How to Audit Outbound Links: 9-Point SEO Checklist

Outbound links to authoritative sources are one of the most underrated trust signals in Google's algorithm. A page that cites Wikipedia, government sources, original research, and respected publishers signals well-researched content. A page that links to PBNs, expired domains, or off-topic spam signals the opposite. Outbound link quality is part of what Google internally calls "neighborhood" evaluation, your content gets associated with what it links to.

Two policy changes since 2023 made this audit more urgent than ever:

1. The Helpful Content Update (HCU, rolled out in waves from August 2022 through the March 2024 core update absorption) explicitly evaluates whether content cites and links to authoritative sources. Sites with no outbound links to recognized authorities are flagged as "thin" or "AI-generated", regardless of the actual content quality.
2. The Site Reputation Abuse policy (May 2024) penalizes hosts that allow link-out abuse, including affiliate landing pages without proper disclosure, "parasite SEO" content, and dense outbound links to commercial domains without editorial context.

The leaked Google docs corroboration

The May 2024 Google API documentation leak revealed internal scoring fields including siteAuthority, linkInfo, and a spamReputation module that explicitly tracks outbound link patterns. The leaked docs corroborated what many SEOs had inferred: Google scores your link neighborhood, and the neighborhood downstream of your outbound links is part of your overall trust score.

Linking out generously to authoritative sources is not a leak of your "link equity", it is a credibility deposit you make in exchange for higher rankings. Sites that cite well rank well.

What this guide covers

This is the 9-point audit we run on client sites quarterly. Each check takes 15-30 minutes for a page-level audit, or 2-4 hours for a full-site crawl. The full list will catch the issues that hurt rankings and the ones that create legal exposure (FTC disclosure failures).

Every outbound link should have the right rel attribute. Google introduced the modern attribute system in 2019, and many sites still have not updated. The four values you need to understand:

Common rel mistakes we see

1. Missing "sponsored" on affiliate links. Amazon Associates, ShareASale, Impact, Skimlinks, and similar networks should ALL be marked sponsored. Missing this triggers FTC liability and Google manual penalties.
2. Blanket nofollow on all outbound links. Some teams nofollow every external link "to be safe." This wastes a positive ranking signal, editorial citations are supposed to be dofollow.
3. "sponsored" on editorial guest posts. Guest posts where no money changed hands should be dofollow. The author paid in time, not money.
4. Missing "ugc" on comments and forums. Pages that allow user submissions need rel="ugc" on every user-added link. Without it, your site inherits responsibility for what users link to.

How to audit rel attributes quickly

Run the page through the Outbound Link Checker, it lists every outbound link, the rel attribute, and flags missing or incorrect values. For full-site audits, Screaming Frog's "External Links" report exports the data with rel values; filter for empty rel on affiliate URLs (Amazon, ShareASale, etc.).

Any link with target="_blank" should also include rel="noopener". Without noopener, the destination page can hijack your original tab via JavaScript's window.opener property, an attack called tabnabbing.

How tabnabbing works

The attack pattern: a malicious page you link to (or a legitimate page that gets compromised) executes window.opener.location = "https://phishing-site.com". Your original tab, in the background while the user reads the linked page, silently navigates to the phishing site. When the user switches back to your tab, they see what looks like your site asking them to re-enter their password. They re-enter. Credentials gone.

The fix is one attribute

rel="noopener" severs the window.opener reference. The destination page cannot manipulate your tab. Modern browsers (Chrome 88+, Firefox 79+, Safari 13+) implicitly apply noopener to all target="_blank" links, but you should still set it explicitly because:

• Some users run older browsers (corporate IE/Edge legacy, locked-down devices)
• HTML emails opened in email clients bypass browser defaults
• Some Android in-app browsers do not apply the default
• Crawler-based audits (Lighthouse, Pa11y, security scanners) flag missing noopener regardless

noopener vs noreferrer

The combined attribute rel="noopener noreferrer" adds privacy: the destination page does not receive the Referer header indicating where the click came from. Use noreferrer for privacy-sensitive contexts (linking to competitor sites you do not want to "credit" with traffic) and noopener-only for general outbound links.

How to audit at scale

Run the Security Headers Checker on your apex domain to ensure other HTTPS security headers are configured, then audit individual pages with the Outbound Link Checker. For codebases, search for target="_blank" in your templates and add rel="noopener" globally.

Studies from the Library of Congress and academic web archiving research show 10-15% of external links break per year. After 5 years, half your outbound links lead to dead pages, redirected destinations, or 404s. After 10 years, most outbound links are dead. Link rot wastes crawl budget, hurts user experience, and signals abandoned content to search engines.

The four types of link rot

The most dangerous type: hijacked domains

The worst case is domain hijacking. A legitimate source goes out of business; their domain expires; a spam operator buys it; your site now links to a casino, adult content, or malware-hosting page. Google's safety scoring downgrades sites with outbound links to malicious destinations within days. Run a hijack-detection scan quarterly.

