If you have moused over a Google search result this week and seen google.com/goto?url= in the status bar instead of the site you were about to visit, that is not your browser and it is not an extension. Google confirmed on 26 August 2026 that it is rolling this out.
The confirmation is one sentence. A Google spokesperson told Search Engine Roundtable:
“We have a long history of deploying technical measures against evolving forms of abuse, and we regularly take steps to protect our services and users.”
That is the entire primary record. There is no blog post, no documentation page, and nothing on the Search Status Dashboard. So everything below separates what Google said, what I could test myself, and what is still a guess.
What actually changed
Before, a result link in the SERP pointed at the destination. You saw the full URL on hover and the click took you there. Now the link points at https://www.google.com/goto?url=<hashed>, which redirects on to the page. The behaviour was first spotted in testing in July 2026 and has now been confirmed as rolling out.
The word doing the work is hashed. I tested this on 28 August 2026, and it is the detail that explains the whole change:
GET https://www.google.com/goto?url=https://shahidali.co/
-> 400 Bad Request
GET https://www.google.com/url?q=https://shahidali.co/
-> 200 OKThe old /url?q= passthrough still accepts a plain URL from anyone. The new /goto endpoint rejects one. You cannot hand a goto link a destination and have it work, because the parameter is a signed or hashed value that only Google can mint, and it is presumably scoped to the search that produced it.
Why is Google doing this?
Google’s own answer is “abuse”. The practical reading, which Google did not say and I am labelling as inference, is scraping. If every result link is a signed redirect through Google’s own domain, then every third party that reads a SERP page and extracts destination URLs has to do more work, and Google gets a log line for each real click. That covers rank trackers, SERP APIs and the AI products that read search results to answer questions.
I want to be careful here, because the two readings have different consequences and the trade coverage tends to blur them. “Anti-abuse” and “anti-scraping” are compatible, and Google chose the first word. Nothing in the confirmed statement mentions AI, scrapers or rank tracking.
Does this change your rankings?
No. This is a change to the anchor on a results page, not to how pages are crawled, indexed or ordered. Nothing about it touches why a page is or is not in the index, and if you see a ranking move this week the August 2026 spam update, which completed on 21 August, is a far likelier explanation than a redirect hop.
Does it change your Search Console numbers?
It should not, and here is the reason. Search Console counts a click at Google’s end, when the result is clicked, not when your server is reached. Google is now the first hop rather than the referrer of a direct navigation, and it is still the thing recording the click. If anything, a redirect Google controls gives it a cleaner click signal than it had before.
I am flagging this as reasoning rather than measurement. My own property is small enough that a few per cent either way would not be visible in 28 days of data, so I cannot prove it from my numbers, and I am not going to pretend otherwise. If you run a site with real volume this is worth watching, and the thing to remember first is that Search Console data runs two to three days behind, so nothing you look at today describes today.
The thing actually worth checking: your referrer data
This is where a redirect hop can genuinely cost you something. Analytics tools work out that a visit came from organic search by reading the Referer header the browser sends. An extra hop through google.com/goto is still on google.com, so a session should still attribute to Google. What can shift is the detail: whether the referrer arrives as the full search URL, as a bare origin, or not at all, is decided by the referrer policy on Google’s results page, not by anything on your site.
That last point catches people out. Your own Referrer-Policy header has no say in this. It governs the referrer your pages send when someone leaves you. This site sends strict-origin-when-cross-origin, and that setting is irrelevant to what Google hands over on the way in. The sending page always decides.
So check these three, in this order:
- Your analytics acquisition report, comparing this week to the same weekday last week. You are looking for organic search traffic falling while direct or referral rises by roughly the same amount. That pattern is misattribution, not a traffic loss.
- Whether any
google.comreferral rows have appeared next to your usual organic rows. A redirect that is misread by your tool shows up as a referral from the redirector. - Your server or CDN logs for
referervalues containing/goto. Logs are the only place you see the raw header rather than a tool’s interpretation of it.
If all three look normal, there is nothing to do. This is a change to Google’s plumbing, and for most sites the correct response is to record the date and move on.
What I am doing about it
Noting 26 August 2026 as a marker on the client sites I watch, so that a referrer anomaly six weeks from now has a candidate cause instead of becoming a mystery. That is the same habit as logging update dates: half of diagnosis later is knowing what changed and when.
The one group that should care more than “note the date” is anyone whose reporting depends on scraping SERPs. If your rank tracking gets patchier over the next month, this is the change to look at first, and it is also a reminder that the site: operator was never a measurement tool either. Numbers you take from a results page are numbers Google can change the shape of without telling you.
Update, 2 September 2026: what it costs the trackers, and how to read your reports this month
A week on, the rollout looks close to complete and the cost to rank trackers has a number on it.
Derek Perkins of the rank tracker Nozzle, quoted by PPC Land, says the goto links cannot be decoded locally. The destination is packed inside the link as Protocol Buffers ciphertext, so the only way to learn where a result points is to follow the redirect. Google refuses HEAD requests on it, so each link costs a GET that stops at the 302. Resolving every link on a five-page ranking takes 500 to 1,000 requests, and at that volume the limit is rate limiting, not bandwidth. Nozzle recorded near total coverage across several residential IP providers on 26 August, the same day Google confirmed the change, after about four months of testing.
Two things follow for anyone reading a ranking report this week.
First, a jump or a drop that only your tracker shows, with Search Console average position flat for the same query, is the tool adjusting to the new links, not your page moving. Search Console does not scrape results pages, so it is the tie-breaker. Check the query in the Performance report, compare average position across the same weekdays, and only then decide whether anything happened.
Second, coverage is uneven while the providers catch up. SerpApi lists the result types where it is still resolving goto links and the ones it has finished, and says the pattern varies by feature and keeps changing. So one tracker showing gaps while another looks normal is expected for a few weeks. Tell clients before the monthly report lands, not after they ask why a keyword vanished.
I have seen a claim going round that signed-in users get direct links and incognito sessions get goto links. I could not confirm it, and Nozzle’s residential IP data points to bucketing by network and cookie rather than by sign-in state. Treat it as an observation, not a rule.
Nothing in this update changes the advice above. Rankings, crawling and indexing are untouched. The referrer check is still the one thing worth doing on your own site.
Sources
- Search Engine Roundtable, confirmed: Google Search rolling out google.com/goto tracking parameters, 26 August 2026, including the Google spokesperson statement quoted above
- Search Engine Land, Google confirms deploying goto URL redirects to search results links, 26 August 2026
- Google Search Status Dashboard, incident summary, checked 28 August 2026, no entry for this change
- First-hand: requests to
google.com/goto?url=andgoogle.com/url?q=with a plain destination, made 28 August 2026, returning 400 and 200 respectively - PPC Land, Google forces rank trackers into 500 to 1,000 requests per query, quoting Derek Perkins of Nozzle on HEAD requests, request counts and coverage, read 2 September 2026
- SerpApi, Google’s new /goto redirect URLs: resolution in progress, on the protobuf encoding and which result types are still unresolved, read 2 September 2026