Link Building in 2026: What Still Works and What Buys You a Penalty

Link building is still sold as a quantity: so many links a month, at such a price, from sites with such a score. The offer has barely changed in fifteen years. What has changed is the value of what is being sold, and the change has been quiet enough that most buyers have not repriced.

Google has said on the record that links have not been among the top three ranking factors for some time, and the word “important” was removed from the documentation describing them. That is not the same as saying links do not matter. It is a warning that a budget line built on the old assumption is now producing considerably less than it used to.

What links still do

Three functions survive, and they are worth separating because only one of them is what link sellers are selling.

• Discovery. A link is still one of the ways a page is found and crawled. For a new site with few pages, this matters more than any ranking effect.
• Corroboration. Being referenced by sources a search engine already trusts is evidence that you exist and are what you claim. This is the residual ranking value, and it is a function of who links rather than how many.
• Actual traffic. The forgotten one. A link from a page real people read sends real people, who convert at rates paid channels rarely match. This value is unaffected by any algorithm change.

The enforcement picture in 2026

Three developments matter, and together they explain why the shortcuts stopped working rather than merely becoming risky.

Detection runs continuously. Link spam handling now sits inside the ongoing systems rather than arriving as a visible update. There is no longer a dated event to point at when rankings fall, which makes cause and effect harder to establish and makes the practice harder to defend internally.

Site reputation abuse became a named policy. Third-party content published on a host site mainly to exploit that host’s ranking signals is now explicitly against the rules, regardless of who wrote it. Enforcement removed a large part of the paid-placement industry that operated through established publishers, and the wider commercial consequences of that were significant enough to attract regulatory attention in Europe.

The policy was extended in May 2026 to cover attempts to manipulate generative AI answers in Search. Anyone planning to redirect a link-buying budget into gaming AI citations should read the current spam policies before signing anything, because that door was closed before most people noticed it was open.

What still works, in order of durability

1. Publishing something worth citing. Original data, a survey of your own customers, a price index for your sector, a genuinely useful calculator. This is slow, produces the highest-quality links, and has the useful property that the links keep arriving after you stop working.
2. Being quoted as a source. Journalists and trade publications need people who will say something specific on the record. Availability and a willingness to give a real opinion matter more than a media budget.
3. Relationships you already have. Suppliers, partners, industry bodies, clients whose case studies you wrote. These links are legitimate, easy to obtain and almost always left uncollected, which is why the audit in documenting your own work tends to produce link opportunities as a side effect.
4. Local and sector directories that people actually use. Not link farms: the chamber of commerce, the professional register, the regional listing customers consult. These also feed the local visibility work described elsewhere.
5. Sponsorship and community involvement, declared honestly. A sponsored link marked as such passes no ranking value and does pass real people, which is the point.

What to stop paying for

The list is short and includes most of what is sold as link building.

Private blog networks, which are detectable by construction. Bulk purchases from marketplaces, where the same sites sell to everyone including your competitors. Guest post placements on sites that exist only to host guest posts, which are recognisable from their content mix in about thirty seconds. Reciprocal schemes, which produce a pattern that is trivially visible. And the cold outreach that begins “I noticed your website could rank better”, which is the same industry approaching you from the other side and belongs in the category described in what actually arrives through your contact form.

The test that filters almost all of it: would this link exist if search engines did not? If the honest answer is no, it is the category of link the policies describe.

The metrics that mislead

Link building is unusually well supplied with numbers that feel authoritative and are not.

Domain authority scores, under whatever brand name, are third-party estimates invented by tool vendors. No search engine publishes such a score or uses one. They correlate loosely with ranking because both correlate with genuine popularity, which makes them useful as a rough sorting device and useless as a target. A service selling “DR 60+ links” is selling against a metric its own supplier can manipulate.

Raw link counts are worse, because they treat a mention in a national newspaper and a footer link on an abandoned directory as equivalent units.

Three measures are worth tracking instead. Referral sessions and what they do, which is real and yours. Brand searches, which rise when people encounter you elsewhere and are the cleanest available proxy for awareness. And ranking movement for the specific cluster you were working on, rather than for the site as an average.

How to read a link-building proposal

If you are buying this as a service, five questions separate the vendors worth talking to from the rest. Ask them before the pricing conversation.

1. “Show me three links you built last month, with the live URLs.” Not a sample report: actual pages. Open them and read what is around the link. Thirty seconds tells you whether the page exists for readers or for links.
2. “Do you pay for placements, and how is that disclosed?” Paid placement is not automatically wrong; undisclosed paid placement is against the policies and the exposure is yours, not the vendor’s.
3. “What happens to the links if I stop paying?” If they disappear, you were renting, and the ranking effect was always temporary. This is worth knowing before the third invoice, not after the twelfth.
4. “What will you send that is worth linking to?” A vendor with no answer is placing links rather than earning them, which is the practice the policies describe.
5. “How will we know it worked?” If the answer is a vendor authority score, the engagement will be measured against a number the vendor influences. Insist on referral traffic and cluster rankings instead.

These are the same class of question that separates a considered supplier from an improvising one across every other discipline, and the wider set is in nine questions to ask before signing.

Disavow, and when it is warranted

The disavow tool still exists and is now rarely the right response. Search engines have stated that they ignore the great majority of spam links automatically, and a disavow file assembled hastily can remove links that were helping.

Two situations justify it. A manual action in Search Console citing unnatural links, where the file is part of the remedy. And a known history of paid links that you commissioned, where cleaning up is a deliberate decision rather than a reaction to a graph.

A sudden drop in rankings with no manual action is almost never a link problem, and the time spent building a disavow file is time not spent on the actual cause, which is more often a technical change or a content one, as covered in how to find the cause of a traffic drop.

What proportion of the budget this deserves

For most small and medium businesses, honestly: less than the industry recommends and more than zero.

If the site has technical problems, thin pages, or no answers to the questions customers actually ask, links are the wrong intervention. Sending authority to a page that does not deserve to rank produces a page that does not rank. The order of work is technical foundation, then pages that answer real questions, then the reasons for anyone to reference them.

Once those are in place, the most defensible allocation is not a link budget at all. It is a budget for producing something citable and for the time to tell relevant people it exists — which is the same work as content, measured differently, and which also happens to be what makes a site quotable by AI answers, for the reasons ranked in the evidence review of citation factors.

The short version

Links are no longer among the top three ranking factors by Google’s own account, and the documentation no longer calls them important, so a budget built on the old weighting is overpriced. They still do three things: help discovery, corroborate that you are real, and send actual people, and only the third is verifiable by you. Enforcement now runs continuously rather than as visible updates, site reputation abuse is a named policy that removed much of the paid-placement industry, and in May 2026 the rules were extended to attempts to manipulate generative AI answers. What works is being worth citing, being quoted, collecting the relationships you already have, and real directories. Ignore vendor authority scores, which no search engine publishes, and track referral sessions, brand searches and cluster-level rankings instead. Disavow only against a manual action or your own known history.