How to detect rot at scale

For single-page audits, run the page through the Outbound Link Checker, it does HTTP status checks on every outbound link. For full-site audits, use Screaming Frog's "External Links → Status Code" report. Filter for status codes 404, 410, 5xx, and any redirect chain longer than 2 hops.

The four fixes for rotten links

1. Replace with Wayback Machine snapshot. archive.org has a snapshot of most dead pages from before they died. Link to the snapshot URL.
2. Swap to an equivalent working source. If the original source is dead, find another that covers the same fact. This is the highest-effort but best-for-user option.
3. Remove the link entirely. If the citation is not load-bearing, just delete it. Better than a dead link.
4. Annotate as historical. For pages discussing historical events, link to the Wayback Machine snapshot and note in the body that the original source is no longer available.

The FTC requires clear, conspicuous disclosure of affiliate relationships and paid endorsements (last major guidance update: June 2023). Google requires rel="sponsored" on paid links since 2019. Both apply to outbound links to affiliate networks, sponsored review destinations, and any paid placement.

The two-part requirement

For every outbound affiliate link, you need BOTH:

1. Visible disclosure, text like "affiliate link" or "sponsored" or "we earn a commission" placed near the link or at the top of the page. Hiding it in the footer or terms-of-service is not compliant.
2. rel="sponsored" in the HTML, invisible to users, visible to Google. Required since 2019.

The audit list

Run a site-wide search for these domain patterns. Each should have both visible disclosure AND rel="sponsored":

• Amazon Associates: amazon.com/dp/, amazon.com/gp/product/, amzn.to
• ShareASale: shareasale.com/r.cfm
• Impact / Impact Radius: track.impactradius-event.com, impact.com/campaign-promo-codes
• ClickBank: Any hop.clickbank.net URL
• Skimlinks / Viglink: go.skimresources.com, redirect.viglink.com
• CJ Affiliate / Commission Junction: www.anrdoezrs.net, www.dpbolvw.net, www.kqzyfj.com
• Awin / ShareASale partner-specific tracking subdomains
• Rakuten Advertising: click.linksynergy.com

FTC enforcement risk

The FTC issued $1.4M+ in fines to influencers and brands for missing affiliate disclosure in 2024 alone. Missing disclosure is not a Google-rankings problem only, it is a legal liability problem. For sites doing significant affiliate revenue, the cost of an FTC investigation dwarfs any short-term SEO gain from omitting disclosure.

The Google enforcement risk

Missing rel="sponsored" can trigger manual actions in Google Search Console. The penalty is typically a "unnatural outbound links" notification that demotes the affected pages until the issue is fixed and reconsidered. Recovery takes 30-90 days. The cost of a single penalty event on a high-traffic affiliate page often exceeds annual revenue.

If you link to the same external domain 20+ times on a single page, that looks unusual, either you are running an affiliate-heavy listicle (verify FTC disclosure for every link) or you are over-citing one source. Diversify with multiple authoritative references.

The diversity audit pattern

Export your page's outbound links. Group by destination domain. Flag any domain receiving 20+ links from a single page. Two scenarios:

1. Legitimate citation density (e.g., a Wikipedia-heavy academic post). Acceptable, but balance with at least 3-5 other authoritative sources to avoid looking thin.
2. Affiliate concentration (e.g., 30 Amazon links on a "best gifts" post). Requires complete FTC compliance: visible disclosure near each link group, rel="sponsored" on every Amazon URL, and ideally a balanced editorial commentary that justifies each pick.

The opposite problem: zero outbound links

The opposite pattern is more common and more harmful: pages with zero outbound links. The Helpful Content Update specifically penalizes "answer-only" content with no citations. Every substantive article should have at least 5-8 outbound links to authoritative sources, varied across domains.

Domain authority of destinations

Not all outbound domains are equal. Linking to .gov, .edu, Wikipedia, and major publishers (NYTimes, BBC, Nature) carries more positive signal than linking to random blogs. For technical content, link to GitHub, Stack Overflow, and the official documentation of the technologies you discuss. Diversity within high-authority sources is the goal.

Audit outbound links for HTTP-only destinations. Linking to HTTP from HTTPS pages signals an outdated reference and triggers mixed-content warnings in some browser configurations. For sites that still have no HTTPS in 2026, consider whether they are still authoritative enough to cite.

The audit process

1. Export all outbound URLs from the page (or full site)
2. Filter for URLs starting with http://
3. For each, check if an https:// version exists (most major sites have transitioned)
4. Update the link to HTTPS, or replace with a different working HTTPS source

The exception cases

Some legitimate sites legitimately do not have HTTPS in 2026, small academic personal pages, government archive sites, certain international sites. For these, the trade-off is:

• Keep the HTTP link if it is the only authoritative source for the citation
• Wrap in Wayback Machine, the Internet Archive serves snapshots over HTTPS
• Add rel="nofollow noopener" to indicate you do not vouch for the destination's security
• Replace with a different source if the citation is not load-bearing

Mixed content browser warnings

If your HTTPS page links to an HTTP destination via target="_blank", some browser configurations still flash a mixed-content warning. The warning visibly damages user trust. Audit for this pattern specifically, HTTP destinations in new-tab links are the worst combination.

