Is this campaign of spammy links to non-existent pages damaging my site?

[MarkHodson]

My site is built in Wordpress. Somebody has built spammy pharma links to hundreds of non-existent pages. I don't know whether this was inspired by malice or an attempt to inject spammy content.

Many of the non-existent pages have the suffix .pptx. These now all return 403s. Example: https://www.101holidays.co.uk/tazalis-10mg.pptx

A smaller number of spammy links point to regular non-existent URLs (not ending in .pptx). These are given 302s by Wordpress to my homepage. I've disavowed all domains linking to these URLs.

I have not had a manual action or seen a dramatic fall in Google rankings or traffic. The campaign of spammy links appears to be historical and not ongoing.

Questions:

1. Do you think these links could be damaging search performance? If so, what can be done? Disavowing each linking domain would be a huge task.

2. Is 403 the best response? Would 404 be better?

3. Any other thoughts or suggestions?

Thank you for taking the time to read and consider this question.

Mark

[MarkHodson]

thanks, Alex. You make some good points.

[Xiano]

1. I don't think it will, Google has got very good at ignoring these spammy sites. Creating large disavow lists isn't technically that hard, but I don't think I would spend the time doing it seeing as you haven't seen any impact.

2. I don't think either of the response codes you're returning are appropriate.
403 for the indicates that the client doesn't have permissions and therefore it could be inferred that the file does actually exist and therefore the link is valid, which is definitely not something you would want Google to think.
While you have disavowed the links you are 302'ing, I still don't think 302 is the right response. For a start, 302 has been superceded now anyway, but 302 indicated moved temporarily. That is certainly not the case. The page doesn't exist and never has. The only reason to 302 is if you are expecting traffic from these links, but I think that also sends a bad message to Google.
I would definitely suggest 404 for both cases.