Google Quietly Routed Every Result Link Through a Redirect. Your Analytics Didn't Notice.

Right-click a Google search result today and copy the link address. You will not get the website. You will get something that starts with google.com/goto and then a long string of characters that means nothing to you.

That is not a bug, and it is not your browser. Google confirmed on 26 August 2026 that it is rolling out these passthrough URLs across search results. Every blue link now points at Google first and at the actual site second.

I spent a chunk of last week reading everything written about this, because three people asked me the same question in different words: is this why my numbers moved? The short answer is almost certainly no. The longer answer is more interesting, and the amount of confident nonsense written about it in the last two weeks is genuinely impressive.

Let me separate what Google confirmed, what people have actually measured, and what is somebody guessing on LinkedIn.

What Actually Changed, and When

Testing started in July 2026. Derek Perkins from Nozzle, who tracks SERPs at scale for a living, reported near 100% rollout across several residential IP providers by the time Google confirmed it on 26 August.

Google's statement, in full, was this: "We have a long history of deploying technical measures against evolving forms of abuse, and we regularly take steps to protect our services and users."

That is the entire official explanation. No technical documentation. No developer blog post. No specification of the redirect status code, the encoding format, or the referrer behaviour. Google confirmed the change exists and said nothing else about how it works.

I want to flag one thing early, because I got it wrong myself before I checked. I had it in my head that this started in spring. It did not. The first sightings cluster in late June and early July 2026, and the confirmation is late August. If you read a post claiming this has been running quietly since March, that post is wrong, or it is describing something else.

The google.com/goto redirect is not limited to standard organic results either. Analysis of SERP samples by DataForSEO found wrapped links across AI Overviews, local packs, and paid ads as well, not just the ten blue links. Organic results are the most completely wrapped surface, at close to 100%.

What the Redirect Does Mechanically

The old behaviour: the href attribute in the search result markup contained your actual URL. Anyone reading that page, human or machine, could see where the link went without clicking it.

The new behaviour: the href contains a Google URL with an opaque token. The destination is encoded, not written. To find out where a link goes, you have to follow it and let Google's server send you onward with a redirect. Reports from people running this at scale describe a 302, which is the temporary redirect, and note that HEAD requests against the endpoint are blocked, so you cannot cheaply peek at the destination without a full request.

That last detail is the whole point, and I will come back to it.

For a person clicking a result, nothing changes. You click, you land on the page you expected, there is no interstitial, no visible delay, no consent screen. The extra hop happens on Google's servers in the time it takes your browser to start loading the next page.

Why Your Referrer Probably Survived It

Here is the part everyone got wrong first, myself included for about an hour.

The obvious fear is that a redirect hop breaks the Referer header, your site sees nothing, and GA4 dumps the session into direct traffic. That fear is reasonable. It is also, based on the only real testing I have seen published, not what happens.

The team at Attributer clicked organic results across ten device and browser combinations: MacBook Pro on Chrome, Safari and Firefox, a Windows 11 laptop on Chrome, Edge and Firefox, an iPhone on Safari and Chrome, an Android phone on Chrome and Samsung Internet. The referrer arrived intact in all ten. Every visit was categorised as organic search. Not one landed in direct.

The reason is elegant, and it is worth understanding rather than memorising. Google's search pages set a Referrer-Policy of origin. That means the browser never sends the full search URL to your site anyway, only the origin: https://www.google.com/. That is all you have been receiving for years. The search query itself has been stripped since Google moved to secure search back in 2011, which is where the old "(not provided)" wound came from.

Now add the redirect. The search results page is on google.com. The /goto endpoint is on google.com. Same origin, same policy. The referrer your server receives is still https://www.google.com/, because it was never more specific than that in the first place.

Google stripped the useful part of the referrer fifteen years ago. There is nothing left in it for a redirect to break.

What GA4, Search Console and Server Logs Actually See

Three surfaces, three different answers, and mixing them up is where client conversations go sideways.

Search Console is not affected, and this one is not in doubt. GSC counts impressions and clicks inside Google's own pipeline, from Google's side of the interaction. It never parsed your href out of a results page. The redirect changes nothing about how a click is recorded.

Server logs should look the same as before. You were already logging https://www.google.com/ as the referrer for organic visits. You should still be logging exactly that. If your logs suddenly show google.com/goto as a referrer value, that is worth a note, but it would still resolve to google.com as the source for any sane classification rule.

GA4 is the one people are worried about, and the worry is mostly theoretical. GA4 assigns google / organic based on the referrer hostname plus its own signals. If the referrer arrives as google.com, which the testing says it does, the session is classified as organic exactly as before. UTM parameters you added to your own URLs are inside the encoded destination and come back out the other side of the redirect, so they survive too. Nobody has published a test showing Google's redirect deleting query parameters.

The Direct Traffic Panic Is Mostly Unverified

There is a genre of post going around right now claiming that analysts "worldwide" are seeing unexplained spikes in Direct and Unassigned traffic, caused by browsers dropping the referrer across a cross-origin double hop.

I read several of these carefully. Not one of them contains a test, a screenshot, a property, a date range, or a number. They contain a diagram of the redirect flow and a confident assertion. The mechanism they describe, browsers stripping referrers on cross-origin redirects, is not how referrer policy works when both hops are on the same origin and the policy is already origin.

