Google's goto links and poisoned SERPs: what changed in 2026

As of November 12, 2026, Google sends many result links through google.com/goto?url=CAES… redirects instead of linking straight to the site, and since October 30 SERP vendors report that Google also limits how fast those redirects can be followed. Separately, the rank tracker Nozzle reports that since mid-September a large share of the Google pages its tracker collects are “poisoned”, with most of the usual sites missing.

If you buy Google results from a SERP API or scrape them yourself, this changes what a “result” is worth. Below is the dated timeline, which parts Google has confirmed and which only vendors have seen, the fix and its cost, and the questions I’d put to a SERP vendor this week.

Short on time?

What I'd do now

You buy Google results from a SERP API

Stay only with a vendor that documents goto resolution

SerpApi, DataForSEO, Serper and Autom have published that they resolve links. Spot-check the link field weekly either way.

You track rankings

Confirm drops in Search Console first

Nozzle reports 27.6% of its SERPs poisoned since September 13. Treat any sudden drop since then as suspect until Search Console agrees.

Your team scrapes Google directly

Move business-critical work to a SERP API

You now need one extra request per result, vendors report throttling of up to 120 seconds per URL, and Google's spam policy names rank-check scraping.

You run a website

Change nothing on the site

Visitors still reach you after the redirect. The risk is a false alarm from a rank tracker, not a real ranking loss.

You build a crawler or AI agent

Store the resolved URL with a timestamp

Never store /goto links. If you can't resolve them reliably, get results from an official or independent-index API instead.

Prices verified 12 Nov 2026. Sponsors cannot buy a verdict or a position.

What is a goto link? #

A goto link is a Google result link that points at Google, not at the site: google.com/goto?url= followed by a long token that starts with CAES. When a person clicks it, Google redirects them to the real page. ScrapingBee.

The token is opaque. Nozzle’s Derek Perkins told Search Engine Roundtable that “The goto links can’t be decoded, so providers will have to follow the redirect links.” Search Engine Roundtable. ScrapingBee could work out the token’s structure but not decrypt it. ScrapingBee.

Not everyone sees goto links. In ScrapingBee’s small September 7, 2026 sample, Chrome and Edge got /goto?url=CAES…, Safari got a /url?…&url=CAES… variant, and Brave and LibreWolf got direct links. That’s one vendor’s environment, and Google hasn’t documented who gets what.

How did we get here? #

Goto is the newest of several changes Google has made since January 2025 that make automated access to Search harder. Here they are in order, as of November 12, 2026.

Date	What happened	Who says so
2025-01-17	Google requires JavaScript for Search, citing 'bots and evolving forms of abuse and spam'	Google spokesperson, via TechCrunch
2025-09-11 to 09-12	The num=100 parameter stops returning 100 results	Search Engine Roundtable and other trackers
2025-09-18	Google confirms it doesn't support the results-per-page parameter	Search Engine Land headline
2025-12-19	Google announces its lawsuit against SerpApi	Google blog
2026-06-23	Goto links spotted publicly (Alex Greenland on X)	Search Engine Roundtable, reported 2026-07-08
2026-08-26	Google confirms the rollout: 'technical measures against evolving forms of abuse'	Google spokesperson, via Search Engine Roundtable
2026-08-27	DataForSEO says it returns direct organic URLs for 99.99% of SERPs	DataForSEO
2026-09-05	SerpApi says it is returning direct destination URLs again	SerpApi blog
2026-09-13	Nozzle's requests start failing	Nozzle
2026-09-20	Nozzle sees its first poisoned SERPs	Nozzle
2026-09-24 to 10-08	Google's September 2026 spam update rolls out (overlaps the poisoning window)	Search Engine Roundtable
2026-10-30 to 10-31	Serper reports a per-page goto limit and a temporary workaround	Serper status page
2026-11-02	DataForSEO reports Google throttling redirects, up to 120 seconds per URL	DataForSEO
2026-11-02	Nozzle's poisoning rate peaks at 68.6%	Nozzle
2026-11-03	Nozzle updates its report (27.6% vs 0.28%); SerpApi opens a goto incident	Nozzle; SerpApi status
2026-11-08	SerpApi marks the incident resolved	SerpApi status
2026-11-09	Court dismisses Google's amended complaint against SerpApi, with 21 days to amend	ECF 62
2026-11-11	Brave announces encrypted result links, citing goto	Brave blog

