You inherited a backlink profile. Now audit it properly
A new client hands you a site, a login, and no documentation. Somewhere in the last four years, someone bought links. Here is a calm order of operations — and why disavow belongs at the end, not the beginning.
Published August 16, 2026
Inheriting a link profile is uncomfortable because you are accountable for decisions you did not make and cannot see. The instinct is to disavow anything that looks bad. That instinct is usually wrong, and it is occasionally catastrophic.
Step 1: get the full list before you judge any of it
Pull from more than one source. Google Search Console is authoritative about what Google has actually seen; third-party crawlers see things Search Console omits and miss things it includes. Two sources beat one, and the union is what you audit.
Deduplicate by domain, not by URL. Forty links from one site is one relationship, one risk and one decision — treating it as forty inflates every number you are about to calculate.
See Linkprofile
Import once, checked weekly — removed, redirected and nofollowed links surface on their own.
Step 2: separate what you can control from what you cannot
Split the profile into three piles before assessing quality:
- Bought — placements someone paid for. You can stop buying more, and sometimes have them removed.
- Earned — editorial mentions, PR pickups, genuine citations. Leave them alone.
- Automatic — scrapers, aggregators, directory spam that arrives at every site. Almost always harmless and almost always what people panic about.
The third pile is the one that makes an inherited profile look terrifying. Every site on the internet accumulates junk links; Google has spent a decade learning to ignore them. Their presence is not evidence of a problem.
Step 3: assess the bought pile on three questions
For each bought placement, ask: does the site have real readers, is the link contextually plausible, and does the anchor look like something a human would write?
| Signal | Fine | Concerning |
|---|---|---|
| Traffic | Consistent organic traffic | Authority score with no traffic behind it |
| Outbound pattern | Links out occasionally, in context | Every post links out to a different industry |
| Anchor | Brand, URL or natural phrase | Exact-match commercial phrase, repeated |
| Content | Written for a reader | Written to hold a link |
A placement can fail one of these and still be fine. Failing three is a pattern, and patterns are what get evaluated.
Step 4: check the anchor distribution, then check your maths
Calculate anchor distribution across deduplicated domains. If exact-match commercial anchors are a large share of the profile, that is the single most actionable finding in the whole audit — and the fix is dilution, not deletion.
Dilution means new links with brand and natural anchors, which you were going to build anyway. It is slower than disavowing and it does not risk removing links that were helping you.
Step 5: disavow last, narrowly, or not at all
Disavow is a blunt instrument that tells Google to ignore links. It cannot be partially undone quickly, and it is applied to your own site. Google's own guidance has moved steadily toward 'most sites never need this'.
Reasonable grounds for using it: a manual action naming specific links, or a documented history of paid links from an obvious network that you cannot get removed. Not reasonable: a long list of directory links that showed up on their own, or a profile that merely looks untidy.
If you were penalised, you would usually know: manual actions arrive in Search Console with the reason attached. A profile that looks messy without a manual action is a profile, not a penalty.
What to hand back to the client
- The deduplicated list, with each link's status and last-checked date.
- The three piles, with counts — bought, earned, automatic.
- Anchor distribution across domains, with the exact-match share stated plainly.
- A named list of placements you would not buy again, and why.
- A plan that starts with dilution and holds disavow in reserve.
That document is worth more than the audit itself. It converts an inherited unknown into a maintained asset — and the next time someone asks what happened to a link, the answer is on a row with a date next to it.