Introduction

If your project depends on external validation signals — SEO, ad-network approval, editorial pitches — the "dofollow backlink" claim is one of the most-abused terms in your inbox. Platforms silently switch outbound links from dofollow to nofollow. Directory networks email you promising dofollow that turns out to be paywalled or reciprocal. And the standard SEO guides confidently give you information that is now two policy changes stale.

The verifier below is production PowerShell 7. It runs against SmartTaxCalc.in — my free browser-based Indian tax calculator suite — where the "dofollow gate" directly affects Google AdSense approval readiness. Every backlink claim in my inbox gets checked before I spend an hour submitting.

This article covers:

  1. Why dofollow vs nofollow still matters for SEO signal

  2. Two silent policy changes I discovered by verification (Medium 2023-2024, GitHub READMEs 2020)

  3. A 40-line PowerShell verifier that catches these — including the Chrome-header dance needed to defeat basic bot detection

  4. The newer trap: sites whose live listings look dofollow but whose submission funnel gates the dofollow behind payment or reciprocity

The verifier runs alongside my weekly GSC / GA4 / Bing analytics fetches. Same script model works for any language — the PowerShell just happens to be what I invoke from a Windows scheduled task.

Why the rel attribute matters

Every external <a href="..."> is either dofollow or nofollow. Google treats them differently:

For SmartTaxCalc.in, chasing external-validation signals in an AdSense approval process, dofollow domains matter and nofollow domains are decorative.

The catch is that platform policies drift one-way — dofollow-to-nofollow, rarely back — and you discover the change only when your rankings do not respond to newly-earned links.

Discovery 1: Medium switched to ugc nofollow platform-wide

I republished a home-loan article to Medium expecting the author-bio + in-article links to be dofollow (per most 2020-2022 SEO guides). I inspected the live rendered HTML:

curl -sL "https://medium.com/@author/article-slug" `
  -A "Mozilla/5.0" | Select-String -Pattern 'smarttaxcalc'

Result on every outbound anchor:

<a class="z rm" href="https://smarttaxcalc.in/..."
   rel="noopener ugc nofollow" target="_blank">

Every outbound link on Medium is now nofollow (rolled out ~2023-2024 to kill SEO spam). Even the author-bio link.

Discovery 2: GitHub renders README external links as nofollow

Same day, I forked an "awesome-personal-finance" repo, added my site to the list, and pushed. Standard SEO advice: "even without a merge, your fork's README anchor is a dofollow link from github.com." I curled the rendered README:

<a href="https://mint.intuit.com/" rel="nofollow">Mint</a><a href="https://smarttaxcalc.in" rel="nofollow">SmartTaxCalc</a>

Every external anchor on any GitHub-rendered README is rel="nofollow", platform-wide since ~2020. Even Mint — a heavyweight domain — is nofollow on the upstream repo. No PR merge changes this.

Both discoveries invalidated ~30 minutes of prep in one afternoon. Both would have been caught by a 30-second script.

The verifier — 40 lines of PowerShell

$siteHost = ([Uri]$config.siteUrl).Host   # e.g. "smarttaxcalc.in"

foreach ($src in $config.knownReferringUrls) {
    $resp = Invoke-WebRequest -Uri $src -UseBasicParsing -TimeoutSec 20 `
        -Headers $browserHeaders   # header set below

    # Match every anchor pointing to our host
    $pattern = '<a[^>]*href="[^"]*' + [regex]::Escape($siteHost) + '[^"]*"[^>]*>'
    $anchors = [regex]::Matches($resp.Content, $pattern,
                [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)

    foreach ($m in $anchors) {
        $tag = $m.Value
        $rel = if ($tag -match 'rel="([^"]*)"') { $Matches[1] } else { '' }

        # Dofollow = no nofollow, no ugc, no sponsored in rel.
        # rel="noopener noreferrer" is fine — security attributes, not SEO.
        $isDofollow = -not ($rel.ToLower() -match '\b(nofollow|ugc|sponsored)\b')

        [pscustomobject]@{
            sourceUrl  = $src
            rel        = $rel
            isDofollow = $isDofollow
        }
    }
    Start-Sleep -Milliseconds 500   # polite pause between hosts
}

$config.knownReferringUrls is a list of URLs where you've published or shared a link — dev.to posts, Medium articles, forum threads, directory listings. Output feeds a scorecard row in my weekly insights.md for SmartTaxCalc.in:

| Dofollow referring domains | 1 | ≥ 5 | 🔴 |

That single row is worth the 40 lines of PowerShell.

