Link audit

Two audits hiding under one name

Ask five SEO consultants what a link audit covers and you get two answers that barely overlap. Half describe a crawl of the site's own internal links: click depth, inlinks per URL, orphan pages, broken redirects. The other half describe a review of the backlink profile: exports from Search Console and a third-party index, anchor distribution, spam patterns, a disavow file. Both readings are legitimate. Treating them as a single deliverable is where the work goes wrong, because they answer different questions with different stakes and different fix horizons.

An internal link audit asks whether your site distributes its own equity to the pages that can rank and convert. It is an architecture problem, entirely under your control, and the fixes ship in a sprint: a template change, a hub page, a batch of contextual links inside existing content. A backlink audit asks whether your external profile carries risk, whether the links you paid for actually landed where the invoice said, and whether anything in the graph explains a plateau you cannot otherwise account for. That one is forensics, mostly outside your control, and the remediation runs in months.

Our stance after running both across our own network of French editorial media: run them on separate cadences and never merge the report. Internal audit quarterly, plus one after any template or navigation change. Backlink audit annually, plus one the moment Search Console shows a manual action or a campaign ends in an unexplained drop. Anything more frequent on the backlink side is busywork, and we will get to why.

What link risk actually looks like in 2026

The reason most link audit guides feel dated is that they still assume the 2012 Penguin model: bad links accumulate, they poison the site, you clean them out to recover. That model has been replaced by a mix of algorithmic devaluation and targeted enforcement, and the practical consequence is that the size of your cleanup list matters far less than its shape.

The enforcement calendar tells the story. Google's December 2024 spam update rolled out over seven days with link networks and low-quality link-driven content explicitly in scope. The August 2025 spam update, the first since then, took 27 days and targeted scaled content, expired-domain abuse and site reputation abuse. The March 2026 spam update completed in roughly 19.5 hours, the fastest on record, and was described as a SpamBrain fine-tuning pass rather than a new policy category, with the June 2026 update running about two days on the same footing. Read together, that sequence says the classification model is mature and the policies stopped moving: what remains is steady enforcement of the three 2024 spam policies, scaled content abuse, site reputation abuse and expired-domain abuse.

SpamBrain now does the work that a disavow file used to do, reading link graph patterns, anchor distributions and acquisition timing to neutralize purchased links, exchanges and private networks. The 2024 leak of internal Google documentation surfaced a reference to a BadBackLinks signal, which supports what practitioners already suspected: some links are not merely ignored, they are held against the target. BlueTree's March 2026 synthesis of a 200+ domain B2B SaaS audit dataset puts a number on the pattern worth hunting: 82% of penalized profiles showed a heavy concentration of exact-match commercial anchors, and 68% of what the clients described as unexplained plateaus had identifiable unnatural link patterns behind them.

That is the single most useful reframing for a 2026 audit. You are not looking for bad domains. You are looking for a distribution that no organic acquisition process could have produced: forty links in three weeks after a year of nothing, the same money anchor on sixty hosts, a cluster of sites sharing a footer template and a registrar. Individual links are a rounding error. The pattern is the finding.

Running the internal link audit

Start with a full crawl and connect the Search Console API before you launch it, because the interesting cells are the ones where crawl data and performance data disagree. Screaming Frog's SEO Spider is still the default here, and its free licence carries a crawl cap that is enough for a small site and useless past that. Set it to render if the internal linking depends on JavaScript, otherwise a raw HTML crawl is faster and truer to what the crawler sees on first pass.

Four numbers matter, and they matter in this order. Click depth, first: any page you expect to rank commercially should sit at depth 3 or less from the homepage, and depth 2 for the handful of URLs that carry your revenue. Inlinks per page next, from the spider's Inlinks tab, which counts every internal href pointing at a URL including navigation and footer boilerplate. That last detail is why the raw count lies: filter out the template links and you often find a category page with 400 inlinks, of which 397 come from the footer. Third, broken internal links and redirect chains, which are cheap to fix and quietly waste crawl on large sites. Fourth, orphan pages, which the spider will only surface when you feed it Search Console and sitemap data alongside the crawl, since by definition no internal href points to them.

The visual walkthrough below covers the mechanics of the crawl itself, which is worth watching once if you have never wired the API integrations.

Then do the part the tools cannot do for you: read the anchor text of contextual internal links. Internal anchors are the one place where being descriptive costs you nothing and helps a lot, and most sites waste them on « read more » or on a bare product name repeated forty times. Export the Anchor Text tab, group by destination URL, and look for destinations that receive a single anchor variant across the whole site. That is a semantic signal you are leaving on the table, and it is the cheapest win in the entire audit.

