A backlink audit after leaving an agency has one job: find out whether the links they built were bought, and whether any of them are the kind Google acts on.
Most of what you will find is harmless. A small share might not be. The point of the audit is to tell the two apart before you decide to do anything, because the most common mistake is doing too much.
You do not need a paid tool for this. Google Search Console gives you a sample of your links for free, one free account at a backlink tool fills in anchors and dates, and the rest is pattern matching you can do in a spreadsheet in an afternoon. It pairs well with the technical SEO checks you can run in an afternoon.
Check the Manual Actions report before anything else
Open Search Console, go to Security and manual actions, then Manual actions, and read what it says. If it says "No issues detected", the rest of this audit is about judgement and tidiness. If it names "Unnatural links to your site", you have a fixed problem with a fixed process, and everything below applies with more urgency.
Google's own wording for that action is that it "has detected a pattern of unnatural, artificial, deceptive, or manipulative links pointing to your site". The help page also says the action is targeted at the links, not your whole site, and that if you cannot control the links, no action is needed because they already do not count.
In practice, a link manual action in 2026 is rare for a small UK business site. We see far more owners who are worried about one than owners who have one. Check, then move on.
Export the Links report from Search Console
The Links report is in the left-hand menu of Search Console. It has three external tables that matter for this audit: Top linking sites, Top linking text and Top linked pages. Each table in the interface shows at most 1,000 rows, and Google's help page for the report says it "is a sample, not a complete list".
Use the Export button on the report's landing page, not the download buttons on the individual tables. The same page says that export gives you up to 100,000 rows in two slices. "Latest links" is sorted by discovery date, which is the useful one here, because an agency's links will cluster around the months they were paid.
Two limits to know before you start sorting. The report groups data by root domain, so one site with 400 links shows as one row. And it "doesn't indicate whether a link is nofollow", so you cannot tell from Search Console alone whether a sponsored article was qualified properly. That is what the second tool is for.
Add one free backlink tool for anchors and dates
A free Ahrefs account, verified against your own site, shows your backlinks, referring domains and anchor text in Site Explorer. Ahrefs' help page says the free tier is "available for websites you can prove ownership for" with "1000 backlinks & keywords visible at once". Verification is done through Search Console or a DNS record, so it takes ten minutes.
What you gain over Search Console is the per-link detail: the anchor text on each link instead of an aggregate, whether it is nofollow or sponsored, the first-seen date, and the linking page's own traffic. Those four columns are where bought links give themselves away.
Export the referring domains list and the backlinks list, put them in a spreadsheet beside the Search Console export, and work through them with the patterns below. If your site has more than 1,000 backlinks, the free tier shows a sample, which is fine. You are looking for patterns, not completeness.
Five signs the links were bought
Bought links share footprints because they are produced in bulk, and bulk production leaves marks. Google's spam policies page, last updated in August 2026, lists most of these directly. Go through your exports looking for each one.
- Private blog network footprints. A cluster of sites with generic names (think "businessnewsdaily" style domains with a number or a hyphen), thin content on random topics, no author, no contact page, no traffic in the tool, all linking to you within the same few weeks. Google calls these "sites used for the purpose of passing outgoing links".
- Irrelevant foreign sites. A Northampton plumber with 30 links from Indonesian, Vietnamese or Russian-language blogs did not earn them. One or two from a scraper site is noise. A cluster, dated during the agency's contract, is a purchase.
- Exact-match commercial anchors. Your Top linking text should be dominated by your brand name, your URL and "(empty)" for image links. If "emergency plumber northampton" or "best accountants milton keynes" is in the top ten, someone paid for it. Google's policy names "links with optimized anchor text in articles, guest posts, or press releases".
- Sitewide footer or sidebar links. One domain giving you hundreds of links from every page is almost always a footer placement. Google's list includes "widely distributed links in the footers or templates of various sites".
- Sponsored articles without the sponsored attribute. The policy states that buying links is "not a violation of our policies to have such links as long as they are qualified with a rel="nofollow" or rel="sponsored" attribute". A paid guest post with a plain followed link is the single most common thing an old agency leaves behind.
A sixth sign is not a link pattern at all. If the agency reported "links built" every month but never named the sites, the links were bought, because earned coverage gets shown off. That is the same gap as paying for SEO link-building that is really theatre. When we take over from another agency we ask the client for the outgoing agency's monthly link reports and any invoices from link vendors, which usually answers the question before the audit starts. Many of these handovers are professional services firms that never saw a single link being built and only have the invoices to go on.
