They have links from those sites because at some fundamental, most basic, never repeat this to anyone ever, terrible advice level, all links are worth
something.
This is one of the tools I use:
https://chrome.google.com/webstore/d...iccmpknp?hl=en
even simpler is this:
https://ahrefs.com/
Depends on how sketchy they are to what happens to the site.
Do you own the website?
If you pull the plug on them do they take the website down?
Do you have access to the wordpress back-end as an administrator?
Do you have access to the hosting environment?
If the answers are not: [yes/no/yes/yes] then they are sketchy and unethical.
The first thing to do is get admin access to everything. Then when it becomes time to pull the plug you change the PWs for the Wordpress site, and change the PW for the hosting environment. Also, they may have SSH access to the hosting account, this is unlikely, but possible, if that is the case take their keys away.
Then you have control of the website and they cannot do anything.