Source: TechCrunch 2025-01-17; Search Engine Roundtable 2025-09-12, 2026-07-08, 2026-08-26 and spam-update report; Search Engine Land 2025-09-18 (headline only); Google blog 2025-12-19; DataForSEO, SerpApi, Serper, Nozzle pages; ECF 62; Brave blog. All read 11-12 Nov 2026. Scroll sideways for more columns.

Google’s four levers, side by side #

Google has pulled four levers that hit automated access to Search, and it has confirmed only some of them. This is the distinction most coverage skips, so I’ve kept it in its own column.

On the JavaScript change, Google also told TechCrunch that “fewer than .1%” of searches come from people with JavaScript turned off. More on num=100 in the glossary.

Google’s lawsuit against SerpApi gives the system it says scrapers get around a name: SearchGuard. That name comes from Google’s complaint, as I cover in Google v. SerpApi; Google’s public documentation doesn’t describe how it works.

Why did Google do this? #

Google’s own words are short and general. Its August 26, 2026 statement: “We have a long history of deploying technical measures against evolving forms of abuse,” “and we regularly take steps to protect our services and users.” It doesn’t mention goto, scraping, scope or a date. Search Engine Roundtable.

Its spam policy is more specific. “Machine-generated traffic (also called automated traffic) refers to the practice of sending automated queries to Google,” and it lists “scraping results for rank-checking purposes or other types of automated access to Google Search conducted without express permission” as violations of “our spam policies and the Google Terms of Service.”

In its December 19, 2025 post announcing the SerpApi suit, Google’s General Counsel accused SerpApi of “circumventing security measures protecting others’ copyrighted content”, “cloaking themselves, bombarding websites with massive networks of bots” and “giving their crawlers fake and constantly changing names”. Google said it was suing “as a last resort”. Google blog.

Anything beyond that, such as “Google wants to protect AI Overviews” or “Google wants to sell its own API”, is a theory. I haven’t found Google saying either.

How do scrapers get the real URL now? #

The documented fix is one extra request per link: request the goto URL without following the redirect and read the Location header, which holds the destination. Autom and ScrapingBee both publish code for it. Autom, ScrapingBee.

They disagree on the method, and I can’t tell you who’s right. Autom (August 31, 2026) recommends a HEAD request first and a GET only if HEAD returns nothing, and says Google may answer with a 402 status that still carries a Location. ScrapingBee (September 7, 2026) says “HEAD does not work for this”: in its tests HEAD returned 200 with no Location, while GET returned the 302.

Both are single-environment observations, which suggests Google may answer differently by client or network. If you build this yourself, handle both cases. ScrapingBee also reports tokens still resolving more than 24 hours later, and a median of about 57–59 ms per resolve across its 50-URL test; it didn’t find a maximum lifetime.

Autom adds that “AI Overviews stay on /goto”. DataForSEO’s August 27 numbers point the same way: SERPs with at least one unresolved goto link were 52.26% for AI Overviews and 25.1% for local packs, against 0.01% for organic results. DataForSEO.

The throttling that started on October 30 #

The “one extra request” math stopped being the whole story in late October. Serper’s status page reported a Google change on October 30 and said “We now resolve the top 3 organic links”, leaving results 4–10 as /goto and pointing customers to a new /resolve endpoint. On October 31 it marked the incident resolved with “another way to get the real URLs”, which it called “likely temporary”. Serper status.

DataForSEO’s November 2 update was more specific: “Google starts throttling the redirects”, with an interstitial “Continue” button, and “the delay can be as long as 120 seconds per URL”. It says the limit applies per results page, not per IP or query, and “Waiting before resolving the URLs does not reset the limit”.

Its Standard priority still resolves all links, more slowly; High Priority and Live resolve “approximately 50%”. DataForSEO.

