Toxic Backlinks and the Disavow Tool: When to Use It, and Why Google Says Almost Never

A disavow file is a plain-text list of domains and URLs you upload to Google Search Console to ask Google to ignore those links when it assesses your site. Most people go looking for it because a tool scored their backlink profile, or because someone selling the audit told them to. Google's own position is that most sites will not need the file, and that using it incorrectly can potentially harm their performance in Search. This is for the growth lead or SEO manager holding a list of allegedly toxic links: the two-condition test Google publishes, how to run it as a procedure, the seven situations that look like they qualify and do not, and what you can observe afterward.

The short version

• Google publishes the test as a conjunction, not a checklist. A considerable number of bad links and a manual action that has happened or is likely. One half alone is not a reason to file.
• Google's documentation says most sites will not need the tool, and calls it an advanced feature that can harm performance if used incorrectly. That is Google's wording, not a contrarian reading of it.
• The conjunction is easy to quote and harder to act on. The decision tree below turns it into a procedure, and for most readers it terminates in one step.
• A vendor toxicity score is evidence of neither condition. It is a model of a link graph, built by a company that also sells the audit.
• A proactive disavow is close to unfalsifiable once submitted, which is why the practice has stayed unaccountable for so long.

What is the disavow tool, and what does a disavow file actually do?

It asks Google to ignore specific inbound links when evaluating your site. Nothing is removed from the web and nothing changes on the linking sites.

The file itself is unglamorous. A .txt file, one entry per line, uploaded against a property in Search Console. Google's disavow links documentation sets out the format and the limits, and one detail catches people out repeatedly: uploading a new list replaces the existing one rather than adding to it. There is no append.

Two boundaries are worth drawing first, because conflating them causes real damage.

Disavow is not nofollow: rel="nofollow" and rel="sponsored" are attributes you put on links leaving your own pages. A disavow file is a request about links arriving at them. Different direction, different mechanism, different decision. Our guide on when to nofollow a link you are placing covers the outbound half.

Disavow is not link removal: the links stay live and keep showing up in third-party tools. A disavow changes what Google does with them, not what exists.

What does Google actually say about who should use it?

Very few sites, and only when two conditions hold at once. Google states the test in its help documentation as a numbered pair joined by an explicit AND:

"You should disavow backlinks only if: 1. You have a considerable number of spammy, artificial, or low-quality links pointing to your site, AND 2. The links have caused a manual action, or likely will cause a manual action, on your site."

The same page carries two sentences that are quoted less often and matter more. On who needs it: "In most cases, Google can assess which links to trust without additional guidance, so most sites will not need to use this tool." On the risk of using it: "This is an advanced feature and should only be used with caution. If used incorrectly, this feature can potentially harm your site's performance in Google Search results."

Google also names an order of operations. Its instruction is "First and foremost, we recommend that you remove as many spammy or low-quality links from the web as possible." The file is the fallback for what you could not get taken down, not the opening move.

None of this is a fringe position, and it is not our discovery. Google publishes it, and the strongest third-party guide we read on this topic reaches the same conclusion. What is missing is the step after quoting it: treating the conjunction as a gate you walk through. That is the next section.

How do you turn Google's test into an actual decision?

By checking the second condition first, because it is the cheap one. Whether your links look spammy is a judgment call that can absorb a week. Whether Google issued a manual action is a fact you can establish in under a minute, and it usually ends the exercise.

Open the Manual Actions report in Search Console. Google's documentation for that report describes it as the place to "See if your site has any manual actions issued against it and view the site's manual action history." The action that concerns inbound links is named "Unnatural links to your site", described as "a pattern of unnatural, artificial, deceptive, or manipulative links pointing to your site." If the report shows no issues, condition two is not met, and the conjunction fails regardless of what any tool says about condition one.

Four branches, and the evidence that puts you in each:

Your situation	Evidence in Search Console	Do this	Do not do this
1. No manual action, no link-buying history you know of	Manual Actions report shows no issues detected	Nothing. Close the tab and spend the time on something that compounds	Do not build a file "just in case", and do not pay for an audit whose only output is a file you should not submit
2. A manual action naming unnatural links to your site	Manual Actions report names "Unnatural links to your site", with a stated scope	Follow Google's documented sequence: export your links, check them against the spam policies, ask site owners to remove or unfollow them, disavow only what you could not get removed, then request a review	Do not skip removal and jump to the file. Google names removal first for a reason, and a reviewer can see the difference
3. A documented link-buying history you inherited	No manual action, but real evidence outside Search Console: invoices, an agency handover, a network footprint, a domain you bought with a past	The one genuine judgment call. Scope the file to the campaign you can document, and comment each block	Do not extend it past what the evidence covers. "While we are in here" is how a file starts discounting links that were working
4. Traffic fell and none of the above applies	Manual Actions report clean; the drop lines up with a confirmed update, a deploy, a migration, or a seasonal pattern	Diagnose the actual cause. A drop with a clean report is not a link problem until something says it is	Do not use a disavow as a recovery lever. It is the hardest change to take back and the least likely to be the cause

