LinkGuard cover — The disavow file checklist: when to use it (and when most sites shouldn't)

You open Google Search Console looking for an unnatural-links manual action that explains the traffic drop, and there isn't one. Someone on LinkedIn just sold you on a "toxic-link cleanup" package. Your last agency has a quarterly disavow-file maintenance line item. Something feels off.

Something is. The 2026 honest answer is that most sites don't need the disavow tool at all. John Mueller has called it "a billable waste of time". Gary Illyes has said in public, "if you don't have a manual action, you do not need to submit a disavow." Cyrus Shepard ran a controlled experiment, disavowed 10,000 backlinks on a real site, and saw no measurable effect on rankings or traffic. Glenn Gabe puts the cohort that actually needs it at roughly 0.01% of sites (one in ten thousand). The tool isn't deprecated, but the work it used to do moved into the algorithm: Penguin 4.0 in 2016 shifted Google from "demote sites with bad links" to "ignore bad links", and the December 2022 SpamBrain update (Google's AI link-spam classifier) detected fifty times more spam than the previous version.

Bing went one step further: they retired their disavow tool in October 2023 because internal data showed it wasn't useful.

So why does this checklist exist? Because there are exactly three situations where you SHOULD disavow, and getting those three right matters enormously when you're in one of them. This is the do-it-right version — built around the named operators above, not the agencies selling toxic-link-cleanup retainers.

Vocabulary, before we start

The article uses six insider terms that a junior shouldn't need to Google in another tab:

PBN — private blog network. A cluster of sites built (often on expired domains) to manufacture backlinks to a money site. Black-hat tactic; Google's manual reviewers know the pattern.
SpamBrain — Google's AI link-spam classifier, deployed in December 2022. Replaced most of the manual work the disavow tool used to do.
Penguin 4.0 — the 2016 algorithm update that shifted Google from "demote sites with bad links" to "ignore them".
Core Update — Google's broad-strokes ranking refresh, typically 3-4 per year. Affects content quality scoring, not link signals.
Helpful Content update — Google's content-quality classifier targeting thin, AI-generated, or unhelpful pages. Has nothing to do with backlinks.
Reconsideration Request — the formal Search Console submission you file to ask a human Google reviewer to lift a manual action after you've cleaned up.

Tick items as you go — progress lives in your browser, no account needed. Pre-flight first — most readers should stop there.

What success looks like

For most readers: this is a tool you never use, and the right answer is "don't disavow, don't pay a monthly retainer for it, redirect that budget to content." For the rare reader who does need it: file submitted once, manual action lifted at the next-but-one recrawl (typically 4-8 weeks), and you never touch the disavow tool again.

0 / 21 · 0%

Critical Important Nice to have

Show only undone

Four gates. Most readers won't pass them, which is what the 2026 evidence says should happen. Be honest here: the wrong yes costs you weeks of work that go backwards; the wrong no costs you nothing.

Critical Check Search Console for an active manual action against unnatural links An active manual action for "unnatural links to your site" is the single universal trigger. Without it, Gary Illyes's public guidance is explicit: if you don't have a manual action, you don't need to submit a disavow. Everything downstream of this gate depends on it.

How to do this

Open Search Console. Left nav: Security & Manual Actions → click "Manual actions". If the panel says No issues detected, you don't have one — skip the rest of this checklist and stop worrying about disavow.
If the panel lists an action, read it. Only the "Unnatural links to your site" type is solved by disavow. Other manual-action types (thin content, user-generated spam, etc.) need completely different fixes; disavow won't help. If the exact label is missing, type "manual actions" into the Search Console top-bar search.
Critical Audit yourself for a confessed paid-link or PBN history The second legitimate trigger is operator-confessed: you (or a previous SEO on the site) bought links, ran a PBN, or joined a link scheme, and the donor sites won't take the links down on outreach. Without confessed history, you're guessing about a problem the algorithm already ignores.