The backlink audit, and the disavow question

Collect from at least three sources: the Search Console links report, which is the only view of what Google actually attributes to you, plus two commercial indexes, because no crawler sees the whole graph. Deduplicate at domain level rather than URL level, run a live check to drop the links that no longer exist, and only then start classifying. Most audit reports die here, buried under 40,000 rows that nobody will ever read.

Classify by acquisition intent, not by vendor score. Three buckets: links you or a predecessor deliberately built, links that arrived on their own, and links you cannot account for. The first bucket is the only one that carries real risk, and you can usually reconstruct it from invoices and old campaign briefs faster than from any tool. Within it, the specific things worth flagging are exact-match commercial anchors clustered on one target URL, hosts whose published content has nothing to do with your sector, expired domains rebuilt purely as link inventory, and any pattern where fifty placements share the same publication window.

Now the disavow file, where most of the industry is still spending money badly. John Mueller said in May 2024 that Google would eventually remove the tool, and on Bluesky in March 2026 he described it as « a tool, not a religion », adding that most sites do not need it while allowing its use in genuinely ambiguous edge cases. He also confirmed on 10 March 2026 that TLD-level entries work, with the caveat that almost no site should go that far. The market has followed: the Editorial.link survey of 518 SEO experts published on 13 May 2026 found only 39.0% still use the tool at all, with Bing having sunset its own equivalent.

The operating rule we apply: disavow when Search Console shows an unnatural links manual action, or when you personally know which manipulative campaign ran and can name the domains. Nothing else. Routine « cleanup » disavows on sites with no manual action are, in Mueller's framing, billable time with no mechanism behind it, and an indiscriminate file can strip equity from links that were fine. When a manual action does land, the timelines from the Linkbuilding Journal guide of May 2026 are a fair planning baseline: four to eight weeks for a partial action, three to six months for a site-wide one, assuming the remediation is genuine rather than cosmetic. One documented B2B services recovery, a site that had lost 72% of its traffic and dropped from $26K to under $7K monthly revenue, restored roughly 94% of organic traffic in about 90 days after a forensic link audit combined with content remediation.

The corollary for anyone buying links today is that the audit belongs before the purchase. Checking what a host site actually publishes, not what its category tag claims, is a ten minute job. It is the reason we publish the full list of media we run, with their metrics visible before you order, and why buying directly from the publisher rather than through a resale layer removes an entire class of audit finding. When you go through a link marketplace or a broker sitting between you and the editor, you inherit inventory you did not vet.

Tools: what free actually covers

Search Console costs nothing and is the only source that reflects Google's own attribution, which makes it the reference point for the external side even though its export is capped and its sampling is coarse. It also holds the manual actions report, which is the single most important screen in the entire audit: if it is empty, most of the disavow conversation is moot. For the internal side, the free Screaming Frog licence handles small sites end to end, and the paid one buys you the API integrations, unlimited crawl and the scheduling that turns an audit into a recurring check rather than a one-off project.

Paid backlink tools buy you index coverage and history, nothing more. Ahrefs, Majestic and Semrush each see a different slice of the graph, so running two is genuinely useful and running four is not. Forensic suites like Link Research Tools sit at the other end, built for the manual action scenario where you need documented evidence per link rather than a dashboard.

Treat every toxicity score as triage and never as a verdict. Semrush's own backlink audit documentation, updated 19 January 2026, states plainly that tools cannot determine toxicity with complete certainty and that the score exists to flag links for closer review, with the model retrained on a larger penalty dataset in Q4 2025 to track real enforcement more closely. That is an honest position from a vendor. The dishonest version is any tool that tells you to clean toxic links on a monthly schedule.

What we see go wrong

The recurring failure is auditing the wrong half. A team spends three weeks classifying 12,000 referring domains, disavows 400 of them, changes nothing about a site where the commercial pages sit at depth 4 behind a mega-menu, and reports no movement. The internal audit would have taken two days and produced ranking changes inside a month.

Second failure: exporting once. A link audit that lives in a spreadsheet is a document. A link audit that lives as a scheduled crawl with a diff against last quarter is a control. Orphan pages and redirect chains reappear with every content migration, so the value is in the repetition, not in the first pass.

Third: auditing acquisition after the fact. If the same team that buys the links also audits them, the audit becomes a justification exercise. Separate the two, and set the acceptance criteria before the campaign starts rather than reconstructing them from a toxicity column afterwards. That is the whole argument for working with a French editorial network operated in-house: the inventory is knowable in advance, so the audit becomes a verification rather than an investigation.

Last, and most expensive: mistaking a link problem for a link problem. Since the March 2024 core and spam updates, a large share of what clients bring in as suspected link penalties turns out to be scaled content abuse or site reputation abuse on their own domain. Check the content policies before you touch the disavow file, because the link graph is rarely where the damage started.