Disavow links

What a disavow file actually declares

A disavow file is a signed statement of distrust, not a deletion request. You are not pulling links off the web and you are not removing them from Google’s map of the link graph. You are telling Google that, when it weighs your site, it should discount every URL and every domain you list. Googlebot keeps crawling those pages, keeps seeing the links, and applies your instruction as a filter downstream. The file sits at property level in Search Console, and it replaces the previous version on every upload instead of merging with it.

Two properties of that mechanic matter more than most tutorials admit. It is reversible: pull a domain out of the file, re-upload, wait for those pages to be recrawled, and the links count again. And nothing ever confirms it worked. There is no report, no diff, no counter telling you « 412 links now ignored ». You upload, then you infer. Anyone who claims to have measured a disavow in isolation on a live site, with every other variable held still, is selling something.

It is also a Google-only instrument. Bing retired its own disavow tool in October 2023 and went all in on algorithmic detection of spammy backlinks, which is the direction the whole industry has drifted since. When you build a disavow file, you are managing one search engine’s opinion of your profile, not cleaning that profile in any absolute sense. The links still exist, still get crawled, and still shape what an LLM crawler or a competitor’s audit sees when they look at your domain.

How the tool behaves in 2026

Google’s public position has barely moved in a decade, but its confidence has. SpamBrain, the machine-learning spam system Google credits with handling the overwhelming majority of low-quality and manipulative links through 2025 and 2026, means the default outcome for a random spammy backlink is that it was already discounted before you noticed it. That is the baseline you should assume when you open a backlink export: the junk is priced in.

What changed in 2026 is the nuance. On 6 March 2026, John Mueller posted on Bluesky, relayed by Search Engine Roundtable and Search Engine Journal, that « most sites don’t need [the disavow file], but that’s not all sites », and that « if you’re conflicted and just want to be sure, it’s totally fine to set up and use disavow files ». He closed with the line the industry has been quoting since: « the disavow file is a tool, not a religion ». Read it as permission for judgement, not as an invitation to mass cleanup.

The same exchange surfaced a capability that had lived in the parser since 2012 without ever being documented: the domain: directive accepts a bare top-level domain. A line reading domain:.xyz or domain:.biz discounts everything on that TLD pointing at your site. Search Engine Roundtable and Search Engine Land both framed it as a big hammer and noted Google keeps it undocumented precisely to discourage casual use. It fits one shape of problem: a bulk spam wave concentrated on a cheap abused extension, with an audit confirming you have zero legitimate links from that extension. Miss that second condition and you have quietly discounted a real editorial link because a scraper farm shares its TLD.

Processing is recrawl-paced. Google gives no timeline, and for a large file with long-tail spam domains that get crawled rarely, the effect spreads over weeks or months. Do not expect a dated before-and-after. And a disavow on its own does not lift a manual action for unnatural links: you still file a reconsideration request, and the reviewer reads the effort, not just the file.

Where disavow fits in a netlinking operation

For a site that buys links, disavow is symptom management for a sourcing failure. Every hour spent classifying inbound spam two years after the fact is an hour that would have been worth ten times more spent choosing hosts up front. That is the operational reframe: the question is not « what should I disavow », it is « why did this end up pointing at me in the first place ».

The answer is usually opacity in the supply chain. When you order through an inventory resold across two or three intermediaries, or through a broker who never discloses the publishing domain before payment, you inherit whatever that host also sells to everyone else. Six months later you are looking at a site with 340 outbound sponsored links across unrelated verticals, and the disavow decision is genuinely hard because your own link sits in the middle of it. The fix is upstream: seeing the exact domain, its traffic and its outbound profile before a single euro moves removes the entire class of problem.

This is the one place our own setup is relevant to the argument. We publish on our own French editorial media, written in-house, and that is not a quality claim so much as a traceability claim: an owned network behaves differently from resold inventory because there is no third party deciding who else gets a link on the same page next month. Whether you work with us, with French media that publish their own editorial, or with a publisher you found yourself, the property that protects you is identifiability, not a toxicity score.