How to do this

Step 1: open Search Console → Links → External links → Top linking sites. Sort by linking-page count.
Step 2: in writing, ask the client contact (and the previous agency-of-record if there is one): "Did anyone ever buy, sponsor, or place any of these links?" Document the answer in your audit file. Any "yes" is a confession.
Step 3: cross-reference suspected donors in Ahrefs (Site Explorer → enter domain → Backlinks) or Semrush (Backlink Analytics). A genuine PBN usually has a homepage link cluster pointing to 6-15 unrelated commercial sites; that footprint is stronger evidence than memory alone.
Step 4: run your anchor-text distribution through our analyzer. Spikes on exact-match commercial anchors from unrelated donors are the highest-probability paid-pattern tell.
Audit anchor distribution free
Important Ignore third-party toxicity scores as a reason to disavow Semrush's Toxicity Score and similar "spam" heuristics in third-party tools are internal models, not Google's judgment. Their own docs say so — Semrush's Backlink Audit help explicitly tells you to "be extremely careful when disavowing" and recommends Google's criteria (manual action or known scheme), not the score alone. Where these tools get misused isn't in the docs — it's in agency reports that print the score, attach a cleanup invoice, and skip the part where the tool itself tells you not to act on it.

How to do this

If your decision to disavow rests on "the vendor flagged N toxic backlinks", stop and re-read pf-01. A toxicity score with no manual action and no confessed history is not a reason to disavow — it's a reason somebody is selling you a cleanup package.
If a stakeholder demands action on a third-party report, treat the report as a candidate list for outreach review, never as a disavow list. Action: if your only evidence is a vendor toxicity report, mark pf-03 done by NOT proceeding. No file to write.
Important Confirm you have a manual action, not an algorithmic drop, before opening the disavow tool A manual action shows in Search Console and was reviewed by a human. Algorithmic suppression (post-Core-Update drops, Helpful Content losses, Penguin's quiet devaluation) doesn't, and wasn't. Disavow addresses only the first. People who file disavow files after a Core Update are fixing the wrong problem.

How to do this

If traffic dropped and Search Console says "No issues detected" under manual actions, your problem is algorithmic. Disavow does nothing for you. The fix is content + on-page work aligned with whatever update hit you.
One side-note: if your real complaint is "we aren't getting cited by AI anymore", the fix lives in content and brand mentions, not in a .txt file to Search Console — disavow is a Google Search lever only, with no documented effect on ChatGPT, Perplexity, Claude, or AI Overviews. Head to our GEO vs SEO guide instead.

The path from here is finite. Outreach, disavow the residue, reconsideration if applicable. Two to six weeks of work, not a forever subscription. Exactly one of the three below matches your situation. If none match, you don't need to disavow even though pre-flight passed — review your answers.

Critical Manual action present? Work the cleanup → disavow → reconsideration loop A real human reviewer at Google declared a class of inbound links unnatural and applied a manual penalty. The reconsideration workflow expects a disavow file as evidence of cleanup. Without it, the action won't be lifted.

How to do this

Workflow: try outreach first (ask donor sites to remove the link), disavow what won't remove, submit a Reconsideration Request from Search Console explaining the cleanup. Google's human reviewer expects to see the disavow file content inline in the request (see sub-04). Submit only after a meaningful outreach pass — Reconsideration Requests filed too quickly after disavow get rejected for lack of recrawl.
Use our free tool
Important Inherited PBN or paid-link history that won't take down? Disavow the residue after honest outreach If you (or a previous SEO on the site) ran a PBN, bought links from a network, or participated in any explicit link scheme, and donor sites won't take the links down on outreach, disavow is the next move. Google's algorithm now discounts most of this automatically — but this is the one case where being explicit is still defensible insurance.
How to do this
Run outreach for 4-6 weeks with a follow-up touch at day 10-14 before disavowing. PBN-residue reply rates run 8-15% (lower than standard removal outreach because half the contact addresses are dead or Cloudflare-proxy). Closing the window at week 3 drops the donors who would have replied at week 5.
Address outreach to the site owner, editor, or the contact on the about/imprint page — there hasn't been a "webmaster" inbox in a decade.
Disavow what won't respond after the second touch. Keep the outreach log (see tr-02 details below) — if a manual action lands later you'll need it for reconsideration.
Outreach log format — Google's reviewer scans it. Five columns, one row per donor:
donor_domain | email_sent_date | follow_up_date | reply_received (Y/N) | link_removed (Y/N)
Keep it in a Google Sheet, not an email folder. Attach a link to it (or paste the row count + removed count) in the Reconsideration Request.
Use our free tool
Important Concentrated TLD spam burst? Disavow the TLD (the negative-SEO edge case) Rare. A real concentrated spam attack — 500+ links from a single throwaway TLD (e.g. .xyz, .top, .icu) appearing inside 30 days, where every sampled donor is parked, dead, or obviously spam — is the one negative-SEO scenario where preemptive disavow is defensible. The undocumented domain:.xyz directive lets you disavow an entire TLD in one line.

