Google Is Coming for Back Button Hijackers — But Who Made Google the Sheriff?

You click a search result. You want to go back. You can’t. The back button does nothing, or worse, dumps you on some ad-riddled page you never asked for. In 2026, Google has finally named this trick for what it is: spam. The company’s updated search spam policy now explicitly targets back button hijacking, threatening offenders with removal from search results entirely. Good news for anyone who uses the internet. But the implications run deeper than a UX fix.

What Back Button Hijacking Actually Does

Back button hijacking is exactly what it sounds like. A site manipulates your browser’s navigation so that hitting “back” doesn’t take you where you expect. The usual methods involve abusing JavaScript’s history.pushState() API or injecting redirect chains that stuff fake entries into your browsing history. When you tap back, you either stay on the same page or land on an unrelated ad.

The technique has been a staple of low-quality affiliate landing pages, fake download sites, and ad farms for years. The goal is simple: trap users and maximize ad impressions. For the average person, it just feels like the browser is broken.

What Changed in Google’s Policy

Google’s spam policies have long prohibited “sneaky redirects.” But this update is the first time the company has singled out back button manipulation by name, classifying it as an explicit category of search spam.

The consequences are severe. Flagged pages — or entire domains — can be demoted or completely removed from Google Search results. Site owners hit with a Manual Action get notified through Search Console and must fix the violation before requesting a review. In practice, getting caught means your search traffic evaporates overnight.

When Google mediates over 90% of global web search traffic, delisting isn’t a slap on the wrist. It’s an existential threat.

The Easy Part: This Is Obviously Good for Users

Let’s state the obvious. A broken back button is one of the most universally hated experiences on the web. Chrome has already shipped some client-side protections against history manipulation, but extending enforcement to search rankings is a much bigger stick. Sites that pull this trick deserve what’s coming.

No argument there. But zoom out from the user experience for a moment and look at the power dynamics.

The Harder Question: Judge, Jury, and Landlord

Google is simultaneously the dominant search engine, the maker of the world’s most popular browser, and the largest digital advertising platform on Earth. It now decides what counts as a bad user experience, and it enforces that decision by controlling who gets traffic.

Here’s a detail worth chewing on: most sites that engage in back button hijacking run third-party ad networks, not Google AdSense. This policy effectively cleans out the bottom tier of Google’s advertising competitors. That may not be the intent — but it is the outcome.

The EU’s Digital Markets Act already requires Google to demonstrate fairness in how it ranks search results, precisely because of this structural conflict. When the entity writing the rules also owns the platform, the referees, and the stadium, questions about transparency and due process aren’t paranoia. They’re basic governance.

Google’s appeals process for Manual Actions exists, but it’s opaque, slow, and entirely on Google’s terms. There’s no independent arbiter. For small site operators, fighting a wrong call is a Kafka-esque ordeal with real financial stakes.

What Site Owners Should Check Right Now

The policy targets intentional abuse, but collateral damage is possible. Single Page Applications with sloppy routing logic can accidentally mess with browser history. Third-party ad scripts — the ones you embedded and forgot about — might be injecting history entries without your knowledge.

If you run a website, test it yourself: search for your site on Google, click through, and hit back. Does it work? Check your Google Search Console for Manual Actions while you’re at it. Better to find out from your own testing than from a traffic cliff.

A working back button should be a given, not a privilege. It’s hard to fault Google for enforcing something so basic. But every time Google expands its definition of what the web should be — and backs it with the power to make sites disappear — the open web gets a little less open. The real question isn’t whether back button hijacking is bad. It’s whether one company should be the sole authority deciding what “bad” means for the entire internet.