SerpApi’s status page shows an incident titled “/goto links returned in organic_results->link” opened November 3 at 23:38 UTC and resolved November 8 at 07:11 UTC, after an earlier one on October 30. A note added on November 7 to its September post says “/goto links may occasionally reappear”. SerpApi status, earlier incident, SerpApi blog.

Search Engine Journal summarized these reports on November 5 and found no Google statement about throttling. SEJ. So the throttling is vendor-observed: Serper and DataForSEO describe it consistently, and SerpApi’s incidents give no cause.

What are poisoned SERPs? #

“Poisoned” is Nozzle’s word for a Google results page where most of the sites that normally rank for a keyword are missing. In its definition, a page is poisoned when fewer than half of that keyword’s usual sites for that page appear anywhere on the SERP, and a SERP counts as poisoned if page 1 or 2 is. Nozzle.

Nozzle’s report was published October 10, 2026 and updated November 3, 2026. The current version covers August 20 to November 3, 58 countries, desktop, iPhone and Android, and 68.7 million judged SERPs, 42.5 million of them since September 13:

Nozzle says its requests “began failing” on September 13 and poisoned SERPs first appeared September 20. The rate hit a September high of 43.5% on September 30, then peaked at 68.6% on November 2. Of poisoned SERPs, 45.1% recovered within three days and 89.0% within two weeks.

If you saw smaller percentages in October coverage, they come from the first version of the report, which used a narrower measure and an earlier window. I’d use the November 3 figures.

How big is the problem? Vendors disagree #

Other rank trackers see far less, and that disagreement is the most useful thing to know. Per PPC Land’s October 19 report, AccuRanker flagged 30.2% of desktop and 25.7% of mobile results on September 25, then about 1.4% on September 29, 1.47% from October 1 to 9, and 0.47% on October 17. AccuRanker put the gap down to how each vendor’s requests look to Google. PPC Land.

Semrush told PPC Land it had seen the issue “since late summer” and that “The impact on the rankings our users track has been limited.”

My read: the effect seems to depend on how a tracker collects, so the same week can look like a crisis at one vendor and a blip at another. That’s also why your own vendor’s numbers matter more than anyone’s headline.

Two caveats. Google hasn’t commented on poisoning at all, so “Google is poisoning results” is an inference from the data, not something Google has said. And Google’s September 2026 spam update ran from September 24 to October 8, overlapping the window; no source I read links the two. Search Engine Roundtable.

What should you ask your SERP API now? #

Most SERP vendors have published something about goto. Few say anything about cost, and none of the pages I read describes how it detects poisoned results. Here’s what each vendor’s public pages state, as of November 12, 2026.

SerpApi’s August 30 post also said some customers had briefly received “a plain string with this form CAES{....}” in the link field, that titles, snippets and positions were unaffected, and that “No changes are required to your SerpApi integration”. SerpApi.

apiserpent.com has the clearest published answer on depth, which is the other half of this story. Its docs say a Quick search is “flat: one call, one charge” for up to 100 organic results via num=, while Deep “bills one Web unit per requested page” and the bulk serp_web endpoint counts “num=100 is 10 units”. So a top-100 check in Quick mode is one charge, not ten, after Google killed num=100. Docs.

What its docs don’t do is mention goto, CAES or resolution at all, and it has no published poisoning or legal-cover statement. Its blog dates the num=100 change to September 11, 2025, but I found no post on goto. apiserpent.com blog. Ask it the same five questions as everyone else.

Five questions for any SERP vendor #

1. Is link always the final destination? Or can it be a /goto URL or a raw CAES string, and for which result types (AI Overviews, local packs)?
2. What happens under throttling? Do you wait, resolve only some links, or return partial results, and is that flagged in the response?
3. Does resolution cost extra, in credits or in slower responses?
4. How are 100 results billed now that num=100 is gone: one charge or ten?
5. How do you detect poisoned pages, and do you re-fetch them or tell me?

For legal cover, read what SERP vendors’ legal protection actually covers. For price comparisons, see the cheapest SERP API comparison and my best SERP API roundup.

