Google has begun routing some organic Search result links through opaque google.com/goto?url=… redirects, reducing users’ ability to independently inspect a destination URL before clicking.
The change appears designed to raise the technical and financial cost of mass scraping. However, it also weakens a long-standing, basic anti-phishing habit: hovering over a link to verify where it leads.
Rather than embedding a publisher’s URL directly in the result link, affected Google Search pages now serve a Google-controlled passthrough URL containing an unreadable, Google-specific encoded value.
When a user selects the result, the browser contacts Google’s /goto endpoint first and is then redirected to the intended destination.
The visible site label displayed above or near the result remains unchanged, but the browser’s hover preview or status bar may reveal only the intermediary Google URL.
The company has not publicly identified the specific abuse category driving the change.
The most likely rationale is anti-scraping enforcement. Previously, rank trackers, SEO platforms, research systems, archival services, and alternative search providers could extract final destination URLs directly from the Search results page HTML.
Under the new model, automated collectors must resolve each google.com/goto link individually to determine where it points.
Search-data provider Autom said the final URL is available in the HTTP redirect response’s Location header.
In practice, a collector must send a request to the /goto URL without automatically following the redirect, then read the returned Location value.
That adds at least one lookup per result and gives Google more opportunity to apply request limits, behavioral analysis, bot detection, or access controls.
The implementation is technically significant because the opaque url parameter is not simply a URL-encoded destination that can be decoded locally.
The destination must be resolved by Google’s infrastructure, turning what was once passive extraction from a search page into an active request workflow.
For end users, the change creates a transparency problem. Security guidance has long advised people to hover over links in email, chat messages, documents, and web pages before clicking, checking whether the browser preview matches the claimed destination.
Malwarebytes confirmed the rollout in a statement, saying it has “a long history of deploying technical measures against evolving forms of abuse” and regularly acts to protect its services and users.
Harder Link Verification
In affected Google Search results, that preview no longer provides an independent confirmation of the outbound domain.
This does not mean Google redirects inherently send users to malicious websites. The redirect is expected to forward the user to the selected result.
However, hiding the destination from the pre-click interface removes a useful verification layer, especially for users evaluating lookalike brands, typosquatted domains, sponsored-content impersonation, or search-optimized phishing pages.
The visible destination label remains available, but it is not equivalent to examining the actual clickable URL.
A security-conscious user can normally compare the displayed domain, hyperlink target, certificate details after landing, and contextual signals.
The new design makes the first of those checks substantially less reliable at the moment it is most useful: before navigation occurs.
The operational consequences extend beyond hostile bots. SEO monitoring access, digital forensics, accessibility tooling, academic research, web archiving.
Independent indexing services may all face additional infrastructure costs and rate-limit exposure because each result now requires server-side resolution.
Community discussions have also highlighted the irony that Google’s own search engine depends on automated collection of publicly reachable web content while making its own results more difficult to collect programmatically.
For security teams, the development is another reminder not to rely on hover text alone.
Organizations should reinforce layered URL-verification practices, including domain reputation controls, DNS and web filtering, browser isolation where appropriate, email security protections, and user training focused on validating domains rather than trusting search rankings or page appearance.
Google’s redirect architecture may deter large-scale extraction, but it does so by placing a Google-controlled opaque layer between users and the link they are being asked to trust.
★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
