Glonce

Google reroutes search result links to curb scraping

securityThe Glonce editorsHacker News🔥76Glonce rating76Impact60Novelty62Relevance82Surprise45Players72Credibility85
Google reroutes search result links to curb scraping

Google Search has begun rewriting the links on its organic results into a google.com/goto?url=... redirect instead of putting the destination address directly in the page's HTML, according to Autom, a company that sells Google Search API and SERP-data access. Clicking a result still lands on the real page, since Google resolves the redirect for the person clicking, but the link itself no longer carries a readable destination. As of late August 2026, Autom says the pattern shows up consistently across searches made while logged out of Google or browsing in private mode; it may still be an experiment, Autom notes, but it is no longer confined to a small slice of results pages.

The new format is not the same as an older redirect wrapper Google has used before, google.com/url?q=[URL-encoded destination], which kept the target link readable right in the query string. In the goto format, the link's href points only to /goto, and the accompanying url= value cannot be decoded offline: Autom describes it as a custom, Google-specific encoding, not plain base64, that in practice reads as an opaque reference into Google's own index record for the page rather than a portable copy of the URL. The only way to recover the actual destination, per Autom, is to request that /goto URL and read the HTTP Location header it returns, without following the redirect itself. Google still needs the destination to draw the results page, since the domain, favicon and attribution shown there have to come from somewhere, so copies of the URL remain elsewhere on the page; Autom treats that as a separate matter from reading the Location header.

Autom's own reading of why Google is doing this, offered as its interpretation rather than anything Google has said publicly, is that it fits a broader push against automated harvesting of search-results pages, in particular by AI crawlers and SEO scrapers that bulk-extract result URLs to build their own indexes. The mechanics support that reading: with plain links, a scraper can pull thousands of URLs out of raw HTML without contacting Google again, but with goto, learning each destination takes a separate request back to Google, which Autom calls slower and noisier, and which leaves a clear pattern when the same client resolves hundreds of links in a row. Autom connects the change to earlier steps it says Google has already taken, removing the &num=100 parameter and tightening BotGuard and SearchGuard, as part of a continuing rise in the cost of unsophisticated SERP scraping.

Autom describes its own path through the rollout: it first saw goto links on only a small percentage of results pages, a share it says was too low to justify shipping a fix without risking broken responses for other customers, and it has been monitoring and testing against the format since. Now that the pattern is consistent for logged-out and private searches, Autom says it has updated its own Google Search pipeline to resolve goto links itself, reading the Location header without following the redirect, and to keep returning the final destination URL through the same structured response fields its customers already use. It tells customers calling its Google Search endpoints that they should keep getting usable destination URLs without changing their own integration, and says it will keep watching Google's rollout and adjust again if the redirect format shifts.

Autom does not give a percentage or count for how many searches or results pages carry goto links, only the qualitative shift from "a small percentage" to what it calls "effectively all" under logged-out and private conditions. It does not say whether or when the same rewrite reaches logged-in search sessions, since the consistent pattern it describes is specific to logged-out and private browsing. And it does not claim to have a permanent fix on either side: Google's rollout may still be an experiment by Autom's own account, and Autom says only that it will keep adjusting its pipeline if the format changes again, not that the matter is settled.

Key facts

  • Google Search now rewrites organic result links into opaque google.com/goto?url=... redirects instead of exposing the destination URL directly in the HTML; Autom says the pattern became consistent for logged-out and private-browsing searches by late August 2026, calling result URLs there "effectively all" goto.
  • The goto parameter uses a custom, Google-specific encoding that cannot be decoded offline, unlike the older google.com/url?q=[destination] wrapper; per Autom, the only way to recover the real destination is to request the /goto URL and read its Location header without following the redirect.
  • Autom, whose business is providing Google Search API and SERP data to customers, reads the change, as its own interpretation rather than a Google statement, as a move against automated harvesting of results pages by AI crawlers and SEO scrapers that bulk-extract URLs to build their own indexes.
  • Autom ties the goto rewrite to earlier Google steps it says already raised scraping costs, including removing the &num=100 parameter and tightening BotGuard and SearchGuard.
  • Autom says it has updated its own Google Search pipeline to resolve goto links by reading their Location header, so customers calling its endpoints should keep getting usable destination URLs without changing their integration.

Why it matters

For years, a Google results page put the actual destination address right in each result's href, so anyone reading the HTML, a person or a script, could see where a link led without asking Google anything further. The goto rewrite breaks that assumption for logged-out and private searches: getting a destination now costs a live request back to Google and a Location header that cannot be decoded ahead of time. That is a change to how a results page itself works, not just a policy update, and it lands squarely on workflows, bulk SERP scraping and AI-crawler indexing among them, that quietly assumed a destination URL was sitting in the page all along.

Who it affects

Autom names AI crawlers and SEO scrapers that bulk-extract result URLs to build their own indexes as the workflows this change targets, in its own reading of Google's motive. It also affects companies like Autom itself, which sell packaged Google Search API or SERP-data access and now have to resolve the goto redirect on their customers' behalf to keep delivering destination URLs. The post does not describe any effect on an ordinary logged-in Google user doing a manual search: the consistent pattern it reports is specific to searches made logged out or in private browsing mode.

How to use it

Anyone reading Google results pages programmatically should stop trying to decode the url= value in a goto link offline, since Autom describes it as a custom Google encoding, not base64 or anything else client-decodable. The destination instead comes from requesting the /goto URL and reading the Location header it returns, without following the redirect. Expect that to be slower than parsing links straight out of HTML, since it now costs one extra request to Google per result, and Autom notes that resolving many links from the same client in quick succession is itself a detectable pattern. Customers who already pull Google Search results through Autom's own API are told they should not need to change anything: Autom says its structured response fields still carry the final destination URL.

How solid is it

This account comes from Autom, one company describing what it has observed and how it responded, not an independent measurement and not a confirmation from Google itself. No percentage or count backs the claim that goto links are now widespread, only the qualitative move from "a small percentage" to "effectively all" under logged-out and private conditions, and the stated motive, that the change targets automated SERP harvesting, is Autom's own reading rather than anything Google has said. Autom also sells Google Search API access and is describing a problem it says it has already solved for its own customers, a detail worth weighing alongside the framing. Against that, the technical description is specific rather than vague: a stated timeframe, late August 2026, and a direct, point-by-point contrast with the older google.com/url wrapper it replaces.

Risks and caveats

The post does not say whether or when the goto rewrite reaches logged-in search sessions, only that the consistent pattern it describes covers logged-out and private-browsing searches. It gives no percentage or count for how many results or results pages are affected, and it does not claim a permanent fix on either side: Google's rollout, by Autom's own description, may still be an experiment, and Autom says only that it will keep watching and adjust its pipeline again if the redirect format shifts, not that the matter is settled.

“Result URLs on Google Search are effectively all goto in those conditions.”

— Autom's blog post on the goto rewrite