Junk backlinks often look like negative SEO when the real problem is malware on WordPress. Clean the site first. Disavow in Search Console only after the install is clean.
Topics Hardening & checklists
Updated Published
“Negative SEO” usually means someone pointing junk links at your domain to hurt rankings. On WordPress it is less common than people claim, and less effective than a compromise that injects spam on your host.
If Search Console, Ahrefs, or another crawler suddenly shows toxic backlinks, start by splitting two problems. Do not open with a disavow file.
| Problem | What it looks like | First move |
|---|---|---|
| On-site spam or malware | Injected pages, hidden links, redirects, cloaked junk for Googlebot | Incident response. Not a disavow file. |
| External junk backlinks | Weird domains linking to you with spam anchors | Often ignore. Disavow only clear networks after the site is clean. |
A hacked site that manufactures its own spam pages will keep looking like negative SEO until you clean the install.
Stop the disavow project.
Signs that this is malware, not a link attack:
site:yourdomain.com shows pharma, gambling, or foreign-language titles you did not publishStart with signs your WordPress site is hacked, then WordPress malware removal. After the install is actually clean, recover indexing with SEO recovery after a hack.
Run a malware scanner and a vulnerability scan. If cleanup keeps looping, hire help.
Google already discounts a lot of obvious spam. A handful of random directory links with no ranking loss is not an emergency.
Useful signals (combined, not one tool score):
Less useful:
Backlink tools help you find candidate domains. Google Search Console is where you submit the file. There is no button in Ahrefs (or similar) that sends a disavow list to Google.
domain:spam-network.example when the whole site is junk. Use a single URL line only when one page is spam and the rest of the site is fine.Example shape:
# Toxic networks reviewed after malware cleanup
domain:obvious-spam-network.example
domain:another-pbn-dump.exampleChase malware and indexing issues harder than a vanity toxic score. Background: why website security matters for SEO.
Security Ninja Free covers tests and vulnerability checks. Pro adds firewall and malware scanning when you want active blocking. Free on WordPress.org or pricing.
Most “negative SEO” panic on WordPress is either ignored junk or an on-site infection wearing a backlink costume. Clean first. Disavow in Search Console only when leftover external networks are still worth a scalpel.
Found this useful? Share it.
Often no. On WordPress, injected spam pages, hidden links, and crawler-only redirects are more common than a rival pointing junk links at you. Check the site itself before you build a disavow file.
No. If malware is still manufacturing spam URLs, a disavow file is busywork. Clean and confirm the install, then decide whether leftover external junk is worth a Search Console disavow.
No. Ahrefs (or Search Console’s link reports) can help you find candidate domains. You still upload a plain-text list in Google’s disavow tool for the correct property.
After the site is clean, and only for clear, persistent spam networks you can explain. Google already discounts a lot of obvious junk. Overusing disavow can throw away links you later wish you had kept.
