google.com/goto: Google rewrites search result links in anti-scraping push

Google Search has begun rewriting the links on its organic results to google.com/goto?url=..., hiding the destination address from the page source. The change was documented by the SERP API provider Autom in a blog post published on 27 August 2026.

Instead of pointing at the target site, each result now carries a /goto link. Clicking it redirects the browser to the real page, but the url parameter is not a plain base64 encoding of the destination and cannot be decoded offline. The post describes it as an opaque reference to Google's index record for that page.

Different from google.com/url

Google has wrapped links before. The older format, google.com/url?q=..., contains the URL-encoded destination in the query string, so the target is readable at a glance. The new format removes that: the result href is just /goto, the blob cannot be decoded locally, and the real address only appears in the Location header returned by the redirect endpoint. Autom advises reading that header with a HEAD request rather than following the redirect.

Google still needs the destination to render the results page, including the domain name, favicon and attribution, so copies of the URL remain in the HTML. That does not restore the old simplicity, because a parser still has to resolve each result to learn where it points.

Why Google is doing it

The change fits Google's broader campaign against automated result harvesting, particularly by AI crawlers and SEO tools that extract URLs in bulk to build their own indexes. With plaintext links, a scraper could pull thousands of destinations out of the HTML without contacting Google again. With goto, every result costs an extra request to Google just to learn the destination — slower, noisier, and easy to flag when one client resolves hundreds of links in a row.

It follows earlier steps such as removing the &num=100 parameter, which many scrapers used to fetch a hundred results per page, and tightening the BotGuard and SearchGuard systems.

What it means in practice

Autom says it first saw goto links on a small share of result pages, where a fix would have risked breaking responses for everyone else. By late August 2026 the pattern was consistent for logged-out and private browsing sessions, and the company has updated its search pipeline to resolve the redirects — reading Location without following it — and to return final destination URLs in the same structured fields customers already use. Google has not announced the change, so it may still be an experiment.