Brave Copies Google's /goto Link Cloaking; Our Pull Finds Google Now Hides All 164 Links

Ras Al Khaimah, United Arab Emirates, 13 November 2026.

Brave Search will stop putting destination addresses in its result links, the company said on 11 November 2026, and will route every click through an encrypted search.brave.com/go/ link instead. In a post by the Brave Search Team, Brave said the change is a response to scrapers that moved to its engine after Google began wrapping its own results in google.com/goto redirects, producing traffic spikes of several thousand requests per second. Brave said the switch would come within days but gave no fixed date.

Our own pull of Google results on 13 November (UTC) shows how far the measure that started this has spread. Across 20 US desktop searches, every one of the 164 page-one organic links came back as a /goto token rather than the address of the ranking page. When we ran a similar check on 31 October, the figure was 74.0%.

Key findings

• Brave's new links take the form search.brave.com/go/v1# followed by an encrypted destination. Each link has its own key, and the browser fetches the key for one link at a time.
• Brave says it can see that a link was opened from a given results page, and when, but not which result was clicked. Without JavaScript, it falls back to an ordinary server-side redirect that does reveal the destination.
• In our Google pull, 164 of 164 page-one organic results (100%) and all 6 text ads in the sample were returned as google.com/goto?url= links, against 148 of 200 page-one results (74.0%) in our 31 October pull.
• For 15 of the 164 results (9.1%), mostly YouTube, Reddit and forum listings, the breadcrumb Google shows under the title held a view or comment count rather than a hostname, so it cannot stand in for the URL.
• All 8 links we tested resolved with a single 302 redirect to the page named in the breadcrumb.

What Brave is changing

Brave says the scrapers that once pulled Google results moved to Brave Search, on top of its existing traffic. The company says the extra load strained its servers and team, and that the tighter bot defences it added in response slowed results and showed more CAPTCHAs to real users.

Its fix copies the shape of Google's change, with one stated difference: Brave says it does not want to learn where users go. Under the new scheme, the browser blinds its request with a random number, Brave applies a secret to it, and the browser removes the blinding to recover a key that decrypts one destination locally. The construction is a partially oblivious pseudorandom function, a primitive specified in RFC 9497. In Brave's words, "Each link has its own key, and only Brave holds those keys." Because each key opens only one link, a scraper that wants every destination on a page has to ask once per result, which Brave can count and block.

Brave lists the trade-offs itself. A copied result link is the redirect, not the page, and it can expire, so it should not be bookmarked. Because a /go/ link carries Brave's domain, it could be abused for phishing; Brave says it can invalidate redirects, gives them a limited lifetime and shows a warning page. Brave also points scrapers to its paid Search API, which it says returns the same results and is free for personal and hobby use, with commercial use paid beyond $10 a month in free credits.

Brave's post does not say what referrer a destination site will receive once the browser decrypts a link and navigates to it. That is the detail analytics teams should check after the rollout.

How Google's /goto got here

Google began testing /goto links in July. On 26 August a Google spokesperson confirmed the rollout to Search Engine Roundtable with a statement that began: "We have a long history of deploying technical measures against evolving forms of abuse." Google has not said which abuse it means, but its spam policies already list scraping results for rank-checking purposes without express permission as machine-generated traffic.

The side effects reached beyond scrapers. In September, Malwarebytes warned that hovering over a result no longer shows where it leads, which undercuts standard advice on spotting phishing links. For SEO teams, our 31 October analysis of Google's /goto links and rank tracking found that three in four organic URLs in a raw results feed were recorded under google.com, which breaks any report that groups rankings by domain or page.

Our check: no plain links left on page one

The 13 November pull covered informational, commercial, local, finance and travel searches. No group had a single plain organic link.

Query group	Queries	Page-one organic results	Returned as /goto	Share
Informational (for example "what is inflation")	6	44	44	100%
Commercial and software (for example "crm for small business")	7	59	59	100%
Finance and insurance (for example "mortgage rates")	4	33	33	100%
Local (for example "dentist chicago")	2	18	18	100%
Travel ("cheap flights to london")	1	10	10	100%
All	20	164	164	100%

Source: SaaS Link Building analysis of Google results pulled through a SERP API, US English, desktop, 13 November 2026 (UTC).

