Quick-Win: Find Toxic Links Free with GSC — Export your links from the Google Search Console (GSC) Links report, run fast spreadsheet filters, and produce a cleanup list for removal or disavow without buying tools. This guide gives exact GSC clicks, export steps, and spreadsheet formulas for a rapid triage you can share with your team.
Why this is a Quick Win — when to use GSC only
This workflow is built for immediate triage: no paid tools, fast exports, and spreadsheet-only analysis that yields a shareable cleanup list in under an hour for small–medium sites (hundreds to a few thousand referring domains). Use GSC-only when you need a quick answer to whether suspicious links exist and which referring domains require fast action.
- Use this approach when you want a fast, free check (no third-party subscriptions).
- Good for initial triage after a traffic drop, a manual action notification, or when you spot a sudden spike in link velocity.
- Not a replacement for a full backlink audit — it’s a rapid triage to find obvious toxic signals and prepare a disavow-ready list.
Checklist — when to use GSC-only:
- You’re under time pressure for initial cleanup.
- Data volume is manageable in a spreadsheet (<5k rows preferred).
- You need shareable CSV output for a legal team or developer.
Transition: First, understand what GSC shows (and what it doesn’t) so you don’t rely on incomplete signals.
What you can (and can’t) see in Google Search Console Links report
The Google Search Console (GSC) Links report provides a useful baseline: top linking domains, top linking pages, anchors, and basic link counts. However, GSC intentionally omits some details third-party tools provide (exact referring page crawl dates, full anchor context, and complete historical link velocity). Below is a quick comparison to set expectations.
| What GSC shows | What it misses | Workarounds |
|---|---|---|
| Top linking domains, Top linking pages, Top linking text, link attributes summary (NoFollow/UGC/Sponsored visible in limited way) | No complete timestamped history for each link, incomplete URL lists (sampled), no automated IP/hosting cluster analysis | Export CSV and cross-check suspicious domains via WHOIS and Wayback; use spreadsheet date fields to infer velocity from GSC exports over time |
| Referring domain counts and example linking pages | Exact link discovery time and full list of anchors from each domain | Re-export periodically and compare CSVs (sheet formulas) to approximate link velocity |
| Link attributes preview (NoFollow / UGC / Sponsored flags shown per link) | Doesn’t always label every link attribute consistently; doesn’t show rel attributes for every link in export | Manually inspect sample pages and use free site snapshots (Wayback) to confirm attribute usage |
Caveat: According to a 2024 Google Search Central help article, GSC data can be delayed and is intentionally pruned, so assume GSC provides a representative sample rather than a full crawl log. Transition: now export everything you can from GSC.
Accessing and exporting your links from GSC (step-by-step)
Open Google Search Console (GSC) Links report and export the “Top linking sites” and “Top linking pages” CSVs to build a consolidated sheet. Below are exact clicks and screenshot placeholders to follow.
- Sign in to Google Search Console and select the property (domain or URL-prefix) for the site you’re auditing.
- In the left navigation, click Links to open the Links report.
- Under “External links” find Top linking sites. Click the “Export external links” icon (three dots) and choose “Export CSV”.
- Repeat for Top linking pages and Top linking text (anchor text) — export each as CSV / Google Sheets.
Screenshot placeholders (replace before publishing):
Figure 1: GSC Links report — Top linking sites (sample screenshot — 2026-06-05)
Figure 2: GSC Links report — Top linking pages (sample screenshot — 2026-06-05)
Figure 3: Export flow — click ‘Export’ > ‘CSV’ (sample screenshot — 2026-06-05)
Exact GSC navigation steps to export CSV (keyboard/menu actions):
- Open property → left nav → Links.
- Click the “External links” card → “Top linking sites” → click the vertical three-dot menu → Export > Download CSV.
- Click “Top linking pages” → same export flow. For anchor data: “Top linking text” → export CSV.
- If you prefer Google Sheets: choose “Open in Google Sheets” from the export menu for direct import into Google Sheets.
Save all CSVs in one folder and label them as: links-top-linking-sites.csv, links-top-linking-pages.csv, links-top-linking-text.csv, and note the export timestamp — we’ll use it to infer link velocity. Transition: import and normalize these exports for fast analysis.
Preparing the export for fast analysis (spreadsheet setup)
Open a new Google Sheet (or Excel). Import the three CSV exports onto separate tabs named: Sites, Pages, Anchors. The goal: create a unified table keyed by normalized referring domain and linking URL so you can triage quickly.
