Backlink audits: what they contain and how they mislead

By Bill Hartzer · Hartzer Consulting · 25+ years in search, domains and expert witness work

What an audit is for

A backlink audit is a structured measurement of what links to a site, what those links are worth, and what has changed. That is the whole job. It is not a search for something to disavow, and framing it that way — which is how most audit templates are built — produces a document that finds problems whether or not any exist.

There are four legitimate reasons to run one.

• Baseline. You have taken on a site and need to know what you inherited.
• Diagnosis. Something changed in visibility and you need to know whether the link profile is a plausible cause.
• Due diligence. Someone is buying a domain or a business and needs to know whether the link profile is a liability. This is the case where an audit most clearly earns its fee.
• Recovery. There is a manual action, and you need to identify links that you or someone acting for you built.

Notice that only the last of those is about removal. If you are running an audit for one of the first three reasons and the output is a disavow file, the audit answered a question nobody asked.

What the audit should contain

A defensible audit has seven parts. The order is deliberate: counting comes before judgment, and judgment comes before recommendation.

1. Scope and definitions. Which index, which view (fresh or historic), what date, what counts as a link, whether duplicates are consolidated. This section feels like bureaucracy until someone challenges a number, at which point it is the only thing that saves the document.
2. Volume. Referring domains, distinct linking pages, and total links — in that order of prominence, because that is the order of usefulness.
3. Concentration. How much of the profile comes from how few domains. Almost every real profile is far more concentrated than people expect.
4. Quality distribution. Referring domains banded by whatever authority metric you have chosen, with an explicit statement of what that metric does and does not measure.
5. Anchor text distribution. Branded, naked URL, generic, and exact-match commercial, as proportions of referring domains rather than of links.
6. Change over time. Domains gained and lost, and the shape of the acquisition curve.
7. Findings and recommendations. Short. Specific. Willing to say that nothing needs doing.

What should not be in it: a toxicity score presented as a fact, a projected ranking impact, or a recommended disavow file produced without a manual action or evidence of links you built.

How to run one

The sequence below is the one I use. It front-loads the boring decisions because those are the ones that determine whether the numbers mean anything.

1. Fix the index and the view before you export anything. Write down which tool, which index, and the date. If you switch indexes halfway through, your totals will move for reasons that have nothing to do with the site.
2. Export at domain level first. Referring domains, not links. This is the dataset you will do most of your thinking in.
3. Pull Search Console separately. It reports what Google recorded, which is a different claim from what a crawler found. Where the two disagree sharply, that disagreement is itself a finding.
4. Consolidate duplicates explicitly. Decide whether repeated links from the same template count once or many times, apply the decision consistently, and state it.
5. Band the domains. By authority metric, and separately by whether they are live.
6. Read the top of the distribution by hand. The domains sending the most links deserve individual inspection, because they dominate the totals.
7. Sample the tail. Do not read fifteen thousand junk domains. Take a random sample, classify it, and extrapolate — and expect the tail to be mostly automated noise, because that is what tails are.
8. Check what was lost. Domains that used to link and no longer do are frequently the most actionable output of the whole exercise.

Module 3 walks through the tiered version of this — auditing not just who links to you but who links to them, which is where link networks become visible.

The counting problem: a worked example

Here is the single most important thing to understand about audit numbers, taken from a real profile rather than a hypothetical.

A backlink tool reported a headline figure of 11,815 backlinks. Classifying that set on a Fresh index produced 9,772 classified links, of which 7,395 were duplicates — repeated links from the same source, the same template, the same sitewide element, counted individually. Consolidate them and the profile contains roughly 2,400 real links.

That is close to a fivefold difference, and no editorial decision sits behind it. Nobody built anything, nobody removed anything, and the site did not change. The only variable is whether the counting method treats a template link repeated across a thousand pages as one endorsement or a thousand.

This has direct consequences for anyone reading an audit:

• A headline backlink count is close to meaningless without a duplicate policy stated alongside it.
• Two agencies auditing the same site can report numbers five times apart while both being technically accurate.
• Growth in total backlinks can happen because a linking site added pages, not because anyone linked to you.
• Referring domains — the count of distinct sites — is stable against all of this, which is why it is the number worth leading with.

On the same profile, concentration made the point again: the top 100 referring domains accounted for 84.3% of all recorded links, and one single sitewide link accounted for 16.8% of the entire profile by itself.

The other ways audits mislead

Duplicate counting is the largest distortion, but not the only one.

Index choice as an invisible variable. A fresh index and a historic index answer different questions. Run a profile through a historic view and you will see every link ever recorded, including a decade of dead ones. Present that as a current profile and the site looks either far stronger or far more polluted than it is.

Treating low-quality domains as evidence of wrongdoing. This is the error that does the most damage in practice. On a twenty-year profile where not a single link was ever bought, 69.3% of the 22,260 referring domains sat at Trust Flow 0 — 15,421 junk domains, all of which arrived unsolicited. Junk links are the default state of publishing on the internet. An audit that flags them as a finding is describing the weather.

Confusing absence of growth with decay, or decay with attack. Links die on their own. Median referring domain lifespan on that profile was 1,080 days, and 49.6% of all links ever recorded were eventually lost. An audit that shows losses is usually showing normal attrition.

Vendor toxicity scores read as verdicts. Those scores are model outputs from a company selling audit software. They are not search engine judgments, they are not calibrated against any known ground truth, and they systematically over-flag.

Averages over a skewed distribution. Average Trust Flow across a profile where two thirds of domains are TF 0 tells you nothing. Report the distribution.

What a good audit concludes

The hardest part of an audit is writing recommendations that are proportionate to what you found. There is professional pressure to produce action items, because a document that says "this is normal" reads as though you did not work. Resist it.

Findings that are usually genuine:

• Excessive dependence on very few domains, which is a concentration risk rather than a quality problem.
• A pattern of exact-match commercial anchor text across unrelated low-quality domains — which suggests links were built, by someone.
• Valuable domains that have stopped linking. On the profile above, 717 referring domains at Trust Flow 21 or higher had stopped linking entirely. That is a recovery list, and it is the most useful list an audit can produce.
• A large gap between what the index shows and what Search Console reports.

Findings that are usually noise: a large tail of low-authority domains, a decline in total link count driven by one site's redesign, and any number derived from a metric average.

An audit that ends with "the profile is unremarkable, here are 717 domains worth re-contacting" is worth more than one that ends with a disavow file. The second is easier to sell and more likely to cause harm.