Negative SEO backlinks: investigate a spike without guessing its cause
Fictional manual investigation. Counts and events are invented, not measurements of your site. No attacker, penalty or cause has been established; no report is fetched or submitted.
Read the seven-day example
Fictional manual investigation. Counts and events are invented, not measurements of your site. No attacker, penalty or cause has been established; no report is fetched or submitted.
Observation
Two fictional exports show a count change; the cause is unknown.
Verification
Compare scopes, inspect pages and obtain owner-controlled evidence.
Decision
Fix confirmed defects or escalate supported findings; retain uncertainty.
- Observation Check the evidence behind the alert Verification
- Verification Act on verified findings, not assumed intent Decision
| Inspection step | Example observation | Evidence to record | Action if it differs |
|---|---|---|---|
| Day 0 baseline | 120 link rows across 40 domains in the fictional export | Provider, scope, filters and saved file date | Keep the original file; align settings before comparing |
| Day 7 increase | 840 rows across 42 domains;720 added rows from two domains | Matched export and sampled source/target pairs | Inspect representative pages; do not label all rows an attack |
| Discovery date | The provider first observed links during the interval | Provider field definition and any independent publication evidence | Keep discovery and publication dates separate |
| Site release | A template changed in the same period | Release log, actual page output and affected URLs | Check for unintended noindex without assuming ranking causality |
| Manual-action status | The investigator lacks property access | Dated report supplied by the verified owner | Record unknown; do not treat missing access as no action |
How to use the matrix
In this fictional exercise, day 0 contains 120 link rows from 40 referring domains. Day 7 contains 840 rows from 42 domains using the same scope. Comparing the saved files attributes the additional 720 rows to two newly observed domains. A manual sample shows repeated directory-style pages, but the remaining rows have not all been visited. A site release occurred in the same period. The worksheet preserves these facts separately; neither the count increase nor the timing identifies an attacker or a cause of lost visibility.
Investigate confirmed page defects through the person who controls the affected site. For the example release, inspect whether a changed template introduced noindex and which URLs received it; do not assume the release caused a search decline. Ask the property owner to inspect Search Console’s Manual Actions report. Without access, the status is unknown, not clear. Google describes disavow as an advanced step for substantial problematic links associated with an actual or likely manual action, not an automatic response to an alarming score or spike.
Review checklist
- Keep the two original exports and their exact scope.
- Compare referring domains as well as link rows.
- Record inspected examples separately from unchecked records.
- Verify site changes and owner-access reports before escalation.
- Close each finding with evidence; leave unknown causes explicitly open.
Save the two exports with their provider, scope, filters and observation dates. Record the exact source and target URL pairs you inspected, what the page showed and which rows remain unchecked. Add release notes, verified page defects and the owner’s report status to separate timeline entries. Give each next action an owner and a review date. If remediation is warranted, use the dedicated removal or disavow guidance and retain the previous decisions; this worksheet does not contact publishers or upload a disavow file.
A simultaneous traffic change remains a correlation until competing explanations have been examined. Technical faults, changed demand and search-system changes can require different investigations. A clean Manual Actions report would not prove that every link is beneficial or that no other search issue exists. Record an unresolved cause as unresolved rather than assigning blame. This exercise is not a live audit, an attribution service or a promise of recovery; actual outcomes require the owner’s real site and search evidence.