Toxic Backlinks After the August 2026 Spam Update: Audit, Disavow, or Leave Alone

Google rolled out its August 2026 spam update between August 18 and August 21, and the impact was bigger than a two-and-a-half-day rollout would suggest. Third-party tracking showed top-10 pages getting wiped out of the top 100 at nearly double the normal rate. If you manage links for clients, you already know what happened next: the “is it our backlinks?” emails started landing.

Here’s the thing. Google said this update did not target link spam. That doesn’t mean your backlink profile is off the hook, but it does mean the panic-disavow reflex is the wrong first move.

This guide replaces our old backlink audit walkthrough with something more useful for this moment: a way to tell toxic backlinks from links that just look ugly, a backlink audit that finds real risk instead of tool-generated noise, and a decision framework for the only three options you have with any link: audit it, disavow it, or leave it alone.

What the August 2026 Spam Update Did (and Didn’t) Target

Let’s set the record straight before we touch a single link.

Google confirmed the update ran from August 18 to August 21, applied to all languages and regions, and was described by Google itself as a “normal spam update.” When Search Engine Roundtable asked what it targeted, Google said it enforces some of the published spam policies, that it does not target link spam, and that recovery for affected sites can take many months.

The volatility, though, was real. SE Ranking data reported by Search Engine Land found that 16.71% of URLs that had been in Google’s top 10 dropped past position 100 during the update window, versus 9.2% during a quiet five-day period in July. That’s an 82% jump in top-10 pages disappearing, across all 20 industries tracked, from a sample of 100,000 US keywords.

So two things are true at once:

• If your site dropped on August 18, your backlinks are probably not the reason. Google pointed affected sites at its spam policies, and the excluded categories were link spam and site reputation abuse. The on-page policies (scaled content, thin affiliation, doorways, expired domain abuse) are the more likely suspects.
• Link spam still gets enforced, just by separate systems. Google’s spam updates documentation is explicit that when a link spam update strips the value from manipulative links, that ranking benefit is gone for good. Cleanup won’t bring it back.

That second point is the one that matters for the rest of this article. The risk from toxic backlinks isn’t that a spam update will find them. It’s that you’re building a profile whose value can evaporate, and that a large enough pattern of manipulation can earn a manual action. Both are worth auditing for. Neither is worth panicking over.

What Counts as a Toxic Backlink (and What Doesn’t)

“Toxic” is a tool word, not a Google word. Every backlink checker has a toxicity score, and every score is a guess based on metrics like domain rating, outbound link count, and traffic. Those scores are useful for sorting. They’re a terrible basis for a disavow file.

Google’s definition lives in the link spam section of its spam policies, and it’s about intent: links created primarily to manipulate rankings.

Links Google’s policies name as link spam

• Paid links that pass ranking credit. Money, products, or services exchanged for a followed link, including advertorials and sponsored guest posts without rel=”sponsored” or rel=”nofollow”.
• Automated or program-generated links. Anything built by a script or a service at scale.
• Excessive link exchanges and partner pages that exist only to cross-link.
• Low-quality directory and bookmark links.
• Widget links, footer and template links distributed across many sites, especially with keyword-rich anchors.
• Forum and comment signatures stuffed with optimized anchor text.
• Contractual links required by terms of service without letting the publisher qualify them.

Notice what every item has in common: someone on your side of the link did something to get it. That’s the tell. Toxic backlinks, in the sense Google cares about, are almost always links you or a previous SEO built.

Links that look scary but usually aren’t toxic

These show up red in every tool and rarely matter:

• Scraper sites that copied your content and kept your internal links. You didn’t build them, and Google’s disavow guidance says the company works hard to make sure third-party actions don’t hurt you.
• Low-DR but legitimate sites. A DR 8 local blog that links to you because it likes your work is a good link. Domain rating is a proxy for authority, not a proxy for spam.
• Random foreign-language directories and auto-generated “stats” sites. Noise. Google ignores them.
• Nofollow links from anywhere. They don’t pass ranking credit, so they can’t pass a penalty either.
• A sudden spike of junk links you didn’t buy. Negative SEO is a real tactic and an unreliable one. Monitor it, but don’t rebuild your disavow file every time a bot network finds you.

The practical filter: if you can’t explain how the link got there, it’s probably not your problem. If you can, it might be.

How to Run a Backlink Audit That Finds Real Problems

Our old version of this post walked through nine steps in Ahrefs. Most of them were about finding opportunities and fixing technical issues, which are worth doing but aren’t a backlink audit. This is the tighter version: four steps, built to answer one question. Is there a pattern of manipulative links pointing at this site, and is it big enough to matter?