Branch 1 is where most readers land, and it is the branch that gets abandoned under commercial pressure. In my experience, the most effective approach is to treat a clean Manual Actions report as a genuine answer rather than the absence of one. Doing nothing is a decision with a rationale behind it, and far easier to defend before you have spent three weeks on a spreadsheet than after.

Branch 2 is worth reading in Google's own words. The Manual Actions documentation puts removal ahead of filing: "contact the owner of that site and ask that they either remove the links or prevent them from passing PageRank", then "disavow any links that you could not get removed", and only then request a review. Confirming you are actually in branch 2 comes first, and our guide to checking the Manual Actions report first covers where that check sits in a wider diagnosis.

What is a toxicity score, and should you act on one?

It is a vendor's model of your link graph, and it is evidence of neither condition in Google's test. Backlink tools compute a score from features they can observe: the linking domain's own metrics, its outbound link patterns, anchor-text distribution, topical distance, indexation. That is a reasonable thing to build. It is also an inference about Google's behavior, made from outside Google.

The gap that matters sits between "this link looks low quality to a model" and "Google has acted on this link". Google's documentation says it can usually assess which links to trust without guidance. A score does not tell you whether that assessment went against you. The Manual Actions report does.

There is an incentive worth naming, and it applies to us too. Toxicity scores are, with few exceptions, produced by companies whose business includes selling the backlink audit that surfaces them, so the metric and the remedy come from one vendor. That is not an accusation of bad faith, and the scores are not worthless. It is a reason to read one as a prompt rather than a verdict. Our own position is the mirror image and deserves the same scrutiny: GrowthHasten sells the service and not a tool here, so our incentive runs toward talking you out of a file and into acquisition work.

During our technical audits, a high toxicity score is a reason to open the report and look at what got flagged. It is never, by itself, a reason to file. For which backlink tools are worth paying for and which layer of the work they cover, our guide to what to buy, and when goes through them.

The rule fits in one line: a score sends you to look, the Manual Actions report tells you whether to act.

Seven situations that look like they need a disavow and do not

These are the patterns that send people to the tool, and none of them satisfies Google's test on its own. Each has a real fix, and in several cases the real fix is nothing.

What it looks like	What it actually is	The real fix
Sites you have never heard of linking to you, with your own article text around the link	Scrapers republishing your content, internal links included. A side effect of the copying, not an attack	Nothing about the links. If a copy outranks the original, that is a duplication and canonicalization question
An expired domain redirecting into your site	Either someone bought a lapsed domain and pointed it at you, or an old domain of your own still redirects and nobody remembers setting it up	Establish which. If it is yours, audit the redirect. If it is not yours and genuinely spam, this can belong in branch 3, evidence permitting
Hundreds of directory and aggregator listings appearing at once	Automated directories that list every domain they can discover. Your competitors are in there too	Nothing. A link everyone gets distinguishes nobody, in either direction
A sudden spike of links with keyword-stuffed anchors from unrelated sites	Possibly a competitor, possibly a link network that scraped a list you were on	Monitor and document. The next section covers what Google publishes about this
A backlink tool reporting a high toxicity score and a long list of flagged domains	A model output from a vendor. Not a statement about what Google did	Read the list, learn something about your profile, check the Manual Actions report. Then almost certainly do nothing
Traffic dropped inside the window of a confirmed core update	A relative reassessment, not a penalty and not a link problem	Improve what the reassessment is judging. Our guide explains why a core update is not a penalty
Rankings slipped and your referring domain count fell with them	Lost links, the opposite problem. Something you had stopped pointing at you	Find out what happened: pages deleted, sites redesigned, resource lists pruned. A disavow makes this strictly worse

The pattern across all seven: the profile looks alarming and nothing in Search Console has changed. That combination describes a normal link profile on the open web, not a diagnosis.

Can a competitor hurt your site with bad links?

Google says it works to prevent exactly that, and its disavow documentation says nothing about whether a spam attack is a reason to file. Both halves matter.