How to do this

Confirm the pattern in Search Console → Links → External links → Top linking sites. The forensic signal is referring-domain growth-rate: a sudden 10x week-over-week new-referring-domain count alongside the TLD concentration is the real giveaway. Without that growth-rate spike, even a TLD concentration can be a legitimate niche directory cluster you forgot about.
If you're a junior on a client account: screenshot the External-links data before submitting so you can defend the call later, and get a senior to sanity-check before you submit. The domain:.xyz syntax is confirmed by multiple operators but undocumented in Google's official help.
Use our free tool

Six rules for the file itself. Two of these silently fail your submission: the file uploads, Google ignores it.

Critical Save the file as plain .txt, UTF-8 encoding, one directive per line Submit as .docx, .csv, or with curly quotes and the file uploads but Google ignores every line. You'll think you're disavowed and you're not. UTF-8 with a byte-order-mark (BOM) at the file start sometimes confuses the parser; export without BOM.

How to do this

VS Code: click the encoding indicator in the bottom-right status bar (it shows "UTF-8") → Save with encoding → UTF-8 (without BOM). Line endings: LF or CRLF both work.
Don't compose the file in Word or Google Docs — they auto-curl quote marks and occasionally insert non-breaking spaces that the parser silently rejects.
Critical Default to domain: — only use the bare-URL form for one specific page domain:badsite.com disavows every link from that domain. A bare URL (https://badsite.com/page) disavows just that page. Almost always you want domain: — spam patterns are site-wide, not single-URL.
How to do this
# Most cases — disavow the whole site domain:badsite.com # Rare case — keep the donor, lose one specific page https://goodsite.com/sponsored-post/
Critical Add # comments above every directive — date and reason Without comments, a year from now you (or the next agency) will see domain:somesite.com with no context, assume it was a mistake, and delete it — re-exposing the site to whatever you originally cleaned up. Comments are the artifact that survives team churn.
How to do this
# 2026-04-12 — PBN cleanup from previous SEO domain:linkfarm1.com domain:linkfarm2.com # 2026-05-26 — TLD spam burst, ~800 unsolicited links in 14 days domain:.xyz
Critical Triage the file: don't disavow your own links, partners, or known-good referrers The single most damaging operator mistake is bulk-exporting a "toxic links" list from a third-party tool and submitting without manual review. The list will include legitimate partner sites, your own subdomains, friend-of-friend directories, and other domains you actually want to keep. "Read every line" works at 200 lines, fails at 5,000. Use a triage workflow.
How to do this
Four-step triage that scales:
Tool-assisted sort + dedup. Our disavow generator handles both.
Allowlist diff. Cross-reference against (a) your own subdomains list, (b) the customer-logo-wall CSV, (c) any CRM partner export, (d) directories you intentionally submitted to. Any overlap is a candidate to keep. This is the highest-value 10 minutes in the entire audit.
High-authority spot-check. Sort by DR/DA descending (Ahrefs export); eyeball the top 50. A stray legitimate domain in the high-DR section costs you the most ranking, so it earns the most attention.
Random sample. 200 random lines from the middle of the file, read them. Catches whatever the allowlist missed.
Critical Submit through a URL-prefix Search Console property, not a Domain property Google's disavow tool only accepts URL-prefix properties (e.g. https://yoursite.com/). Submit from a Domain property (the DNS-verified one) and the upload button is missing — or worse, looks fine and silently doesn't run. Operators waste a day looking for the upload before realising they need the other property type.