If you scrape Google yourself #

Start with the policy, because it’s unambiguous about rank tracking. Google’s spam policy names “scraping results for rank-checking purposes” without “express permission” as a violation of its spam policies and Terms of Service. That’s Google’s rule, not a court ruling, and this isn’t legal advice; for the broader legal picture see is robots.txt legally binding?.

Then the cost. Ten results used to be one request. With goto it’s at least 11 (my arithmetic: one page plus one resolve per link), and with throttling DataForSEO reports waits of up to 120 seconds per URL, applied per results page. A top-100 check now means 10 pages and up to 100 resolves.

If you keep going anyway, these are the habits I’d adopt from what vendors report:

• Resolve every goto link before storing anything, and record the time you resolved it.
• Handle both HEAD and GET, plus a 402 that carries a Location, since vendors disagree on which works.
• Check every page against what normally ranks for that keyword, and re-fetch pages where most usual sites are missing.
• Compare your rankings with Search Console for sites you own before acting on a drop.

For most teams I’d rather pay a vendor to absorb this. My build vs buy comparison covers when building still makes sense.

Is there an official way to get Google results? #

Not for the whole web. Google’s Custom Search JSON API is “closed to new customers”, and existing customers “have until January 1, 2027”; it costs “$5 per 1000 queries, up to 10k queries per day”, with 100 free queries a day. Google.

Grounding with Google Search in Gemini is the other official route, but it returns model answers with sources rather than a results page. I compare every remaining option in is there a Google Search API?, and the search API pillar maps independent indexes too.

Brave copied the idea, with a twist #

On November 11, 2026, Brave Search announced its own encrypted result links, search.brave.com/go/v1#…, and blamed goto directly: Google’s move “did not so much abolish the scraping trade as relocate it” to Brave. Brave.

The twist is privacy. Brave’s design has the browser fetch a key with a blinded request and decrypt the link locally, so Brave says it sees the results page and time but not which result you clicked. It wasn’t live when I checked on November 12; the details are in Brave’s encrypted result links.

Which route should you pick? #

You need Google results in a product: a SERP API that documents goto handling. SerpApi, DataForSEO, Serper and Autom have all published fixes, and all but Autom have also published incidents or limits since late October, which I count as honesty, not weakness. Pick on depth billing and price, then spot-check the link field yourself.

You need 100 results per keyword cheaply: check depth billing first. apiserpent.com’s Quick mode is documented as one charge up to num=100; elsewhere, check whether the top 100 costs one call or ten. Ask apiserpent.com about goto in writing, since its docs are silent.

You track rankings for clients: add a sanity check. Compare sudden drops since September 13, 2026 with Search Console before reporting them, and ask your tracker how it detects poisoned pages.

You scrape Google yourself: stop for anything that matters. The policy names rank-check scraping, the request cost has at least doubled for result URLs, and throttling makes timing unpredictable.

You need search results without Google’s rules: use an independent index. The search API pillar compares them; SerpApi alternatives covers Google-results vendors if you’re switching.

FAQ

Why do my Google result links start with google.com/goto?

Since mid-2026 Google has been sending many result clicks through google.com/goto?url= followed by an opaque token, instead of linking straight to the site. In ScrapingBee's small test, Chrome and Edge got goto links, including manually operated Chrome and Playwright sessions, while Brave and LibreWolf got direct links. Google confirmed the rollout on August 26, 2026 as part of 'technical measures against evolving forms of abuse'.

Can you decode a goto CAES token?

Not as far as anyone has published. Nozzle's Derek Perkins told Search Engine Roundtable that 'the goto links can't be decoded', and ScrapingBee could parse the token's structure but not decrypt it. The documented way to get the destination is to request the goto URL and read the Location header.

Does goto hurt SEO or referral data for my site?

Not on your side, as far as any source shows. Real visitors still arrive at your page after the redirect. The visible effect for site owners is in third-party rank trackers, some of which report swapped results since September 2026, so check sharp drops against Search Console.

Did Google remove num=100?

Yes, in practice. The parameter that returned 100 results per request stopped working around September 11 to 12, 2025, and Search Engine Land reported on September 18, 2025 that Google confirmed it does not support the results-per-page parameter. Rank trackers now need ten requests for the top 100.