Link pattern, risk and what to do
| Pattern you found | Risk in 2026 | Action |
|---|---|---|
| Handful of odd links from unknown sites, spread over years | Low. Mueller: "Random links collected over the years aren't necessarily harmful" | Nothing |
| Scraper and spam directories you never asked for | Low. Google says it works to stop third-party sites harming you | Nothing |
| Sponsored posts with followed links, under ten of them | Low to medium | Email the site and ask for rel="sponsored"; note it, do not disavow |
| Exact-match anchors in your top linking text | Medium | Trace the sources; ask for anchor change or removal; disavow only the ones that are clearly paid |
| Sitewide footer link from one domain | Medium | Ask for removal; if it was paid and refused, disavow the domain |
| PBN cluster, dozens of domains, same dates | Medium to high | Disavow the domains; keep the file to just these |
| Manual action for unnatural links | High | Remove what you can, disavow the rest, reconsideration request |
The reason the risk column says "medium" rather than "high" for most paid patterns is Google's own account of what its systems do. The December 2022 update used SpamBrain to "detect both sites buying links, and sites used for the purpose of passing outgoing links", and Google said that "any credit passed by these unnatural links are lost". Lost credit is the usual outcome, not a penalty.
That is also why an old agency's "we built 200 links" sometimes coincides with no ranking movement at all. The links were neutralised as they were found. You paid for them and received nothing, which is a contract problem, not a search problem.
Where the disavow tool stands in 2026
The disavow tool still exists, Google still says most sites do not need it, and Google staff have said for two years that they expect it to go eventually. All three are true at once, and the order matters.
Google's disavow help page opens with "This is an advanced feature and should only be used with caution" and says "most sites will not need to use this tool". It gives two conditions, both of which must hold: "a considerable number of spammy, artificial, or low-quality links pointing to your site", and that those links "have caused a manual action, or likely will cause a manual action". One unwanted footer link does not meet either.
In May 2024, John Mueller said on X that he was confident Google would eventually retire the tool, with no timeline, and Gary Illyes told a Pubcon audience "If it were up to me, I would do away with the disavow link tool", as reported by Userp. As of October 2026 it has not been retired. It is still in Search Console, and it still does not support Domain properties, so you need a URL-prefix property to upload a file.
The most recent Google comment we can find is from September 2026. A site owner on Reddit had bought guest posts through Fiverr, disavowed heavily, and lost rankings. Mueller's reply, reported by Search Engine Roundtable, was that the tool "has its place & time, it does have effects", and that "disavowing a handful of links is not going to make your site drop out of search". His advice to that owner was to cut the file back to only what was needed, "which might be an empty file".
"Disavow links that were really paid for (or otherwise actively unnaturally placed)." John Mueller, Google, via Search Engine Journal
That 2019 line is still the best one-sentence rule. The tool is for links you or your agency placed on purpose, that you cannot get removed, in enough volume to look like a scheme. It is not for everything a tool paints red.
If you do use it: one domain or URL per line, "domain:example.com" to cover a whole site, saved as a UTF-8 .txt file, uploaded by a verified owner of the property. Google says "it can take a few weeks" to take effect, and it will not tell you when it has.
When to do nothing
Do nothing when the Manual Actions report is clean, the suspicious links are fewer than a few dozen, and your rankings have not moved since the agency left. That describes most small business sites we look at. The audit was still worth doing, because now you know what the old agency did, and you can read the next agency's proposal with that in mind.
The forum record on this is consistent and old. In a 2017 UK Business Forums thread, one agency owner said his firm had stopped offering link clean-up after disavow files hurt client rankings, and a moderator asked whether deleting one good link by accident was worth the risk of removing thousands of bad ones. In another thread from the same year, the advice was "If in doubt it's generally best not to disavow". Nine years on, Google's September 2026 comments say the same thing.
Where owners go wrong is the toxicity score. Paid tools assign a number to every link, and a number invites a reaction. Google does not use those scores and has said repeatedly that it ignores the kind of link they flag. If the only evidence against a link is a third-party score, leave it.
What to do with sponsored posts you cannot fix
Email the publisher and ask them to add rel="sponsored" to the link, and most will, because it protects them too. Google's policy applies to the site selling the link as much as the site buying it, and SpamBrain's 2022 update explicitly targeted "sites used for the purpose of passing outgoing links". A publisher who refuses is telling you what kind of site they run.
If they refuse and the post is one of many, it goes in the disavow file. If it is one of three, it does not. The threshold Google gives is "a considerable number", and three is not that.
Keep a record either way. A short document listing the agency, the dates, the domains you found, what you asked for and what you did is the thing you will want in a year if rankings drop and someone asks whether the old links could be the cause. An off-page review by a new agency should start from that record, not repeat the audit from scratch.
The decision rule we use is simple: disavow only links that were bought, in volume, that you could not get removed or qualified. Everything else is a note in the file and a question for the next agency about what they will do differently.
Where a backlink audit sits in a sensible retainer is covered in our guide to what a UK SEO agency should cost and deliver. If you would rather have someone else read the exports and tell you which of the three rows in the table you are in, our SEO audits include a backlink review, or you can contact us with your Search Console export and we will tell you whether it needs one.