Step A — Import CSVs
- Google Sheets: File > Import > Upload > choose CSV > Insert new sheet(s).
- Confirm the first row is treated as headers. Rename sheets to Sites, Pages, Anchors.
- Timestamp your sheet name (e.g., Sites_2026-06-05) to track exports over time.
Step B — Normalize domains and URLs
On the Sites tab, create a new column “RefDomain” that contains the normalized referring domain (naked domain without protocol or subpath). Use these formulas (Google Sheets):
- Extract domain from URL: =REGEXEXTRACT(A2,”https?://([^/]+)”) — where A2 is the linking page column.
- Normalize to naked domain (remove www): =LOWER(IF(LEFT(B2,4)=”www.”,RIGHT(B2,LEN(B2)-4),B2)) — where B2 is the domain extract.
Example combined formula (one step):
=LOWER(IFERROR(REGEXREPLACE(REGEXEXTRACT(A2,”https?://([^/]+)”),”^www\.”,””),””))
Step C — Build a master sheet
- Create a new sheet named “Master”.
- Copy columns: RefDomain, LinkingPage, AnchorText, LinkCount (from Sites and Pages exports) so each row is one linking URL or domain instance.
- Remove exact duplicate linking pages: Data > Data cleanup > Remove duplicates (in Sheets) or use UNIQUE in a helper column: =UNIQUE(ExistingRange).
Step D — Key formulas you’ll need
Use these exact formulas to create quick signals:
- Count referring pages per domain (in Master): =COUNTIF(Master!$A:$A, A2) — count pages where RefDomain = A2.
- Unique referring domains list: =UNIQUE(Master!A2:A) — returns unique domains.
- Flag identical anchors across domain: =COUNTIFS(Master!$A:$A,A2,Master!$C:$C,C2) — counts same anchor within the same domain.
- High anchor repetition ratio (percentage): =IF(D2=0,0, E2/D2) where D2 = total anchors from domain and E2 = anchors matching suspicious anchor.
- Extract TLD-only domain (for domain-level disavow decision): =REGEXEXTRACT(A2,”[^.]+\.[^.]+$”)
- IP / hosting cluster quick lookup helper (placeholder): create a column “IP” and paste IPs from a free IP lookup; use =VLOOKUP(A2,IPLookupRange,2,FALSE) if you build a lookup table from bulk IP results.
Step E — Useful spreadsheet shortcuts and menu actions
- Google Sheets: Ctrl+F to find suspicious anchors; Data > Create a filter for quick sorting.
- Excel: Text to Columns > Delimited > Comma to split CSV fields; use Filter button to enable column filters.
- To remove duplicates by domain: Data > Remove duplicates (select domain column only).
Step F — Generate the shareable CSV-ready output
- Create a “Cleanup” sheet with columns: Action, Type (domain/url), Target, Reason, Evidence (link to sample), ExportTime.
- Populate Action values as REMOVE / CONTACT / DISAVOW based on quick scoring (see triage rubric below).
- Export Cleanup sheet as CSV: File > Download > Comma-separated values (.csv).
Trade-offs and domain vs URL normalization:
- Domain-level disavow (domain:) is broader — use when a domain shows multiple spam signals or many bad pages. Use URL-level disavow when the problem is a single page on an otherwise legitimate site.
- Normalization can hide subdomain differences — e.g., blog.badsite.com may be different from badsite.com. Use REGEXEXTRACT carefully and inspect examples manually before applying domain-wide actions.
Transition: With your sheet ready, run the red-flag scans below to mark likely toxic links.
Red flags to spot in the GSC export — fast toxic link detection heuristics
Scan your Master sheet for these rapid signals. If a referring domain triggers multiple red flags, escalate quickly for removal or disavow.
13 backlink red flags in marketplaces — Many red flags in your export match patterns we list in 13 backlink red flags in marketplaces — check that guide for marketplace-specific examples.
audit paid links and reduce risk — If you find suspicious guest-posts or paid placements, see our audit paid links and reduce risk guide for specific detection and remediation tactics.
PBNs vs Marketplaces: Link Risk Compared — Some suspicious domains in your export may be PBNs—compare indicators in PBNs vs Marketplaces: Link Risk Compared.