Outbound anchor text matters for two reasons: it signals to Google what your page is about (the anchor of every link contributes context), and it signals to the user what to expect on click.

The outbound anchor pattern

Use descriptive, contextual anchors. Three categories perform well:

1. Source title / publication name: "according to Nature" or "the New York Times reported that..."
2. Descriptive phrase: "the study found that..." or "see this analysis of..."
3. Specific terminology: "the Helpful Content Update" linked to Google's official announcement

The "click here" problem

"Click here" and "read more" anchors on outbound links waste the contextual signal entirely. They also hurt accessibility, screen readers announce the anchor out of context, leaving visually-impaired users guessing what they will get if they click. Convert generic outbound anchors to descriptive ones during your audit. Use the Anchor Text Analyzer to identify generic anchors.

The keyword-stuffing risk on outbound

Stuffing keywords into outbound anchors backfires. <a href="example.com">best SEO tool 2026</a> pointing to a competitor is awkward and looks templated. Use natural language. Save your keyword-rich anchors for internal links, see our internal linking guide for the inverse pattern.

Some pages block search engine crawlers from following outbound links via robots.txt or meta robots tags. This usually defeats the purpose of having the links.

The audit checks

• Run your robots.txt through the Robots.txt Tester to verify nothing is accidentally blocked
• Check meta robots on each page, <meta name="robots" content="nofollow"> blocks all outbound link discovery on that page
• Check x-robots-tag headers, server-set headers can override on-page meta tags
• Verify your sitemap is complete with the Sitemap Validator, pages not in the sitemap and not internally linked are invisible

The intentional cases

You might legitimately block outbound link discovery on:

• User-generated content pages (forums, comment sections), combined with rel="ugc" on individual links
• Affiliate landing pages where you do not want Google to traverse to affiliate destinations
• Search results pages on your site, Google's docs explicitly recommend noindex'ing these

For everything else, ensure crawlers can follow your links.

The last check is forward-looking: do the destinations you link to have proper metadata? Pages that you cite as authoritative should themselves look authoritative when previewed. Sites that link to pages with broken or missing Open Graph tags inherit some of that low-quality signal.

The audit pattern

For your top-15 outbound destinations (those receiving the most links from your site), run each through the Open Graph Checker. Verify:

• Title tag is descriptive and matches the citation context
• Open Graph image renders properly
• Description matches the page content
• No broken meta tags or 5xx errors

If your most-cited destinations have broken metadata, consider whether they are really the best authorities to cite. The audit often surfaces "I always link here but should I?" decisions.

The Meta Tag Generator for your own pages

While auditing destinations, also audit your own page metadata. Use the Meta Tag Generator to ensure your pages have correct title, description, and Open Graph tags. Sites that link out generously to good metadata should themselves have impeccable metadata, Google compares your page to the pages you cite.

The full 9-point audit takes 2-4 hours for a full-site review or 15-30 minutes per page for spot audits. Here is the workflow.

The audit workflow

1. Run the Flyn Outbound Link Checker on your top-20 traffic pages individually. This catches rel issues, broken links, missing noopener, HTTP destinations.
2. Run a full-site Screaming Frog crawl with the "External Links" report enabled. Export to CSV.
3. Filter for affiliate URLs (Amazon, ShareASale, Impact, etc.). Verify each has rel="sponsored" AND visible disclosure on the page.
4. Filter for status codes 404, 410, 5xx, and 3xx chains. Triage with the four-fix framework (replace, swap, remove, annotate).
5. Filter for HTTP destinations. Update to HTTPS where possible.
6. Filter for target="_blank" without rel="noopener". Bulk-update in your CMS or codebase.
7. Identify domain concentration (any single external domain receiving 20+ links). Audit FTC compliance or rebalance citations.
8. Verify robots/sitemap configuration with the Robots.txt Tester and Sitemap Validator.
9. Spot-check top-15 destinations with the Open Graph Checker.

What to expect after fixing

Outbound link improvements show in rankings within 2-4 weeks (faster than internal linking changes because Google's neighborhood signal updates on each crawl). Sites that fix multiple categories simultaneously often see 8-15% organic lift in the following month. For more on the related internal link optimizations, see our 2026 internal linking strategy guide.

Cadence

Run the full 9-point audit quarterly for content-heavy sites (50+ articles) and semi-annually for smaller sites. Link rot, FTC rule changes, and Google policy updates all accumulate faster than most teams realize.