On the general question, Google's guidance on competitors and your site's ranking states: "Google works hard to prevent other site owners from being able to harm your ranking or have your site removed from our index." Its advice about one specific link is procedural rather than technical: "If you're concerned about another site linking to yours, we suggest contacting the owner of the site in question."

On the specific question, the honest answer is that the disavow documentation does not address competitor link attacks at all. It gives the two-condition test, the format rules and the caution, and says nothing about negative SEO. So anyone telling you Google has confirmed that a defensive disavow is the right response to a spam attack is describing something Google has not documented. That absence is itself informative, and more reliable than a half-remembered quote from a video.

What to do if you genuinely think it is happening: keep a dated record of the spike, keep checking the Manual Actions report, and do not file. A spam attack that has produced no manual action fails condition two, so filing puts you outside Google's stated use case while taking on the risk its documentation warns about. If a manual action does arrive, you are in branch 2 with evidence and a documented route.

How do you build and submit the file, if you have decided to?

The mechanics come last on purpose. They are the easy part, and the part most likely to be skimmed straight into action. Google's documentation is the reference for all of it, and the limits change without notice, so read the source rather than a summary when you do the work.

The format: a text file encoded in UTF-8 or 7-bit ASCII, with a file name ending in .txt. One URL or domain per line.

Domain versus URL entries: a bare URL disavows that page. A line prefixed with domain:, for example domain:example.com, disavows the domain or subdomain. Google is explicit that you cannot disavow a subpath such as example.com/en/, so the real choice is between one URL and a whole domain.

Comments: lines beginning with # are ignored by Google. Use them. The reasoning behind each block is the only thing that makes the file auditable by whoever inherits it, including you in eighteen months.

The limits, as Google currently documents them: maximum URL length 2,048 characters, and a maximum file size of 100,000 lines (blank and comment lines included) and 2MB.

Replacement, not append: uploading a new list for a property replaces any existing list for that property. Upload a five-line file over a previous four-hundred-line file and you have just re-avowed three hundred and ninety-five domains.

How do you know whether it worked?

In branch 2 you can tell. Outside it, you mostly cannot, and that gap is where this section spends its time.

After a manual action there is something observable: you request a review, and the report either clears or does not. Google notes that "Most reconsideration reviews can take several days or weeks, although in some cases, such as link-related reconsideration requests, it may take longer than usual." Slow, but a real signal with a real state change behind it.

A proactive disavow gives you nothing comparable. Search Console confirms the upload, and that is the last thing it tells you. There is no report of which links were discounted, no before-and-after, and no way to separate "the file helped" from "the file did nothing" from "the file discounted links that were helping". Google says only that "It can take a few weeks for Google to incorporate your list into the index as Google recrawls the web and reprocess the pages that we see", so even the timing of any effect is unfixed.

So if traffic rises six weeks later, you have a coincidence and a story. If it falls, you have the same coincidence with a worse story and no way to know whether the file caused it. Reversal exists on paper: Google documents a Cancel Disavowals control, and clicking it means "The disavowal list for the selected property will be removed." But undoing runs on the same slow reprocessing as submitting, so it is useless as a fast rollback.

That unfalsifiability is why the practice persists. A recommendation nobody can grade is a recommendation nobody has to be right about, which argues for demanding more evidence before acting, not less.

What should you do instead?

Spend the effort on the acquisition side, where the work is measurable and the mistakes are cheap. Nearly every hour that goes into a disavow file is an hour that produced no link, no coverage and no citation.

Learn what actually violates the policy: Google's spam policies define link spam as "the practice of creating links to or from a site primarily for the purpose of manipulating search rankings", then list the patterns, from paid links and excessive exchanges to advertorials and widget links. That list is a better use of an afternoon than scoring your backlinks, because it tells you what not to build. Our guide covers the difference between earned links and link schemes in practice.

Recover the lost links instead: the referring domains you used to have and no longer do are traceable, attributable, and cheap to chase, because you know the page, the site, and what used to be on it.

Build the assets that earn coverage: original data, working tools, and genuinely useful references get linked without an outreach campaign behind every placement. That is the slow half of authority you earn rather than links you buy, and the half that survives every algorithm change.

The habit worth building is narrow and it transfers: treat a link-risk claim like any other claim, and ask what evidence supports it before acting. "A tool gave it a score" is not evidence. "Google issued a manual action naming unnatural links" is.

This week, open the Manual Actions report in Search Console and confirm it is empty. That takes about thirty seconds and settles the question for almost everyone reading this.