Google Hides Direct Links in Search Results Behind a /goto Redirect

Google Search has started rewriting the links in its organic results: instead of a page's real address, the HTML now carries a link in the format google.com/goto?url=.... When you click it, your browser passes through Google and only then lands on the site you wanted.

How this differs from the old scheme

Google wrapped links in redirects before, too, but the old format google.com/url?q=... contained the destination address in readable form — you could simply pull it out of the query string. The new /goto works differently: the url= parameter is encoded using Google's own scheme, it isn't ordinary base64, and it can't be decoded “offline.” Essentially it's an opaque reference to an entry in Google's index. The real address arrives only in the Location header when you make a request to /goto.

According to the service Autom, which was the first to publish the observation, isolated goto links had been spotted before, but since the end of August 2026 the scheme has been working consistently for logged-out users and incognito mode — under those conditions practically every link in the results goes through the redirect. It can't be ruled out that this is still an experiment, but it has long since spread beyond a small share of queries.

Why Google is doing this

The author of the piece ties the change to Google's broader fight against the automated harvesting of results — above all by AI crawlers and SEO scrapers, which pull result addresses in bulk to build their own indexes. Previously a parser could extract thousands of links straight from the HTML without ever touching Google again. Now every address requires a separate request back to the search engine: that's slower, more conspicuous, and gives Google a clear signal when one and the same client resolves hundreds of links in a row.

The move fits into a string of earlier measures: disabling the &num=100 parameter and tightening the BotGuard and SearchGuard mechanisms. Google is methodically raising the cost of naïve scraping of its results.

A caveat about the source

It's worth keeping in mind that the piece was written by Autom, a company that sells an API for harvesting data from search engines, and it ends with an ad for that service: the authors report that they have already learned to parse goto links and hand clients the final addresses back unchanged, with no changes to their integration. The technical details do look credible, but the overall tone comes from a party with a stake in scraping. It's also curious that the destination address still remains somewhere on the page: Google itself needs it in order to render the domain, favicon and caption of a result.

Source: Hacker News