How to do this

How to tell which property type you have: if you verified by DNS TXT record, it's a Domain property. If you verified via HTML file upload or HTML meta tag, it's URL-prefix.
If you only have a Domain property: add URL-prefix properties for each protocol/host combination (https://yoursite.com/ and https://www.yoursite.com/), verify each, then submit the disavow file from the URL-prefix property that matches your canonical host.
One related gotcha: if blog.example.com and example.com are separate URL-prefix properties, a disavow on the root does NOT cover the subdomain. Check property scope before submitting on multi-subdomain clients.
Nice Use domain:.tld syntax only when tr-03's threshold is met (undocumented) For the rare concentrated-TLD-spam-burst case (tr-03), the syntax is domain:.xyz — with the leading dot. Multiple operators have confirmed it works; Google hasn't officially documented it. Use only after exhausting per-domain options and only if tr-03's numeric threshold (500+ links / 30 days / all sampled donors parked) holds.
How to do this
# Disavow every link from any .xyz domain domain:.xyz
Comment the line with the spam pattern + date — this is exactly the kind of irreversible-looking move future-you needs context for.

Five steps between "saved the file" and "Google has registered the cleanup". Skipping any of these is how operators submit and then panic-resubmit weeks later.

Critical Generate the file from your actual link profile, not a vendor toxicity export Build the file from your own Search Console link export plus your manual cleanup list. Don't dump a vendor "toxic links" CSV into it — that's the vendor's model of bad, not Google's. This is where most operators sabotage themselves.

How to do this

Use our free disavow file generator to format the entries correctly (domain: vs URL, comments, deduplication). Paste the domain list you actually want to disavow; the tool produces a Google-ready .txt.
Use our free tool
Critical Diff against the current file before submitting — the new file fully replaces the old Each submission FULLY REPLACES the previous file for that property. If your current file has 200 domains and the new one has 20, the 180 you omitted are no longer disavowed. The 180-domain silent-drop catastrophe is the worst way to spend a Monday.

How to do this

Disavow tool lives at search.google.com/search-console/disavow-links-tool. Before submitting the new file: download the current one from the same tool, diff it against the new file, confirm you're adding (not losing) the entries you mean to keep.
Critical After upload, read back the submitted file to confirm it matches what you sent Google's tool occasionally accepts an upload and shows the previous file unchanged. A 30-second read-back-after-submit catches "I thought I submitted last month" disasters before they cost you 6 weeks.

How to do this

After clicking submit, refresh the disavow tool. Confirm the timestamp updated and the file shown matches what you uploaded. If it doesn't, re-upload — don't assume.
Critical If this was for a manual action: file the Reconsideration Request with the operator-tested template Disavow alone does not lift a manual action. Search Console → Security & Manual Actions → click "Request review". The reviewer's bar is specific: clean ownership boundary, outreach log with counts, sample of the actual disavow file, named human signature, policy change. Expect 1-2 rejections before approval on dirtier histories — iterate.
How to do this
Five-point operator template that gets approved:
One-paragraph context. "Site received a manual action for unnatural links on [date]. The unnatural links originated from [previous-agency-name / previous-in-house-SEO / 2019-2021 link-building program] which has been terminated. Cleanup is complete as below."
Outreach log. Total donors contacted (N), email send-date range, follow-up touches (Y/N), replies received (M), links removed via outreach (R). Link to the row-level Google Sheet.
Disavow file inline. Submitted on [date], URL-prefix property, M domains. Paste 10-20 representative lines (with the # comments) directly in the request body — reviewers do not re-fetch your .txt; they want to see it without leaving the form.
Policy change. Name what you've changed so it won't recur: "We have terminated [X]. Future link acquisition is restricted to [editorial / digital PR / sponsored-content marked rel=sponsored only]. Approver: [name + title]."
Named human signature. Anonymous "the SEO team" requests get longer review cycles — sign with name, title, date.
Important Wait several weeks before resubmitting — processing isn't instant Google's docs say disavow takes effect as the affected URLs are next recrawled. In practice that's 2-6 weeks for the bulk, longer for low-priority donor domains. Don't resubmit twice in a week thinking it didn't land — check the file you uploaded is the right one, then wait.