The header dance for Cloudflare-fronted sites

A bare Invoke-WebRequest gets a 403 instantly on Medium, Quora, and anything behind Cloudflare. Even -UserAgent 'Mozilla/5.0' isn't enough. This header set gets through most sites:

$browserHeaders = @{
    'User-Agent'                = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36'
    'Accept'                    = 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8'
    'Accept-Language'           = 'en-US,en;q=0.9'
    'Sec-Ch-Ua'                 = '"Chromium";v="121", "Not A(Brand";v="99"'
    'Sec-Ch-Ua-Mobile'          = '?0'
    'Sec-Ch-Ua-Platform'        = '"Windows"'
    'Sec-Fetch-Dest'            = 'document'
    'Sec-Fetch-Mode'            = 'navigate'
    'Sec-Fetch-Site'            = 'none'
    'Upgrade-Insecure-Requests' = '1'
}

The Sec-Ch-Ua-* + Sec-Fetch-* headers are what Chrome sends automatically that a bare HTTP client does not. Even with the full set, some sites block on a TLS-fingerprint check that Invoke-WebRequest cannot spoof. For those the verifier reports ❓ Unknown (fetch blocked) rather than misclassifying.

The newer trap: emails claiming "dofollow backlink"

Discoveries 1 and 2 were silent nofollow — platforms changed policy quietly. The newer pattern is louder: directory sites email you with:

"We discovered your product and think it's a great fit. Submit it and get a high-quality dofollow backlink from a trusted domain."

I received six such emails in one week. I did what the verifier taught me — checked an existing listing on the network. And here is the twist: the existing listing checked out. Outbound product links carried:

rel="noopener noreferrer"

No nofollow, no ugc. By the rule above, dofollow. Naive verdict: "great, submit."

Then I opened the actual submission form:

The same operator ran multiple sites under different brand names and emailed me from each. Live listings looked dofollow; the submission was gated behind conditions or payment.

The lesson upgrade: verify the funnel, not just a listing

Checking an existing listing's rel is necessary but not sufficient. A network can serve genuinely dofollow HTML on live pages while gating new free submissions behind:

The check I run now has two steps:

  1. Listing check (the script above): does an existing outbound link carry a clean rel?

  2. Funnel check (manual, 2 minutes): open the submit form. What tier grants the dofollow? Is the free tier actually available (open slots), or zeroed out to push you to pay? Does "free dofollow" require a badge or reciprocal link?

If step 2 says "dofollow only via payment or reciprocity," the answer is no — regardless of what step 1 showed.

Why platform-policy drift matters

Platforms shift policies one-way and announce it via ranking drops, not press releases:

PlatformWent nofollowHow I know
LinkedIn~2016Historical SEO record
Twitter/X~2019Public announcement
Quora~2022Verified via curl inspection
Medium~2023-2024Verified via curl 2026-07-07
GitHub READMEs~2020Verified via curl 2026-07-07

Any pre-2023 SEO guide is potentially wrong about at least one of these. The newer directory-spam wave means the claim of dofollow is now marketing copy — the fact lives in the rel attribute AND the submission funnel.

Two operating rules:

Adapting to your stack

The verifier is a small script alongside other analytics fetches (GSC / GA4 / Bing / PageSpeed) — one double-click, all marketing signals in one place. For SmartTaxCalc.in it runs from a Windows scheduled task and drops the CSV output next to the weekly analytics dashboard. Two adjustments for your setup:

  1. Point $config.siteUrl and $config.knownReferringUrls at your domain + list of URLs where you've dropped a link.

  2. For 403-heavy platforms, either add retry logic or just report them Unknown (I do the latter — I already know their policies from historical curls).

If you are shipping links across platforms hoping some count toward SEO: run the listing check weekly, run the funnel check before every submission, and stop being surprised.

About the author

Chetan Sanghani is a Technical Product Manager and C# Corner MVP. He builds SmartTaxCalc.in — a free browser-based Indian income tax calculator suite. All 38 calculators run client-side on Blazor WebAssembly, CA-reviewed by ICAI 644575, no signup, no backend. Reach out via smarttaxcalc.in/about/ or LinkedIn.