Step 1: Pull the profile from two sources

Export external links from Google Search Console (Links report, “Export external links”). Then pull the full backlink list from Ahrefs Site Explorer or your tool of choice. GSC shows you what Google sees, which is the list that matters. The third-party tool shows you more of the web, plus the metrics you’ll sort by.

Set the tool to “http + https” and “subdomains” so you’re auditing the whole property, not one version of it.

Step 2: Sort by risk signals, not by toxicity score

Filter for followed links only. Then sort on the things that correlate with manipulation:

• Exact-match commercial anchors. “best plumber Dallas” as anchor text from a site that isn’t about plumbing or Dallas.
• Sitewide links. One domain sending you hundreds of links from a footer or sidebar.
• Linking pages with no traffic and dozens of outbound links. The classic paid-placement fingerprint.
• Clusters of similar domains. Same hosting, same template, same registration window. That’s a PBN whether or not the tool flags it.
• Link velocity that doesn’t match anything you did. Three hundred new referring domains in a month with no campaign behind it.

You’ll end up with a short list. That short list is the audit. Everything below it in the export is noise.

Step 3: Judge the pattern, not the individual link

Open the linking pages. You’re not grading each one; you’re asking whether the short list adds up to a strategy. Twenty guest posts on real sites with a few optimized anchors is a normal profile. Two hundred links from templated “blog” sites with the same anchor text is a scheme, and Google’s systems are built to recognize it as one.

Write down what you find in plain language: “Roughly 140 PBN links built in 2023 targeting the money page,” or “Nothing beyond normal web noise.” That sentence drives the decision in the next section.

Step 4: Check Search Console for a manual action

Go to Security & Manual Actions in GSC. If there’s an “Unnatural links to your site” action, the decision is made for you: skip ahead to the disavow section. If there isn’t, keep reading, because most sites don’t need to disavow anything.

The Decision Framework: Audit, Disavow, or Leave Alone

Every link in your profile lands in one of three buckets. Here’s how we sort them.

Leave alone when:

• You didn’t build it and can’t explain how it got there.
• It’s nofollow, or it’s from a scraper, a stats site, or a bot directory.
• It’s low-authority but from a real site with real content.
• There’s no manual action and no pattern of manipulation in your short list.

This is the bucket most links belong in. Google’s disavow documentation says it plainly: in most cases Google can assess which links to trust without help, and most sites will never need the tool.

Disavow when:

• You have a manual action for unnatural links, or
• Your audit found a considerable pattern of manipulative links (paid, PBN, scheme) that you or a previous SEO built, and it’s large enough that a manual action is a realistic risk.

Google’s own condition is both parts together: a considerable number of spammy or artificial links, and those links have caused or likely will cause a manual action. One bad link doesn’t meet the bar. One bad campaign might.

Remove first, disavow second

If a link belongs in the disavow bucket, Google’s guidance is to try to get it removed from the web first. That means emailing the site owner or, if you paid for the link, asking the vendor to pull it. Disavow is for what you can’t remove.

In practice, removal requests on PBN and paid-placement sites mostly go unanswered. Do the outreach, document it, and move on. If you ever need to file a reconsideration request, that paper trail is what shows Google you made a good-faith effort.

The one rule that prevents most disavow mistakes: disavow at the domain level for sites that exist only to sell links, and at the URL level for real sites where one page is the problem. Never disavow a domain because a tool colored it red.

How to Disavow Correctly If You Need To

If your audit landed you here, the mechanics are simple. The judgment was the hard part.

1. Build a plain text file, UTF-8, ending in .txt. One entry per line. Use domain:example.com to disavow a whole domain, or the full URL for a single page. Lines starting with # are comments; use them to note why each domain is in the file.
2. Keep it clean. Google rejects the whole file on any formatting error, and an accepted file replaces whatever list was there before. It doesn’t append.
3. Upload it in the disavow links tool for the correct property. Note that Domain properties aren’t supported; you need a URL-prefix property, and if you have both http and https properties you’ll need a list for each.
4. Wait. Google says it can take a few weeks to incorporate the list as it recrawls the pages. Disavowed links will still show in your Links report, which confuses a lot of people. That’s expected.

Two warnings straight from Google’s documentation, because they’re the ones people ignore: the tool is described as an advanced feature to use with caution, and using it incorrectly can hurt your site’s performance. If you disavow real links from real sites, you’ve just thrown away authority you earned.

