Finding out that your SEO company built low-quality or spammy backlinks is unsettling, but it is rarely the emergency it feels like. The first thing to understand is what actually happened and how much it matters, because the right response is usually calmer and more measured than the panic the situation tends to create.
The Real Risk
Bad links built on your behalf fall into a few categories: links from low-value directories, links from unrelated or low-quality sites, links placed inside spun or thin content, and links bought in bulk. None of these help your rankings, and a campaign that relied on them was wasted money. The more important question is whether they can hurt you.
For most sites, the honest answer is that they will not. Google has spent years training its systems to recognize manipulative links and simply ignore them rather than penalize the site they point to. Google representatives have repeatedly said that ignoring spam links is normal behavior for the algorithm and that disavowing them is not a routine part of site maintenance. So if your traffic and rankings are stable, a batch of junk links is more an indicator of a poor provider than an active threat to your site.
The exception is a manual action. If Google has reviewed your site by hand and issued an “unnatural links” notice, you will see it in Google Search Console. That is a genuine problem that requires direct cleanup. Without that notice, you are almost certainly dealing with links that Google is already discounting on its own.
Audit the Backlink Profile
Before deciding anything, get a clear picture. Pull your backlink data from Google Search Console, and supplement it with a third-party backlink tool if you have access to one. Review the new links by referring domain, anchor text, and the type of page they sit on. You are looking for patterns: a sudden spike of links from the same low-quality network, repeated exact-match commercial anchor text, or links from sites unrelated to your business. Document what you find. This audit tells you the scale of the problem and gives you something concrete to raise with the provider.
When a Disavow Is Appropriate, and When It Is Not
The disavow tool lets you tell Google to ignore specific links. It is the right move in two situations: when you have a manual action for unnatural links, or when you have strong evidence of a deliberate, large-scale manipulative campaign that the algorithm may not have fully neutralized.
It is the wrong move for routine cleanup. The disavow tool is widely overused, and that is a real risk. If you disavow aggressively, you can accidentally cut off legitimate links that were helping you, which lowers your rankings. Because Google already ignores most spam, disavowing it usually changes nothing while exposing you to the chance of removing something useful. If your site has no manual action and stable performance, the safer choice is often to do nothing with the disavow file at all.
Stop the Practice and Reconsider the Provider
Whatever you decide about disavowing, the bad link building has to stop immediately. Tell the company in writing to halt all link acquisition until you have agreed on a quality standard. A provider that built spam links either did not know better or chose the fastest path over a sound one, and both are serious problems.
Ask them directly to explain their link methodology, show you sample placements, and describe how they vet linking sites. If their answers are vague, defensive, or they treat bulk links as normal, that is a strong signal to change providers. Quality link building is slower and earns mentions from relevant, credible sites. A company that cannot work that way is not protecting your long-term search performance, and continuing with them only repeats the same mistake.