count "creating low-value content primarily for the purposes of manipulating linking and ranking signals" as link spam. [3]
Expired domains. An old domain (a closed school, a defunct charity) bought and filled with unrelated content. Google lists this as "expired domain abuse." [3]
Scraped content farms. Sites that copy other people's pages, often word for word, links included. Google's scraping policy covers republishing content "without adding any original content or value." [3]
Directory and bookmark junk. Low-quality directories with thousands of listings and no real visitors. Google names "low-quality directory or bookmark site links" as a link spam example. [3]

Does all this junk mean Google already punished me?

Usually not. A bad-looking report and a penalty are two different things.

Google's Links report help says that for known spam sites, "Google typically will ignore the links." [1]
Google's disavow guidance says that in most cases Google "can assess which links to trust without additional guidance, so most sites will not need to use this tool." [4]
If a person at Google does take action, it's called a manual action, and Google says it will notify you "in the Manual actions report and in the Search Console message center." [2]

So the first fact to check is simple: open Search Console, go to Security & Manual Actions, then Manual actions. A green check mark means no manual action is on your site. [2] A red "toxic score" from a third-party tool is that tool's opinion. It isn't a message from Google.

What should I do about spam backlinks this week?

This is the boring version, and boring is the point. You're building a record, not pressing buttons.

Check for a manual action. Search Console > Manual actions. Note the date and the result in a plain document. [2]
Export your links. In Search Console, open Links and use Export. You can download "Latest links" (most recently found, sorted by date) or "More sample links," up to 100,000 rows each, as a CSV or Google Sheet. [1] If you use a paid SEO tool, export its list too, and label each file with the date and source.
Know what the export is and isn't. Google says the report "isn't a comprehensive list of every link" and "includes links that Google has found over time," some of which may already be gone. [1] Treat it as a sample.
Flag patterns, not single links. Add a column to the sheet and tag each domain with the patterns above: foreign/unrelated, spammy anchor, PBN look, expired domain, scraper, junk directory. Sort by tag. You'll usually find a few clusters rather than hundreds of separate problems.
Mark anything you were involved in. This matters most. Did you or an SEO you hired ever buy links, swap links, or pay for "guaranteed backlinks"? Google's main example of links that can hurt a site is paid links or link schemes that you or an SEO you hired built. [3][4] Put those in their own group.
Keep the good ones safe. Highlight real links: local press, suppliers, associations, real customers. You don't want them caught in a cleanup later.
Write it down before you disavow anything. Record the date, what you exported, the patterns you found, and whether there's a manual action. If you ever do need Google's disavow tool, Google calls it "an advanced feature" that "can potentially harm your site's performance" if used incorrectly. [4] Your notes are what keep a later decision careful instead of panicked.

Where should I spend the time instead?

For most local businesses the better return is in what you control: a complete, accurate Google Business Profile, clear service pages, and steady real-world mentions from your community.

I automated a check for information gaps on the site, then wrote content to fill them. That kind of work is useful. Chasing every junk domain in a report usually isn't.

Frequently asked questions

Are spam backlinks hurting my local rankings?

Usually not. Google says it typically ignores links from known spam sites, and that most sites never need the disavow tool. [1][4] Check the Manual actions report in Search Console. If it's clean, there's no sign Google has acted against your site.

Can a competitor hurt my site by pointing spam links at it?

Google says that "in most cases" it can work out which links to trust without extra help, and that it "works very hard to make sure that actions on third-party sites do not negatively affect a website." [4] If you never bought or swapped links, the right move is usually to document and keep watching.

Should I trust the "toxic score" in my SEO tool?

Use it to sort the list, not to decide what to do. It's the tool's estimate, not Google's view. Google's own signals are the Manual actions report and its messages to you. [2]

How often should I check my backlinks?

For a typical local business, a quick look once a month is plenty. Export, compare against last month, and add notes. Act sooner if Search Console sends you a manual action message.

Sources for this page

Google Search Console Help: Links report. https://support.google.com/webmasters/answer/9049606
Google Search Console Help: Manual actions report. https://support.google.com/webmasters/answer/9044175
Google Search Central: Spam policies for Google web search (last updated Aug 28, 2026). https://developers.google.com/search/docs/essentials/spam-policies
Google Search Console Help: Disavow links to your site. https://support.google.com/webmasters/answer/2648487

Next step

If you'd like a second pair of eyes on the parts of local search you do control, start with the free Google Business Profile audit. If your backlink report has you worried and you want to talk it through, book a 30-minute Growth Call. You can also see how we approach local SEO and Google Maps. Want to build checks like this yourself? Join TopofmindAI Builders on Skool.