Are rank trackers showing fake results?

Nozzle reports that since September 13, 2026, 27.6% of the SERPs it collected had page 1 or 2 'poisoned', meaning most of the usual sites were missing, against 0.28% before (report updated November 3, 2026). AccuRanker measured far less after late September, and Semrush called the impact on its users 'limited'. Google has not commented.

Does my SERP API still return real destination URLs?

Check its public notes and spot-check the link field. SerpApi, Serper, DataForSEO and Autom have each published that they resolve goto links, but SerpApi and Serper both logged incidents from October 30, 2026, and DataForSEO says its fastest modes resolve only about half since November 2. apiserpent.com's docs don't mention goto as of November 12, 2026.

Sources

27 sources, accessed 12 Nov 2026.

Official pricing, docs, changelogs and status pages 16

1. Google: Why we're taking legal action against SerpApi (2025-12-19) blog.google · accessed 12 Nov 2026
2. Google Search Central spam policies developers.google.com · accessed 12 Nov 2026
3. Custom Search JSON API overview developers.google.com · accessed 12 Nov 2026
4. ScrapingBee: Google goto redirect URLs (2026-09-07) scrapingbee.com · accessed 12 Nov 2026
5. Autom: Google goto URL fix (2026-08-31) autom.dev · accessed 12 Nov 2026
6. SerpApi: goto resolution in progress (2026-08-30) serpapi.com · accessed 12 Nov 2026
7. SerpApi: we have resolved the goto rollout (2026-09-05, note added 2026-11-07) serpapi.com · accessed 12 Nov 2026
8. SerpApi status: /goto links in organic_results link (2026-11-03 to 11-08) status.serpapi.com · accessed 12 Nov 2026
9. SerpApi status: earlier goto incident (2026-10-30) status.serpapi.com · accessed 12 Nov 2026
10. Serper status: goto incident (2026-10-30 to 10-31) serper.betteruptime.com · accessed 12 Nov 2026
11. DataForSEO: we resolve 99.99% of URLs (2026-08-27) dataforseo.com · accessed 12 Nov 2026
12. DataForSEO: new goto URL limits (2026-11-02) dataforseo.com · accessed 12 Nov 2026
13. apiserpent.com API documentation apiserpent.com · accessed 12 Nov 2026
14. apiserpent.com blog: num=100 removed (2026-06-08) apiserpent.com · accessed 12 Nov 2026
15. apiserpent.com terms of service apiserpent.com · accessed 12 Nov 2026
16. Brave Search Team: How Google's anti-scraping move became our problem (2026-11-11) brave.com · accessed 12 Nov 2026

Independent benchmarks and published studies 1

1. Nozzle: Poisoned Google SERPs (published 2026-10-10, updated 2026-11-03) nozzle.io · accessed 12 Nov 2026

News and press 8

1. Search Engine Roundtable: Google statement on goto (2026-08-26) seroundtable.com · accessed 12 Nov 2026
2. Search Engine Roundtable: Google tests goto tracking URLs (2026-07-08) seroundtable.com · accessed 12 Nov 2026
3. TechCrunch: Google begins requiring JavaScript for Search (2025-01-17) techcrunch.com · accessed 12 Nov 2026
4. Search Engine Roundtable: num=100 stops working (2025-09-12) seroundtable.com · accessed 12 Nov 2026
5. Search Engine Land: Google confirms it does not support the results per page parameter (2025-09-18; headline and date only) searchengineland.com · accessed 12 Nov 2026
6. Search Engine Roundtable: September 2026 spam update done seroundtable.com · accessed 12 Nov 2026
7. PPC Land: Semrush and AccuRanker on swapped results (2026-10-19) ppc.land · accessed 12 Nov 2026
8. Search Engine Journal: Google appears to limit goto link speed (2026-11-05) searchenginejournal.com · accessed 12 Nov 2026

Other sources 2

1. Google v. SerpApi, ECF 62: order granting motion to dismiss with leave to amend (2026-11-09) storage.courtlistener.com · accessed 12 Nov 2026
2. Google v. SerpApi public RECAP docket feed courtlistener.com · accessed 12 Nov 2026