- Low-quality directory or odd “yellow pages” sites — indicator: many domains with similar templated pages and minimal unique content. Quick check: open three sample linking pages; content under 300 words or repeated templates. Example filter: =FILTER(Master!A2:C, REGEXMATCH(Master!B2:B,”directory|submit|listings”))
- Comment spam / blog comments — indicator: anchor texts like “great post” or URLs in body comments. Use COUNTIFS to find many links to a single page with short anchors: =COUNTIFS(Master!$B:$B,B2, LEN(Master!$C:$C)<15)
- Gibberish anchor text or keyword-stuffed anchors — >90% identical anchor across many domains is suspicious. Formula to calculate identical-anchor ratio per domain: identical_count / total_links; flag when >0.9.
- Automated networks / link farms — indicator: clusters of domains with similar WHOIS data, same IPs, or identical footer links. Use IP lookup batch then pivot by IP to find clusters (see IP / hosting cluster indicators below).
- High link velocity spike — sudden large increase in referring domains across recent exports. Compare exports via sheet: new_domains = COUNTIF(ExportDate2!A:A,”<>“) – COUNTIF(ExportDate1!A:A,”<>“) — flag if spike >50% in 7 days.
- Unrelated topicality — example: your medical site receives many links from gambling or payday-loan directories. Quick check: open 3 sample pages and review content topic and ad density.
- Multiple links from same template URL structure — e.g., /author/12345 or /?p=9999 across many domains. Use REGEXEXTRACT to find repeated URL patterns and flag.
- Expired or parked domains linking to you — WHOIS shows recent re-registration or domain forwarding. Quick WHOIS check reveals new owner within weeks of linking spike.
- High proportion of NoFollow/UGC/Sponsored attributes — if many links are NoFollow, they’re low SEO value; if many are UGC/sponsored when not expected, suspect paid placement abuse. GSC shows attributes in the Links report (sampled).
- Repeated footer links across many domains — identical HTML snippet across domains suggests an automated placement or network. Sample-check the page source for identical anchor + surrounding text.
- Referring domains with zero organic traffic — according to a 2023 industry study (tool data sample), domains with no organic traffic are more likely to be low-quality or link farms. Use free SimilarWeb/Alexa samples to estimate traffic where needed.
- Anchor diversity too low — if >70% of anchors to your site are commercial keywords, treat it as a signal (thresholds: 70% identical anchors = high risk).
Quick checks (one-minute each):
- Open three linking pages — if all look templated or ad-heavy, mark domain high-risk.
- Use WHOIS (link below) to see recent registrant changes.
- Check Wayback snapshots to confirm whether content was recently created or scraped.
Transition: flagged items need prioritization — next we score and act.
Quick triage: prioritize which links to remove, contact, or disavow
Think of triage like an emergency room — treat the worst offenders (highest risk) first. Use a simple points-based rubric to prioritize actions. If a domain scores above a threshold, escalate to removal attempts or immediate disavow listing.
Manual Action vs Algo Drop: Diagnose Links — If your traffic drop looks severe, use Manual Action vs Algo Drop: Diagnose Links to determine whether links are likely the root cause.
Mini scoring rubric (example):
| Signal | Points |
|---|---|
| Low-quality directory / templated pages | +3 |
| Gibberish / exact-match anchors >90% | +3 |
| Multiple pages from same domain linking | +2 |
| Recent registration/parked domain | +2 |
| Same IP / hosting cluster with other bad domains | +2 |
| No organic traffic on referring domain | +1 |
Scoring example and actions:
- 0–2 points: Monitor (low priority).
- 3–4 points: Contact webmaster for removal (medium priority).
- 5+ points: Immediate removal + add to disavow-ready list (high priority).
Prioritized checklist (fast):
- Sort Master sheet by total score (descending).
- For top 20 domains: capture evidence (screenshot, page URL, date) and attempt contact via site contact form or WHOIS email.
- If contact fails after two attempts (one week apart), mark for disavow. Use domain-level disavow for cluster spam unless only a single URL is spammy.
De-risk Old Guest Posts with rel=sponsored — For older guest-post links you can contact the publisher to add rel=’sponsored’ and de-risk the link — see De-risk Old Guest Posts with rel=sponsored.
False positives vs false negatives:
- False positives: Legitimate niche directories or partner sites may look odd but be harmless. If in doubt, try contacting the site owner before disavow.
- False negatives: Some PBNs are built to mimic legitimate sites; use IP/WHOIS cross-checks to catch them.