What to Build Instead of What to Remove

Here’s what nobody says loudly enough after a spam update: the sites that came out fine had less to lose. They weren’t propped up on links that a link spam system could strip out. Their rankings came from links that would survive any audit because they were earned from real publications for real reasons.

That’s the actual defense against toxic backlinks, and it has nothing to do with the disavow tool. If a manual action ever hits, a profile that’s 90% legitimate recovers. A profile that’s 40% legitimate doesn’t, because there’s nothing left once the bad links stop counting.

Practically, that means:

• Editorial placements on sites with real traffic, where the link sits inside content a human wrote for readers.
• Anchor text that reads like a sentence, not a keyword list. Branded and natural anchors should dominate.
• Topical relevance over raw DR. A DR 40 industry publication beats a DR 70 general site that links to everyone.
• Steady velocity. A profile that grows every month looks like a business getting attention. A profile that jumps 300 domains in a week looks like a purchase order.

If you want a benchmark for what that looks like at scale, our link building services page walks through how we vet publishers, and our high-authority links are built for exactly the kind of profile that doesn’t need a disavow file.

The AI Search Angle: Why This Matters Beyond Google’s Ten Blue Links

Google updated its spam policy language earlier this year to cover attempts to manipulate generative AI responses in Search. The August update was the first spam update since that change, and reporting on it noted that sites hit by the update dropped across surfaces, including AI Overviews and AI Mode.

That changes the math on link quality. AI answer engines cite sources they trust, and trust is built on the same signals a backlink audit measures: who links to you, from what kind of site, and why. A profile that looks manufactured doesn’t just risk a manual action. It makes your site a worse candidate to be the cited source when someone asks ChatGPT, Perplexity, or AI Mode a question in your category.

So when you sort a link into the “leave alone” bucket, you’re protecting earned trust. When you build editorial links, you’re building the citation profile that AI search runs on. Same work, two payoffs.

How Authority Builders Can Help

If your audit turned up a real problem, or you’d rather not run it yourself, our Link Audits service does the full review and delivers a properly formatted disavow file, typically within 7 to 10 days. We audit the entire profile against the criteria above, not a toxicity score, so you don’t end up disavowing links that were helping you.

If the audit came back clean and the real gap is authority, that’s what we do all day. ABC Plus gives you curated placements from a vetted marketplace, and High-Authority Links targets the publications that move rankings and get cited. Either way, book a call with our team and we’ll tell you which one fits.

FAQ: Toxic Backlinks and the August 2026 Spam Update

Did the August 2026 spam update target backlinks?

No. Google confirmed the update did not target link spam or the site reputation abuse policy. It enforced other spam policies, mostly on-page ones. If your rankings dropped between August 18 and 21, start by reviewing your content against Google’s spam policies before you look at links.

What is a toxic backlink?

A toxic backlink is a link created primarily to manipulate rankings, as defined in Google’s link spam policy: paid links that pass ranking credit, automated links, PBN links, excessive exchanges, and keyword-stuffed widget, footer, or comment links. A low domain rating alone does not make a link toxic.

Should I disavow toxic backlinks?

Only if you have a manual action for unnatural links, or your audit found a large pattern of manipulative links you built that could realistically trigger one. Google says most sites never need the disavow tool, and that using it incorrectly can hurt your performance.

How do I find toxic backlinks?

Export your links from Google Search Console and a backlink tool, filter to followed links, then sort by exact-match commercial anchors, sitewide links, zero-traffic linking pages with many outbound links, and clusters of templated domains. Review the short list for a pattern of manipulation rather than judging links one at a time.

How long does a disavow take to work?

Google says it can take a few weeks after upload for the list to be incorporated as pages are recrawled. If the links were part of a link spam enforcement, expect no ranking recovery from the disavow itself, since Google says the value of spammy links is lost and cannot be regained.

Can competitors hurt me with spammy links?

Google says it works hard to make sure third-party actions don’t affect your site. Monitor for unusual link spikes, but don’t disavow every bot-network link that shows up. Reserve the tool for links you or a previous SEO built.

Audit Calmly, Disavow Rarely, Build Constantly

The August 2026 spam update was a reminder that Google can rearrange the results in under three days. It was also, per Google, not about your links. That’s the lesson worth keeping: audit your profile on a schedule, not in a panic. Disavow only when the pattern and the risk are both real. And spend the time you save building the kind of links that would survive any update.

If you want a second set of eyes on your profile, schedule a call. We’ll tell you what’s toxic, what’s noise, and what to do next.