Google's New Search Redirects Obscure Link Destinations, Sparking Security and Usability Concerns
Google's implementation of opaque google.com/goto?url= redirects for some search results hinders users' ability to verify links before clicking, raising security and usability issues.
Google has begun routing a portion of its search result links through an opaque redirect mechanism, identified as google.com/goto?url=.... This change replaces direct links to destination websites with a custom, encoded URL parameter, making it significantly harder for users to preview where a link will take them before they commit to clicking.
Google confirmed the rollout to Search Engine Roundtable, stating, "We have a long history of deploying technical measures against evolving forms of abuse, and we regularly take steps to protect our services and users." While the company has not specified the exact nature of the abuse it aims to prevent, security researchers and observers speculate that the primary goal is to make it more difficult and costly for automated tools to scrape destination URLs in bulk from Google search results. This would require scrapers to perform an additional request for each result to resolve the redirect.
The change has drawn criticism from some users and observers who find it ironic that Google, a company built on automatically collecting information from other websites, is now making it harder for others to gather information from its own search results. The move also impacts legitimate tools and services that rely on parsing search result destinations, such as rank trackers, SEO auditing software, research platforms, archival services, and accessibility tools.
According to search results data provider Autom, the final destination URL is only accessible via the Location header in the redirect response. This necessitates an extra HTTP request for every single search result that employs the new redirect, potentially increasing costs and introducing rate-limiting challenges for services that process a high volume of search data.
From a security perspective, the change undermines a common user-advising practice: hovering over a link to preview its destination before clicking. When hovering over a link now reveals an encoded Google redirect rather than the actual website address, this preview method becomes less reliable. While Google still displays the claimed destination above each search result, the inability to independently verify the link's target through a simple hover action removes a valuable layer of user-initiated security checking.
This development raises questions about how security advice will evolve. Users are already cautioned against clicking sponsored search results, and the new redirect mechanism may necessitate further warnings, potentially advising users to be wary of goto?url= links as well, unless Google provides a more transparent method for link verification.
The shift could inadvertently create a less secure environment for users who rely on visual cues and link previews to identify potentially malicious sites. By obscuring the final destination, Google's new redirect system, while perhaps intended to curb abuse, risks diminishing user confidence and complicating the already challenging task of navigating the web safely.