Transition: Once your cleanup decisions are made, build a disavow-ready file from the cleanup sheet quickly.
Format a disavow-ready list from your GSC export (summary + link to full guide)
When you have a Cleanup sheet full of targets, format the disavow file as plain text with exact lines. Below is the short, GSC-only process to produce disavow-ready lines — for the full submission and extra precautions, follow the linked step-by-step guide.
- Open your Cleanup sheet and filter for Action = DISAVOW.
- Decide domain-level vs URL-level per row. For domain-level: prefix with domain:. For URL-level: use full URL.
- In a new text file (UTF-8), paste one target per line. Add short comments (prefixed with #) for internal notes.
- Save as disavow.txt and keep a copy in your audit folder with evidence screenshots.
Sample formatted lines (example only):
# example/sample data — not live domain:bad-directory-example.com domain:cheap-links-network.net https://example-bad-page.com/spam-post-123
Build a Google Disavow File — Step-by-Step — When your cleanup list is ready, follow Build a Google Disavow File — Step-by-Step for exact formatting and submission instructions.
Reconsideration Request Template for Link Spam — If you receive a manual action, pair your disavow and cleanup with our Reconsideration Request Template for Link Spam.
Caveat from Google: According to a 2024 Google Search Central help article, use the disavow tool only for webspam you cannot remove manually; incorrect use can cause loss of link credit.
Transition: below is a practical example using sample data so you can see the before/after workflow.
Example walkthrough — real exported file to cleanup list (annotated)
The following is a fabricated sample export labelled clearly as “example/sample data — not live.” It demonstrates raw GSC export, normalization, scoring, and final cleanup rows.
Sample raw export (Sites tab) — example/sample data — not live:
| Linking Page | Anchor Text | Referring Domain | Link Count |
|---|---|---|---|
| http://cheap-links-network.net/post/1 | best-loans-online | cheap-links-network.net | 12 |
| http://bad-directory-example.com/listing/455 | medical-directory | bad-directory-example.com | 4 |
| http://legitpartner.com/blog/guest-post | insulin treatment guide | legitpartner.com | 1 |
| http://spam-comments.site/article?id=234 | great post | spam-comments.site | 20 |
| http://pbn-cluster01.com/page/9 | best-loans-online | pbn-cluster01.com | 8 |
Annotated processing steps (example/sample data):
- Normalize domains with =LOWER(REGEXREPLACE(REGEXEXTRACT(A2,”https?://([^/]+)”),”^www\.”,””)) → yields cheap-links-network.net, bad-directory-example.com, etc.
- Count anchors per domain → cheap-links-network.net shows 12 links with identical commercial anchor “best-loans-online” → high-risk.
- WHOIS check (example): cheap-links-network.net recently re-registered (within 2 weeks of link spike) → add +2 points.
- IP cluster lookup: pbn-cluster01.com and cheap-links-network.net resolve to the same hosting IP range → add +2 points for cluster.
Sample scoring output (Master sheet excerpt):
| RefDomain | TotalLinks | IdenticalAnchorRatio | WHOISRecent | IPCluster | Score | Action |
|---|---|---|---|---|---|---|
| cheap-links-network.net | 12 | 1.00 | Yes | Yes | 10 | DISAVOW |
| bad-directory-example.com | 4 | 0.75 | No | No | 5 | CONTACT |
| legitpartner.com | 1 | 0.00 | No | No | 0 | MONITOR |
| spam-comments.site | 20 | 0.95 | Yes | Yes | 9 | DISAVOW |
| pbn-cluster01.com | 8 | 1.00 | Yes | Yes | 9 | DISAVOW |
Final Cleanup sheet (excerpt) — example/sample data — not live:
| Action | Type | Target | Reason |
|---|---|---|---|
| DISAVOW | domain | domain:cheap-links-network.net | High anchor spam, IP cluster, recent reg |
| CONTACT | domain | domain:bad-directory-example.com | Template listings, moderate anchors |
| MONITOR | url | https://legitpartner.com/blog/guest-post | Legitimate guest post |
Outcome example (sample): removed 12 referring domains via contact, added 5 domains to disavow.txt, and saw no immediate traffic harm from conservative domain-level actions. These are illustrative numbers for the sample.
Transition: before you act, run a few free external cross-checks to avoid mistakes.
