What Is Spam Score in SEO?

Spam Score is a Moz metric, scored 1–100, that estimates the percentage of sites with similar characteristics that Moz found had been penalized or banned by Google. A Spam Score of 30 doesn't mean a site is 30% spam — it means roughly 30% of sites sharing its profile were penalized. It's a statistical risk estimate, not a verdict.

What the number actually measures

This distinction trips up almost everyone who uses the metric, so it's worth being precise about.

Moz trained a model on a large sample of sites, recorded which ones Google had penalized or removed, and identified the features those sites had in common. Spam Score reports where a given site sits on that curve. It is a prediction about a population, applied to an individual.

The practical consequence: a Spam Score of 40 tells you that this site looks like a group of sites where 4 in 10 got penalized. It tells you nothing about whether this particular site is one of the four or one of the six. That's a useful triage signal and a terrible basis for a final decision.

Moz publishes its own explanation of the metric on Moz's Spam Score page, including how the current version replaced the older system.

The old version vs the current one

If you read an SEO article written before 2021, it's probably describing a different metric.

	Old Spam Score (2015–2021)	Current Spam Score
Scale	0–17	1–100
What it counted	Number of "spam flags" triggered	Modelled % of similar sites penalized
Reading it	"7 out of 17 flags"	"27% of similar sites were penalized"
Granularity	Coarse, 18 possible values	Fine

The old flags — thin content, no contact page, few internal links, an unusual TLD, a very small page count — are still roughly the kind of feature the model learns from. But you can no longer read the score as a flag count, and any guide telling you "4 flags is fine, 8 is bad" is describing a metric that no longer exists.

What counts as a risky Spam Score

Moz groups scores into three bands:

1–30 — low risk. The overwhelming majority of ordinary websites.
31–60 — medium risk. Worth a manual look before you rely on the site.
61–100 — high risk. Treat as a strong signal to walk away.

Two important caveats on those bands.

First, small and new sites score high for innocent reasons. A six-page site on a fresh domain with no contact page and few inbound links shares a lot of surface features with disposable spam sites. That's the model doing exactly what it was built to do — and it's why a new, legitimate blog can easily show a Spam Score in the 30s or 40s while being perfectly clean.

Second, Google does not use Spam Score. It's a Moz product built from Moz's index. Google has no access to it and doesn't rank by it. Neither does Semrush's Toxicity Score, which is a different metric with a different scale calculated a different way — the two frequently disagree about the same site.

How Spam Score compares to the other risk metrics

Metric	Vendor	Scale	Measures
Spam Score	Moz	1–100	Modelled likelihood of penalty, site-level
Toxicity Score	Semrush	0–100	Weighted count of toxic markers on a linking page
Trust Flow / Citation Flow gap	Majestic	0–100 each	Trusted-neighbourhood links vs raw link volume

None of these is authoritative, and the sensible way to use them is together. When Spam Score is high, Toxicity is high, and Trust Flow sits far below Citation Flow, three independent models built on three separate crawls have reached the same conclusion. That agreement is worth far more than any single number.

Using it to vet a link — the part that matters

Spam Score earns its keep as a first-pass filter on a list, not as the answer.

A workable process when you're evaluating a site you might get a link from:

Sort by Spam Score, don't decide by it. Anything in the high band gets dropped without ceremony. Everything else moves to step 2.
Open the site. Thirty seconds of looking answers more than the score does. Is there a real author? Is the writing about one subject or forty unrelated ones? Would you send a customer here?
Check its outbound links. Sites that link to gambling, pharmaceuticals, or crypto from a supposedly unrelated blog are the classic tell, and the one Spam Score is most reliably picking up.
Check estimated organic traffic. A high authority score with near-zero traffic is the single clearest indicator of a manufactured profile — see what makes a backlink bad for the full list of warning signs.
Check whether the page your link would sit on is actually indexed. An unindexed page passes nothing at all.

Steps 2 through 5 are what actually decide it. Step 1 just saves you from doing them 400 times.

What to do about a high Spam Score pointing at your site

Usually: nothing.

Google's systems are built to ignore the great majority of low-quality inbound links rather than penalize the target for them, which is the whole reason negative SEO is far less effective than it sounds. Google's own guidance on the disavow links tool opens by saying it's an advanced feature most sites should not use, and Google Search representatives have said as much publicly and repeatedly.

Disavowing is worth considering only in a narrow case: you have a manual action in Search Console citing unnatural links, or you know you paid for links in the past and want to clean up before they cause a problem. Outside of that, mass-disavowing every domain over an arbitrary Spam Score threshold does more harm than good — you'll throw away genuinely useful links that happened to score high for structural reasons.

The far better use of your time is the input side: getting new links from sites you've actually looked at. Exchanging directly with a real site owner in a related niche sidesteps the problem entirely, because you can see exactly who you're dealing with before anything goes live. Backlinkster matches you with one, puts both links inside real content, and verifies each placement live by code rather than taking it on trust.

Frequently asked questions

What is a good Spam Score? Under 30 on Moz's scale is the low-risk band and covers most ordinary websites. But "good" is relative to the site's size and age — a small, new, legitimate blog can score in the 30s or 40s purely because it shares structural features with disposable sites, so read a mid-range score as "look closer," not "reject."

Does Google use Moz Spam Score? No. Spam Score is a Moz metric calculated from Moz's own crawl index. Google has no access to it and does not rank by it. The same is true of Semrush's Toxicity Score and Majestic's Trust Flow.

Does a high Spam Score mean my site is penalized? No. A penalty is something you can see — a manual action in Google Search Console, or an unmistakable drop in impressions across the whole site. If neither is present, a high Spam Score is a modelling artefact, not evidence of anything Google has done.

Should I disavow links from high Spam Score domains? Only if you have a manual action for unnatural links, or you know links were bought. Google ignores most low-quality links automatically. Bulk-disavowing by score routinely removes legitimate links and has no upside for a site with no penalty.

Why did my Spam Score go up without anything changing? Because Moz periodically recalculates the model across its whole index. Scores can shift for every site at once with no change in the underlying websites — the same recalibration effect that moves Domain Authority without any link being gained or lost.

Can I lower my site's Spam Score? Somewhat, and mostly by building the things that make a site look established: more indexed pages of real content, a proper about and contact page, working internal linking, and genuine referring domains. There's no setting to change and no quick fix, because the score is a description of what your site looks like from the outside.

The bottom line

Spam Score is a probability estimate wearing the clothes of a verdict. Read it as "how many sites like this one got penalized," use it to cut a long prospect list down to a short one, and then make the actual decision by opening the site and looking at it. When it agrees with two other vendors' risk metrics, take it seriously. When it's the only red flag on an otherwise healthy site, it's usually telling you the site is small — not that it's spam.