How to disavow links with Ahrefs: find toxic backlinks, build a disavow list, upload it in Google Search Console, and clean WordPress malware spam before you chase links.
Topics Hardening & checklists
Lars Koudal Updated Published
“Negative SEO” usually means someone pointing junk links at your domain to try to hurt rankings. It is less common than people claim, and less effective than a real site compromise that injects spam. If you came here for Ahrefs disavow links help, start by separating external junk from on-site infection.
On WordPress, that split matters. A hacked site that manufactures its own spam pages will keep looking like “negative SEO” in Ahrefs until you clean the install.
| Problem | What it looks like | First move |
|---|---|---|
| External junk backlinks | Weird domains linking to you with spam anchors | Investigate in Ahrefs / Search Console; often ignore; disavow only clear networks |
| On-site spam or malware | Injected pages, hidden links, redirects on your host | Incident response, not a disavow file |
External junk backlinks. Weird domains linking to you with spam anchors. Investigate with Google Search Console and a backlink crawler such as Ahrefs (Majestic or similar also work). Document patterns. Many links can be ignored; Google already discounts obvious spam.
On-site spam or malware. Injected pages, hidden links, or redirects on your host. That is an incident, not a disavow file. Start with WordPress malware removal and SEO recovery after a hack. Signs checklist: signs your WordPress site is hacked.
If Search Console shows “Hacked content” or you see pharma/gambling pages on your domain, stop the disavow project and clean first.
People search “how to disavow links in Ahrefs” because Ahrefs surfaces toxic backlinks clearly. The important detail: Ahrefs helps you find candidates. Google’s disavow tool is where you submit the file.
There is no “Ahrefs upload disavow file” button that talks to Google. Export from Ahrefs, edit the list, upload in Search Console.
domain:example.com for the worst confirmed spam networks. Prefer domain-level entries over endless URL lists when the whole site is junk.| Line style | When to use |
|---|---|
domain:spam-network.example | Whole site is junk / PBN spam |
https://example.com/bad-page | One spam page; rest of the site is fine |
Prefer domain: when the whole linking site is garbage. That is what most “difference in disavow URL or domains Ahrefs” searches are asking.
# Toxic networks reviewed 2026-08-26
domain:obvious-spam-network.example
domain:another-pbn-dump.exampleSave as UTF-8 plain text. Upload in Search Console under the property that matches the site (domain property vs URL-prefix property). Wrong property is a common silent miss.
Useful signals (combined, not one score alone):
Less useful:
Chase malware and indexing issues harder than a vanity toxic score. Background: why website security matters for SEO.
Link spam is annoying. A hacked site that manufactures its own spam is career-level painful.
If cleanup keeps looping, hire help. Security Ninja Free covers tests and vulnerability checks; Pro adds firewall and malware scanning when you want active blocking. Free on WordPress.org or pricing.
Use Ahrefs to find toxic candidates. Use Google Search Console to disavow. Clean WordPress malware before you live in a disavow spreadsheet. Most “negative SEO” panic is either ignored junk or an on-site infection wearing a backlink costume.
Found this useful? Share it.
Ahrefs does not submit a disavow file to Google. Use Ahrefs (or Search Console) to find toxic candidate domains, export them, build a plain-text disavow list with domain: lines, then upload that file in Google’s disavow tool for the correct Search Console property.
You can export linking domains from Ahrefs and turn the worst confirmed spam networks into a disavow list. The upload itself still happens in Google Search Console’s disavow tool, not inside Ahrefs.
No. Disavow is a scalpel. Google already discounts a lot of obvious spam. Overusing disavow can discard links you later wish you had kept. Fix on-site malware spam first, then disavow only clear, persistent spam networks.
First check whether the damage is on your site (injected spam pages, redirects, malware) or only external junk links. Clean and harden WordPress if the site is compromised. Use Ahrefs to find toxic domains, then disavow only the worst networks in Search Console.
Prefer domain:example.com when the whole linking site is junk. Use a specific URL line only when one page is spam and the rest of the site is legitimate. Domain-level entries keep the list shorter and clearer.