Quick cross-checks using free signals (optional checks that catch false positives)
Use free external checks to confirm whether a flagged domain is truly spammy.
- Wayback snapshots — check whether linking pages are recent or were repurposed: Wayback Machine.
- WHOIS lookup for registration changes and contact emails: ICANN WHOIS.
- IP / hosting cluster quick method: run a bulk DNS/IP lookup and pivot on IP to find many flagged domains sharing the same IP range (free online IP lookup services or command-line ‘nslookup’).
- Site content quality: view page HTML and check for heavy ads, thin content (<300 words), and replicated templates; Wayback can show if content is scraped.
- Traffic signals: use free SimilarWeb samples or the Ahrefs blog posts for patterns indicating suspicious linking behavior.
Mini checklist — one-minute cross-checks:
- WHOIS recent change? (Yes = suspicious)
- Wayback shows new pages created at spike time? (Yes = suspicious)
- IP cluster with other bad domains? (Yes = suspicious)
- Page content thin or duplicate? (Yes = suspicious)
Note: For guidance on common spam patterns and research-backed indicators, see the industry write-ups from Moz and SEMrush (linked below).
Moz / SEMrush — use these for deeper pattern examples and technical checks.
Transition: finish with monitoring and recurring audits to keep link risk low.
Next steps, monitoring, and where to learn more
After you export, clean, contact, and prepare a disavow file, put ongoing monitoring in place. Schedule periodic GSC exports and compare them with previous snapshots to detect link velocity spikes early.
5-step action plan:
- Export Links report weekly for 4 weeks, then monthly once stable.
- Keep a versioned folder of exports (timestamped CSVs) and a Running Master sheet with historical flags.
- Automate notifications: set a calendar reminder to repeat the quick audit after major campaigns or content updates.
- Attempt 1–2 contact attempts for removals before disavow; document each attempt in Cleanup sheet.
- If you receive a manual action, pair cleanup with a Reconsideration Request.
The Complete Beginner’s Guide to Link Risk & Penalty Recovery — For a full walkthrough of link risk concepts and long-term penalty recovery, read The Complete Beginner’s Guide to Link Risk & Penalty Recovery.
Monitor metrics to watch: organic sessions, ranking SERP positions for target keywords, and the number of referring domains in GSC over time. Small disavows usually take weeks to show impact; a manual action requires a different path (see linked guides).
Transition: below are short FAQs to answer common quick questions.
Frequently Asked Questions
What is a toxic backlink and how can GSC help me find one?
A toxic backlink is a link from a low-quality or spammy site that risks harming your rankings. GSC helps by listing top linking domains/pages and anchor text so you can spot obvious spam signals (templated pages, gibberish anchors, sudden link velocity) and export CSVs for spreadsheet triage.
How do I export all my backlinks from Google Search Console?
Open your property → Links → under External links export “Top linking sites”, “Top linking pages”, and “Top linking text” using the Export menu. Choose CSV or Google Sheets and save each export with a timestamp for later comparison.
Which red flags in a GSC export mean a link is likely spammy?
High-risk red flags include templated directories, >90% identical anchor text across many domains, hosting/IP clustering, recently re-registered domains, and pages with thin or duplicated content. Multiple flags on a domain increase urgency to disavow or remove.
Can I rely on GSC alone to find every toxic link?
No—GSC provides sampled and delayed data. It’s excellent for fast triage but can miss links; use GSC for quick cleanup and combine with WHOIS, Wayback, and periodic exports for fuller audits or paid-tool analysis if needed.
How long does it take to build a disavow file after exporting links from GSC?
For a small site, you can produce a disavow-ready CSV in under an hour using the spreadsheet steps here. Larger sites require more time to validate evidence; always timestamp exports and document removal attempts before disavowing.
What should I do if I accidentally disavow a good domain?
Remove the line from your disavow.txt, reupload the corrected file in Search Console, and document the change. According to Google guidance, recovery is possible but may take time for link credit to return.
How do I verify if a suspicious link is part of a PBN or link network?
Cross-check WHOIS for similar registrant data, run bulk IP lookups for hosting clusters, inspect identical templates/footers across domains, and use Wayback to spot recent coordinated content creation—these free checks reveal PBN patterns.
Is contacting webmasters before disavowing always worth it?
Yes—attempt 1–2 contact attempts; many webmasters remove links. Document attempts in your Cleanup sheet. Disavow only when removal fails or when domains are clearly malicious or unreachable.