There is a second, rarer case: a genuine negative SEO wave. Someone points 40 000 links at a commercial page from a link farm, and you can see it in Search Console within days. Here the profile shift is fast, concentrated and traceable, and a disavow is cheap insurance even if SpamBrain would have caught it. The distinction that matters is measurable impact and a clear attack pattern, not the mere presence of ugly domains in your backlink export. Ugly domains are the normal state of the web.

What we see go wrong in audits

The dominant failure mode in 2026 is treating a vendor score as a work queue. Semrush’s Backlink Audit assigns each link a Toxicity Score from 0 to 100 across more than 50 parameters and will generate a formatted disavow file in one workflow, which is convenient and dangerous in equal measure. Semrush’s own blog said it plainly on 19 January 2026: the automated detection is a warning system, human review is required, and a file used too broadly can do more harm than good. Ahrefs’ help documentation, updated 27 June 2026, makes the parallel point that no single metric such as DR or UR defines a manipulative link, because Google’s guidelines set no numeric threshold. Majestic went further and announced in October 2025 that it was removing its export-to-disavow-format feature and any toxic-link indication, stating it does not pretend to identify links to disavow without significant manual intervention. When the data vendors themselves start withdrawing the button, the signal is not subtle.

The numbers back that shift. Editorial.link’s 2026 survey of 518 SEO experts found 39.0 % still actively using the tool, 61 % not using it at all, and only 4 % disavowing every suspicious backlink they find. A practice that was standard hygiene a decade ago is now a minority intervention.

Then come the mechanical errors, which are quieter and just as expensive. Uploading an incremental file, forgetting that it overwrites rather than appends, and silently un-disavowing last year’s work. Disavowing an entire domain when a single scraped page was the problem and the domain also sends you a real editorial link. Listing the source of a 301 redirect but not the redirect target. Formatting URL lines without the protocol, so Google skips them. Disavowing a directory or a partner site because a tool flagged it, then wondering why a category page slid two positions.

One competitor convention deserves a direct contradiction: the ritual of emailing webmasters for manual removal before disavowing. In 2026 that is mostly theatre. Spam operators do not answer, and the links Google already ignores do not need removing. The one context where the effort is genuinely worth it is a manual action, where the reconsideration reviewer is assessing whether you made a real attempt at cleanup. Outside that, log the outreach if you want a paper trail, but do not let it delay the decision for six weeks.

A protocol that survives contact with a real profile

Start with the trigger, not the data. If there is no manual action in Search Console, no historical link scheme you personally know about, and no dated traffic drop that lines up with a link event, close the tab. The correct action is nothing. Curiosity about a backlink export is not a reason to intervene in your own ranking signals.

If a trigger exists, pull the full picture rather than one vendor’s view: Search Console’s link report for what Google actually attributes to you, plus one commercial index for the crawl depth Search Console does not give you. Reconcile them. Sort by domain, not by URL, because patterns live at domain level: a hundred links from one expired-domain network is one decision, not a hundred.

Classify in three buckets. Links you or a predecessor paid for or built manipulatively, which you disavow without hesitation because Google would find the same footprint. Links from an obvious automated wave you had nothing to do with, which you disavow if they are numerous enough to shape the profile. And everything else, which is noise you leave alone. The default for the third bucket is inaction, and it should hold the large majority of your rows.

Write the file with comments, one # line per group explaining why that block exists and when it was added, because the person auditing this in eighteen months is probably not you. Keep it under version control. Prefer domain: lines when a whole host is compromised and URL lines when the problem is one page. Reserve the bare-TLD form for the case it was meant for, where an entire cheap extension is the vector and you have verified you lose nothing legitimate. Then upload once, note the date, and stop touching it. The measurement you can actually run is a slow one: does the profile stabilise, do the impressions on the affected pages recover over the following quarter. Anything faster than that is you reading noise.