Worked example
Backlink spike detection: thresholds for a small site
A spike means nothing without a baseline. The figures below are an invented example, chosen to show the arithmetic of a watch, not a standard to copy.
- per refdomains pull, $0.0002
- 2 credits
- rows per call, one bill
- 1,000
- index refresh
- ~Monthly
- domains per bulk_dr call
- 2,000
Build the baseline first
Pull three monthly snapshots when nothing is wrong. Three is the minimum for seeing what normal growth looks like.
Imagine a local clinic site that gains between 6 and 14 new referring domains a month. That range is the baseline. In the example below, the clinic suddenly shows 312 new domains in one refresh, which is more than twenty times its largest monthly gain and well beyond any seasonal story you could tell.
Store the numbers in a sheet with one row per month: new referring domains, the share at low DR, the top anchor's share. Three columns are enough, and the sheet becomes your threat log.
Example scoring (hypothetical clinic site)
| Signal | Baseline | This month | Flag? |
|---|---|---|---|
| New referring domains | 6 to 14 | 312 | Yes, over 3x the top of the range |
| Share of new domains with DR 0 to 5 | about 30% | 91% | Yes |
| Largest single anchor among new links | under 5% | 64% | Yes |
| New links to a page you never promoted | 0 | 187 | Yes, check for injection |
| New domains in your own language or country | most | almost none | Supporting evidence |
Splitting a spike into its parts
A spike is a bundle of signals, and each one can be measured on its own. Separate them first, then judge. A backlink spike that moves one signal and leaves the others flat is usually a different event from one that moves all four together.
Work through the signals in the same order every month, and write each result in the same row of your sheet. A consistent order makes a bad month easy to recognise next to a normal one. Keep it dull on purpose.
New domains against the baseline
Compare the count of new referring domains with your best baseline month, not with the average. The average hides short bursts, and a short burst is what a flood looks like. Each count covers the window since your last pull, so a flat line can hide a sudden jump.
If the new count is three times your best month, the trigger list says to look harder. If it sits just above your best month, that is weak evidence, and the next pull will tell you more.
Share of low-DR newcomers
Scores on our scale come from a logarithmic formula, so the bottom of the range is tight. A DR of 5 or lower means the domain has at most one referring domain of its own, because the formula climbs slowly at the start. Many young sites sit in that band, which is why a high share alone proves little.
Read the share alongside the count. Ninety percent of low-DR newcomers on a count of twenty is not the same signal as ninety percent on a count of three hundred.
Largest anchor share
Find the most common anchor among the new rows, and divide its count by the total. Natural profiles spread across the brand name, the bare domain and generic phrases. One commercial phrase holding a large share is the pattern to write down.
Run the search call only when the other counts already look wrong. It costs 3 credits and finds a phrase across anchors, titles and URLs, so it pays to know what you are looking for first.
Suggested trigger rules (adjust to your site)
- New referring domains above 3 times your best baseline month
- More than half of the newcomers scoring DR 5 or lower
- One anchor on more than 30 percent of new links
- Links landing on a URL with no earlier inbound history
- Two or more of the above in the same refresh: open the runbook
What a false alarm looks like
Not every spike is an attack, and a rule that never fires on good news is not much of a rule. False alarms repeat. Learn their patterns. Learn them before the first alarm, so you are not guessing at two in the morning.
Each pattern below leaves a different trace in the same three lists.
A story that earns real links
Imagine a regional clinic whose local paper runs a feature on its staff. Two dozen real sites link to the story, the anchors are the clinic's name and a few phrases from the article, and the domains have readers. The count is high, but the shape is natural, so the file says wait.
The honest test is the link itself. Open a few of the new pages and ask whether a person would link there on purpose.
A partner or directory listing
A supplier or a membership directory may add a page of links in one batch. The anchors then repeat, because they come from the listing's own template, and the scores stay modest. On paper that repetition looks like a flood, so check who published the listing before you count it.
Ask the partner directly, and keep the reply with the file.
A redesign with a new footer
A sitewide footer on another site can create links from many of its pages at once, especially when a partner builds a shared template. Count by root domain, because one site with a footer link produces many rows and only one domain.
Look at where the link sits on the linking page before you count it as a vote of any kind.
Rate and cost table for a watch
| Watch plan | Calls per month | Credits | Cost |
|---|---|---|---|
| One site, refdomains + anchors + toppages | 3 | 6 | $0.0006 |
| One site plus bulk_dr on up to 2,000 newcomers | 4 | 7 | $0.0007 |
| Ten client sites, same four calls | 40 | 70 | $0.0070 |
| One deep pull: 50,000 rows (50 pages of 1,000) of refdomains | 50 | 100 | $0.0100 |
Running the check once a month
Pull the three lists
Save refdomains and anchors for your domain at 1,000 rows per call, plus toppages for the same domain. Each call is two credits and one bill, whatever the row count.
Score the newcomers
Send the new domains through bulk_dr, up to 2,000 per call, at 1 credit. Keep the scores in the same file as the domain names.
Compute the four signals
Work out the count, the low-DR share, the largest anchor share and the number of links landing on pages you do not recognise. Write them in one row, in the same order every month.
Flag and file
If two or more triggers fire, open the runbook. If none fire, record the row and close it. In both cases the saved files are the record.
Why these numbers are only a starting point
Thresholds that work for a clinic fail for a news site that gets a hundred natural links after one story. Tune them against your own history.
Also remember the refresh cycle. The index refreshes roughly once a month, so a spike reflects what our crawler found since the last pass, not the day the links were placed. Ahrefs and Semrush crawl more often if you need to spot a flood within days, at a much higher monthly price.
The cost row for a deep pull assumes 1,000 rows per call and the 50,000 pagination cap. Most sites never need it.
For the file habit that feeds these rules, see the monthly watch guide.
Questions about spike thresholds
These questions come up once the watch is running and the first flag appears.
Is there one correct spike threshold for everyone?
No. The figures on this page are an invented example, chosen to show the arithmetic of a watch. A threshold that suits a clinic can be far too sensitive for a news site, so tune the numbers against your own history over at least three months.
How much history do I need before a spike means anything?
Three snapshots is the minimum for seeing normal growth. With fewer, every month can look like a spike. More history makes the threshold steadier, and each extra pull costs only a few credits.
Does a high DR on the linking site make a spike harmless?
Not automatically. A few strong links from relevant sites are ordinary, but a cluster of unrelated high-DR domains is still worth reading. Score is one signal among four, so do not let it decide alone.
What if the spike is real but the links are not in the index yet?
That is a normal gap. Our index refreshes roughly once a month, so a spike you see today reflects the last pass. Note the pull date, then recheck after the next refresh before you conclude the links have stopped.
Reading the anchor column
Natural profiles are untidy. They hold the brand name, the bare domain, phrases such as click here, and the occasional exact-match phrase.
A flood looks tidy in the wrong way: one commercial phrase, repeated, or a language that does not match your market. Run anchors for the counts, and search (3 credits) if you want to find that phrase across other targets.
Google's own Penguin work, folded into the core algorithm in September 2016, was aimed at exactly this shape. Today the more likely outcome is that the links are discounted, which is why a flag opens an investigation instead of a panic.