How to do this

Set a calendar reminder for 8 weeks out: "Re-check disavow impact". Compare the Manual Actions page (cleared?) and the link profile in Search Console.

Three anti-patterns that show up in nearly every disavow-cleanup post-mortem. If you're about to do any of these, stop.

Critical Don't disavow after a Core Update drop — disavow doesn't fix that Core Updates and Helpful Content updates rank by content quality and site-level signals. Disavow addresses link-graph signals only. Submitting a disavow file after a Core Update drop is the single most common operator mistake we see — and it costs weeks of work in the wrong direction, often without recovering until the next-but-one recrawl cycle.

How to do this

If the drop coincides with an announced Core Update date, treat it as a content problem. Audit pages for relevance, depth, intent match, and originality. Read the quality-rater guidelines section relevant to the update type. Don't open the disavow tool.
Important Don't run a quarterly "preventative" disavow process — kill the line item Quarterly disavow is the agency upsell pattern Google has explicitly warned against. Mueller's 2024 statement called it a billable waste of time. A disavow file is a remediation tool used once when needed, not a subscription. Five pieces of evidence point the same way: Mueller 2024, SpamBrain 2022, Penguin 4.0 2016, Bing retired the tool in October 2023, and Glenn Gabe's 0.01% figure (one site in ten thousand).

How to do this

If your current agency has a recurring disavow-file line item, ask: which of the three legitimate triggers (manual action, confessed paid links, concentrated TLD spam burst) is this against? If they can't name one, kill the line item. Audit step for incoming agencies: pull the last 4 disavow files the previous agency submitted, bucket each domain into one of the three triggers. Anything unbucketable flags the retainer for cancellation. Redirect the budget to content or on-page work — both of which actually affect 2026 SEO.
Important Don't disavow alleged "negative SEO" without concentrated evidence Real negative-SEO attacks (the kind that warrant disavow) show as concentrated patterns: one TLD, one IP range, one timeframe, sudden 10x week-over-week new-referring-domain spike. A scatter of sketchy-looking donor sites across years is not an attack — it's the open web's long tail. Penguin and SpamBrain already discount it.

How to do this

Before crying negative SEO: plot the new donor domains by week and by TLD. Is there a spike in any single week with a single-TLD dominance? Yes → trigger tr-03 (verify the 500+ links / 30 days / parked-donor threshold first). No → leave it alone.

About the Author

Andrei

SEO and digital marketing professional with 13+ years of experience. Started as a website administrator in 2011, transitioned to SEO, and achieved top-3 rankings for competitive keywords. Co-founded a consulting firm specializing in marketing audits for companies in Ukraine and internationally. Built LinkGuard to solve the problem he experienced firsthand: most SEO teams purchase links but never monitor their survival. Based in Kyiv, Ukraine.

The disavow file checklist: when to use it (and when most sites shouldn't)

Andrei

Vocabulary, before we start

What success looks like

Pre-flight — do you actually need to disavow?

If you passed pre-flight: the three honest triggers

Mechanics — write the disavow file correctly

Submit and verify

What NOT to do

Tags

About the Author

Andrei

Vocabulary, before we start

What success looks like

Tags

About the Author

Andrei

Related Articles

Quarterly backlink audit checklist for agencies: 40 items for 2026

On-page SEO optimization checklist: 35 items for the 2026 audit

Site migration SEO checklist: 37 items for surviving a 2026 domain move