Runbook
Spam backlinks flood: what to do in the first 48 hours
A sudden pile of casino, pill or foreign-language links is alarming and mostly harmless. This runbook keeps your hands off the site until you hold evidence.
Change nothing on the site, the redirects or the disavow file until hour 24. Traffic that fell and links that arrived are two facts, and the link may not be the cause.
Hour by hour
Hour 0 to 2: preserve the record
Export the Search Console links report and 16 months of performance data. Save a dated copy of your current disavow file, if you have one. Screenshots count as evidence too.
Hour 2 to 6: list the newcomers
Call refdomains for your domain with per=1000 and keep the file. Do the same for anchors. If you pulled a baseline last month, diff the two lists and keep only the new rows.
Hour 6 to 12: score them
Send the new domains to bulk_dr, 2,000 per call, 1 credit. Note how many sit at a DR of 0 to 5 and how many share an anchor.
Hour 12 to 24: check the targets
Run toppages. Are the links aimed at your home page, at a product page, or at a URL that should not exist? The last case points to a hacked or spam page on your domain.
Hour 24 to 36: line up the dates
Overlay link arrival with the clicks curve and with the Google update calendar. If the drop starts before the links, the links are not your answer.
Hour 36 to 48: decide
Use the ignore or disavow table. Write the decision down with the numbers that justify it, even if the decision is to do nothing.
What the evidence looks like, and what it usually means
| What you see | Likely reading | Next move |
|---|---|---|
| Hundreds of new domains, one anchor, DR near 0 | Automated blast | Record it; consider a domain-level disavow of the cluster |
| Links appear, clicks unchanged for 6 weeks | Background noise | Ignore and keep the monthly diff |
| Clicks fall the week of a core update, links old | Update, not attack | Audit content and intent, see the attack versus update guide |
| Links aim at pages you never created | Possible injection | Crawl your own site and check for spam URLs |
| Manual action notice in Search Console | Real penalty | Fix, document, then file a reconsideration request |
Reading the newcomers: names, pages and timing
Once the lists are saved, the newcomers are the part of the file that matters on day one. Spam backlinks show their shape in those rows, so read them in three passes and write down what each pass shows before you start the next. Notes first, opinions later.
Newcomers from a spike check should match the numbers you already have. If they do not, the pull itself may be the problem, so rerun it before you conclude anything.
Domain names that look generated
Say you run a small dental practice and a batch of new domains appears in one refresh. Look at the names before the scores. Scripts often build clusters from one stem with a number attached, or from a few copies of the same site with a single word swapped.
A name alone proves nothing, because ordinary businesses also register odd domains, and a strange word can simply be a brand. The useful question is whether names, anchors and scores point the same way at once. Agreement is the signal.
Pages that carry the links
Open a sample of the linking pages, not only the root domain of each newcomer. A real article usually has readers, comments that talk about its subject, and outbound links to sources in its own field. Templates with a wall of links and no text give the game away.
The backlinks call costs 2 credits and lists the linking pages behind a URL, so you can open the ones that matter most to your decision. Read about ten of them slowly. Ten is usually enough to see whether the pattern repeats.
Timing against your own calendar
Our index refreshes roughly once a month, so the pull date is the timestamp you can defend, not the day a link went live. Put that date beside the clicks curve. Then test the overlap.
A drop that begins before the new rows appear points away from links. A drop that begins after a pull, with clicks falling on the same pages the links target, deserves a serious look. Hold both results side by side before you write anything down.
Evidence file: what to keep, in order
Raw exports first
Keep the untouched JSON from each call, with the call name and the date in the file name. Working copies go in a separate folder, so the original never changes.
One summary table
Put the counts in a single sheet: new domains, the share at DR 5 or lower, the largest anchor and its share, and the three URLs that collect the most new links.
Screenshots with the address bar
Capture the Search Console pages with the address bar and the date range visible. A screenshot without a URL and a date proves very little later.
A decision note with a date
Write the decision, the numbers that justify it and the next check date in one paragraph. File it next to the exports, not in a chat thread.
Mistakes that turn an annoyance into an outage
The most common error is acting at hour zero. Owners disavow in a rush, upload a file of three thousand lines, and include a few healthy links by accident. That is self-inflicted.
A second error is trusting one tool's toxicity score. Vendors disagree. None of their scores is Google's view. Treat any score as a pointer to a domain, then look at the domain yourself, at least for the top fifty by volume.
A third, quieter error is deleting evidence. If you later need to explain the situation to a client, a host or a search engine, the dated exports are what you will wish you had kept.
When the flood is not about links at all
Some incidents that look like a link flood start somewhere else. Two cases are common. Each one leaves this runbook early. Spot them before you spend an afternoon on the link file.
Both paths are quicker than a disavow debate, and neither needs a single line in a disavow file.
A hacked page can look like a flood
The first sign is usually a target URL you never built. It may sit in a folder you do not recognise, or on a subdomain you forgot existed. Check each subdomain too, since an application on one host can be compromised while the main site looks fine.
If those pages return a normal 200 status and carry gambling or pharmacy words, stop the runbook here. Move to the injection check, because the fix is on the server, not in the link file.
- Folders you did not create
- Subdomains you did not set up
- Titles that changed without an edit from your team
A site change can look like a flood
Consider a team that changes its URL structure on a Monday. Clicks drop by Thursday, and a spam report lands the same week. The report is real, but the cause is the redirect map, and the links are only a bystander.
Redirect every moved URL to its new equivalent, not to the home page. Google's guidance treats mass redirects to unrelated pages as soft 404s, so a flat redirect can cost the traffic you were trying to keep.
Before you close the incident
- Dated exports of links, anchors and top pages are stored somewhere you can find them
- The decision, with its numbers, is written in one paragraph
- Next monthly pull is in the calendar
- You told whoever owns the budget that this is monitoring, not a crisis
- Nobody paid a stranger to remove links from sites you had not looked at
Questions people ask in the first 48 hours
Should I disavow the new spam backlinks on day one?
Usually not. Day one is when most mistakes happen, because the file is built from partial data. Finish the 48-hour sequence and decide with the numbers in front of you. A manual action notice in Search Console follows its own row in the decision table.
Is a sudden flood of spam backlinks always an attack?
No. Many floods are scrapers, directory bots or old pages that were reposted. It becomes an attack only when the shape fits and the timing argues for it. The two common signs are one anchor repeated across many new domains and a target nobody on your team ever linked to.
How many new domains is too many?
There is no universal number. Compare this month with your own best month, as the thresholds page explains. A count that alarms a small blog can be ordinary for a large news site, so the baseline decides, not the headline figure.
Do I need to tell Google about the links?
Not by default. Google's systems generally ignore links they consider spam, and the disavow tool is meant for narrow cases. Filing one is a decision in its own right, so make it only after the table says so.
Can a security scan or a hosting company help here?
Often yes, for the injected-page side. A scan can show planted files or pages. It cannot tell you which links are harmful, so keep the server check and the link check as two separate tasks.