So here is my honest split.

Confirmed by Google: the redirect exists, it is rolling out, it is an anti-abuse measure.

Observed and reproducible by third parties: near-total rollout, an encoded destination, a 302, blocked HEAD requests, coverage across AI Overviews, local packs and ads, and the referrer surviving intact across ten browser and device combinations.

Inference or speculation: everything about GA4 direct traffic spikes, anything about AI Mode attribution as a motive, and any claim that this is preparation for agentic browsing traffic. Those might all turn out to be true. None of them is currently supported by anything I can point you at.

I am not going to invent numbers from my own sites to settle it either. One agency's charts are not a test, and reading a redirect into whatever your own traffic did in August is exactly the kind of thing I am complaining about. This is the same measurement blindness problem I wrote about in Half My Traffic Says "Direct." I Stopped Pretending I Knew Why., just from the opposite direction: there, the data really was missing and everyone assumed it was fine. Here, the data is fine and everyone assumes it is missing.

Who This Actually Hurts

Not you. Rank trackers.

Before this change, one request to a search results page gave you every URL on it. Now the destination is not in the page. To build a five-page ranking report you have to follow each wrapped link individually. Estimates from people running these systems put it at roughly 500 to 1,000 requests where one used to do, because HEAD requests are blocked and each token needs a full round trip to resolve.

That cost lands on rank tracking tools, SERP APIs, and anyone scraping results to feed an AI product. Google has been in litigation with SerpApi since December 2025 over exactly this, and in July 2026 a US federal court dismissed Google's DMCA claims, holding that bypassing anti-scraping controls to reach uncopyrighted search results is not circumvention under that law. A month later, the redirect shipped. Draw your own line between those dots, but note that Google never named scrapers, rank trackers or AI companies in its statement.

Practically: if your rank tracking gets slower, more expensive, or patchier over the next few months, this is why. Your rankings did not change. Your ability to cheaply observe them did.

Rankings, Link Equity and Crawling: No Effect

I want to be blunt because the SEO internet is not being blunt about this.

The redirect happens at click time, in the browser, after Google has already ranked and indexed everything. It is not a redirect on your site. It is not in your link graph. It does not sit between Googlebot and your pages. Your canonical URL is unchanged, your indexed URL is unchanged, and a 302 wrapper on a click has no bearing on how PageRank flows anywhere.

If someone tells you to "fix" this, or sells you an audit to address it, they are selling you nothing. There is no site-side change to make. When I run through my own AI-assisted SEO audit workflow, this does not add a single line item.

What to Check This Week

Fifteen minutes, then stop.

Open GA4 and pull google / organic sessions for the last 90 days, daily. Put Direct / None next to it on the same chart. If organic drops and direct rises on the same day, you have an attribution question worth chasing. If they move independently, or not at all, you are done.

Then open Search Console and compare clicks for the same window. GSC is your control group here, because it is measured on Google's side and untouched by the redirect. Search Console clicks steady while GA4 organic falls is the signature of a measurement problem. Both falling together is a traffic problem, and a real one. I went through this comparison in detail for AI-driven traffic in what Search Console's AI traffic numbers actually say, and the same logic applies: two sources disagreeing tells you more than either one alone.

Last, grep your access logs for google.com/goto in the referrer field. My expectation is you find nothing, and finding nothing is the correct result.

What to Tell a Client Who Asks

Something close to this, and no more:

"Google changed how the links in search results work in August. Clicks now pass through a Google redirect before reaching us. It is an anti-scraping measure aimed at tools that copy search results, it does not affect our rankings, and testing so far shows our analytics still attribute those visits to Google organic correctly. If our numbers moved, the cause is somewhere else and I am looking at that separately."

The last sentence is the one that matters. The temptation with any Google announcement is to use it as an explanation for whatever the chart is doing. Resist that. A tidy story about a redirect is much more comfortable than admitting a competitor out-published you in Q3, and it is also wrong.

If a client asks specifically about their reporting tools rather than their traffic, that is a fair question with a real answer: rank tracking got more expensive to do, so expect some vendors to raise prices, reduce refresh frequency, or lose coverage on deeper pages. That is a supplier problem, not a site problem. The same caution applies to the newer reporting surfaces in Search Console, which I looked at in Search Console's social media properties: new data is not automatically better data.

Where I Am Landing

The google.com/goto redirect is the rarest kind of Google change, one that is genuinely significant and genuinely does not require you to do anything.

The measurement effect is real but sits almost entirely on third-party tooling, not on your analytics. The referrer survives because Google had already reduced it to a bare origin years ago, which is a slightly grim joke: the change cannot break your data because Google already took the part worth breaking.

What I am less sure about is where this goes. An endpoint that sees every click and can encode arbitrary state into a token is useful infrastructure for far more than blocking scrapers. If Google starts attaching attribution data to those tokens for AI Mode, or shaping what agents can and cannot resolve, that is a different story with real consequences. There is no evidence of it today. I am watching, not predicting.

For now: check the two charts, tell the client the truth, and go back to work.

If you want a second pair of eyes on why your organic numbers actually moved, rather than a reason to blame a redirect, that is the sort of thing I do at wunderlandmedia.com.