The coverage did not stop at page one. For "project management software" we also pulled page two, and all 10 of its organic results were /goto links as well. Every row, organic or paid, was recorded under the domain google.com.

The destinations are still recoverable. We requested 8 of the links, from Salesforce, the BBC, Wikipedia, Mailchimp, Progressive and three other sites, and each answered with one 302 redirect to the page the breadcrumb named. That costs one extra request per result, which is the burden the change places on anyone collecting results in bulk.

A second SERP feed, which resolves organic links itself, returned plain URLs for "crm for small business", but 3 of the 12 links cited in its AI Overview were still google.com/goto paths. Its organic list for the same query also dropped the word "crm": none of its 9 results were about CRM software, against 9 relevant results in the first feed. That is one query, so we treat it as an example rather than a rate, but it matches the pattern of Google ignoring query words for rank trackers that we reported in October.

What this means for SEO teams

• Audit your rank tracker's URL column now. If Google wraps every link, a tool that does not resolve redirects will show google.com for every position. Positions may still look right while landing page, cannibalisation and competitor domain reports are empty or wrong.
• Do not rely on breadcrumbs alone. In our sample, 9.1% of breadcrumbs had no hostname at all. Resolving the redirect is the only complete fix.
• Expect higher data costs. One request per result means a 100-result check needs about 100 extra requests. Ask vendors whether they resolve /goto links and how often.
• Watch Brave referrals after the rollout. Brave has not said what referrer its /go/ links pass. Compare Brave Search sessions in analytics for the week before and after the switch, and check whether any move to direct.
• Treat alternative engines as less scrape-friendly, too. If your own monitoring pulls Brave results, budget for its API rather than its result pages.

Brave's move also sits inside a wider fight over who may reuse search and publisher data, including a New York Times lawsuit against Brave over AI scraping that we covered earlier this month.

Methodology

On 13 November 2026, between about 21:00 and 21:25 UTC, we pulled Google results for 20 queries through a SERP API (US English, desktop, page one; two pages for one query, and a city-level US location for "plumber near me"). We counted organic results whose URL began with google.com/goto?url= and, separately, text ads. We classified breadcrumbs as hostnames or as other text. We resolved 8 links by requesting them on www.google.com and recording the status code and Location header. The second-feed check was one query through a different SERP API on the same evening. The 31 October comparison figure comes from our earlier pull of 20 queries, whose query list was not matched to this one, so the change should be read as a direction rather than a like-for-like rate. Google and Brave were not asked for comment for this report.

Conclusion

Google's anti-scraping links have gone from most results to, in our sample, all of them, and the pressure has now pushed a second engine to copy the idea with its own privacy twist. Brave has not given a date for its rollout, and its effect on referrer data is unknown.

For anyone who depends on third-party ranking data, the practical message is the same for both engines: the destination URL is no longer in the results page, and every tool now has to pay one request per link to get it back.

Questions and answers

What is Brave Search changing in its result links?

Brave said on 11 November 2026 that result links will switch to encrypted search.brave.com/go/v1# links in the coming days. The browser fetches a one-time key for the clicked link and decrypts the destination locally, so Brave says it can see that a link was opened from a results page but not which one.

Why is Brave doing this?

Brave says scrapers moved to Brave Search after Google began routing result clicks through google.com/goto redirects, causing traffic spikes of several thousand requests per second, slower results and more CAPTCHAs for real users.

How many Google results now use /goto links?

In our pull of 20 US desktop Google searches on 13 November 2026 (UTC), all 164 page-one organic results and all 6 text ads were returned as google.com/goto links. An earlier pull on 31 October found 74.0% of page-one organic results wrapped.

Can the real URL behind a Google /goto link still be found?

Yes. All 8 links we requested on www.google.com answered with a single 302 redirect to the page named in the result's breadcrumb. That means one extra request per result for any tool that wants the full URL.

Has Google explained the /goto change?

A Google spokesperson confirmed the rollout on 26 August 2026, citing technical measures against evolving forms of abuse, without naming the abuse. Google's spam policies list scraping results for rank-checking purposes without express permission as machine-generated traffic.

###