---
title: Negative SEO vs WordPress malware
canonical: https://wpsecurityninja.com/ways-to-remove-the-attack-of-negative-seo-with-ahrefs/
---
“Negative SEO” usually means someone pointing junk links at your domain to hurt rankings. On WordPress it is less common than people claim, and less effective than a compromise that injects spam on *your* host.

If Search Console, Ahrefs, or another crawler suddenly shows toxic backlinks, start by splitting two problems. Do not open with a disavow file.

| Problem | What it looks like | First move |
| --- | --- | --- |
| **On-site spam or [malware](https://wpsecurityninja.com/dictionary/malware/)** | Injected pages, hidden links, redirects, cloaked junk for Googlebot | Incident response. Not a disavow file. |
| **External junk backlinks** | Weird domains linking to you with spam anchors | Often ignore. Disavow only clear networks after the site is clean. |

A hacked site that manufactures its own spam pages will keep looking like negative SEO until you clean the install.

## If the damage is on your WordPress site

Stop the disavow project.

Signs that this is malware, not a link attack:

- Search Console **Hacked content** or **Security Issues**
- `site:yourdomain.com` shows pharma, gambling, or foreign-language titles you did not publish
- Redirects for Googlebot or mobile visitors only
- Unknown posts, plugins, or admins

Start with [signs your WordPress site is hacked](https://wpsecurityninja.com/signs-wordpress-site-is-hacked/), then [WordPress malware removal](https://wpsecurityninja.com/wordpress-malware-removal/). After the install is actually clean, recover indexing with [SEO recovery after a hack](https://wpsecurityninja.com/recover-wordpress-websites-seo-after-hacker-attack/).

Run a [malware scanner](https://wpsecurityninja.com/malware-scanner/) and a [vulnerability scan](https://wpsecurityninja.com/vulnerabilities/). If cleanup keeps looping, [hire help](https://wpsecurityninja.com/consultation/).

## If the site is clean and the junk is only inbound links

Google already discounts a lot of obvious spam. A handful of random directory links with no ranking loss is not an emergency.

Useful signals (combined, not one tool score):

- Sudden spikes of low-quality referring domains with matching spam anchors
- Foreign-language gibberish sites linking with money keywords
- Link graphs that look automated (thousands of near-identical domains in days)
- Ranking drops that line up with **on-site** spam in Search Console, not only new backlinks

Less useful:

- A single “toxic” score with a healthy site and no ranking loss
- Random directory links that have been there for years
- Competitor paranoia without evidence

## Disavow only after cleanup (Search Console, not the crawler)

Backlink tools help you *find* candidate domains. **Google Search Console is where you submit the file.** There is no button in Ahrefs (or similar) that sends a disavow list to Google.

1. Confirm the site is clean.
2. Export suspicious linking domains from Search Console or a backlink crawler. Focus on networks you can explain, not every low-DR mention.
3. Build a UTF-8 plain-text list. Prefer `domain:spam-network.example` when the whole site is junk. Use a single URL line only when one page is spam and the rest of the site is fine.
4. Upload it in [Google’s disavow tool](https://search.google.com/search-console/disavow-links) for the correct property (domain vs URL-prefix). Wrong property is a common silent miss.
5. Keep a copy. Revisit when new evidence appears. Do not rebuild the file weekly out of anxiety.

Example shape:

```text
# Toxic networks reviewed after malware cleanup
domain:obvious-spam-network.example
domain:another-pbn-dump.example
```

Chase malware and indexing issues harder than a vanity toxic score. Background: [why website security matters for SEO](https://wpsecurityninja.com/why-website-security-is-important-to-seo/).

## Hardening so the next mess is smaller

1. Keep core, plugins, and themes updated ([checklist](https://wpsecurityninja.com/wordpress-security-checklist/))
2. Harden logins with [2FA](https://wpsecurityninja.com/two-factor-authentication-2fa/) and [login protection](https://wpsecurityninja.com/login-protection/)
3. Run scheduled [malware](https://wpsecurityninja.com/malware-scanner/) and vulnerability checks
4. Watch Search Console security messages
5. Keep restore-tested [backups](https://wpsecurityninja.com/wordpress-backup-tips-backing-up-your-site-for-protection/)

Security Ninja Free covers tests and vulnerability checks. Pro adds firewall and malware scanning when you want active blocking. Free on [WordPress.org](https://wordpress.org/plugins/security-ninja/) or [pricing](https://wpsecurityninja.com/pricing/).

## Related reading

- [Recover WordPress SEO after a hack](https://wpsecurityninja.com/recover-wordpress-websites-seo-after-hacker-attack/)
- [WordPress malware removal](https://wpsecurityninja.com/wordpress-malware-removal/)
- [What to do if your WordPress site is hacked](https://wpsecurityninja.com/what-should-you-do-if-your-wordpress-site-is-hacked/)
- [Why website security is important to SEO](https://wpsecurityninja.com/why-website-security-is-important-to-seo/)
- [WordPress security checklist](https://wpsecurityninja.com/wordpress-security-checklist/)

## Bottom line

Most “negative SEO” panic on WordPress is either ignored junk or an on-site infection wearing a backlink costume. Clean first. Disavow in Search Console only when leftover external networks are still worth a scalpel.