Is There a Google Sandbox? A Leaked hostAge Field and 38 SERPs Point to a Narrow Yes

Ras Al Khaimah, United Arab Emirates, 27 October 2026.

Few SEO arguments have lasted as long as the "Google sandbox": the belief that Google holds new websites back for months, whatever their quality, before letting them rank. Google representatives have denied it on the record for years. Yet a field in Google's own leaked Content Warehouse documentation describes data "used in twiddler to sandbox fresh spam in serving time". To test the claim, we pulled 2,590 module pages of the leaked documentation, and checked the registration date of the domains ranking in the top 10 for 38 usable Google searches run in the US on 27 October 2026.

Our short answer: Google does appear to hold an age-based mechanism aimed at new spam, and its own patents describe using document and domain age in scoring. But the blanket version of the theory, a waiting period that every new site must serve, does not fit what we found. Domains registered less than two years ago held 11 of the 83 dated top-10 positions for brand-new AI topics, including two first places, and none of the 212 dated positions for established topics.

Key findings

• Of 13,976 attributes we parsed from the leaked documentation, only two descriptions use the word "sandbox". One is a page-rendering timer. The other is hostAge in the PerDocData record, defined as the earliest date Google first saw any page on the host or domain.
• The documentation also stores a RegistrationInfo record with the date a domain was last created and last expired, attached to each document through the CompositeDoc.
• Google's US patent 7,346,839, filed on 31 December 2003 with Matt Cutts and Jeffrey Dean among the inventors, describes scoring documents on their inception dates and judging whether a domain is legitimate partly from how far ahead it has been renewed.
• Across our 38 usable searches, 295 top-10 organic results had a registration date we could verify. Only 11 (3.7%) came from domains registered less than two years ago, and all 11 were in searches about brand-new AI products and protocols.
• In evergreen how-to searches, "best" product searches and long-tail problem searches, the median ranking domain was more than 21 years old, and not one result came from a domain under two years old.

The theory: new sites wait in a holding pen

The sandbox theory took hold in SEO forums in the mid-2000s. Site owners saw new domains indexed quickly yet failing to rank for competitive terms for months, then rising sharply. The explanation that stuck was a deliberate filter that distrusts new domains until they serve a probation period.

The theory is still repeated today, usually in two forms. The strong form says every new site is held back for a fixed period, often put at three to nine months. The weak form says new sites lack the history, links and engagement data that Google relies on, so they rank poorly until they earn it, which looks like a sandbox from the outside. A related belief, that older domains rank better, feeds a market in aged domains.

Google has rejected the strong form for at least a decade. Google's Gary Illyes wrote in December 2016 that "we don't have a Google sandbox". In August 2019, John Mueller posted that there is no sandbox, as Search Engine Roundtable reported at the time. On domain age, Mueller wrote in a July 2019 post that "domain age helps nothing", and in December 2023 he said the claim comes mainly from people who want to sell aged domains, according to Search Engine Journal's report of that exchange.

This is the fourth claim we have tested this way, after whether Google uses clicks to rank pages, whether it favours big brands and whether it rewards fresh dates.

Evidence for: what Google's own documents describe

The hostAge field

The strongest single piece of evidence sits in the Content Warehouse API documentation that surfaced in 2024, which Google confirmed was genuine to The Verge while warning against reading it out of context. The PerDocData record, which holds per-document signals, includes a field called hostAge. Its description says it holds the earliest first-seen date of all pages in the host or domain, stored as a day count after 31 December 2005, and that the data is used in a twiddler to sandbox fresh spam at serving time.

Three details in that description matter. First, the reference to serving time points to an adjustment made when results are shown, rather than a block on crawling or indexing. Second, the age is measured from when Google first saw pages on the host, not from domain registration. Third, the stated target is fresh spam, not new sites in general. The same record carries a separate domainAge field, described only as 16-bit, and the hostAge note says the domain age is omitted when it equals the host age.

The documentation also refers to a helper file under a spam directory for converting the site age value, and a separate data-version record includes an entry named spamContentSiteAgeStats. Both point to site age being handled by Google's spam systems. Neither comes with a description of how it is used.

Registration and first-seen dates

Google also keeps registration data. The RegistrationInfo record stores the date a domain was last created and the date it last expired, both counted in days since 1 January 1995, which the documentation says was chosen as a special epoch by Google's "history project". The CompositeDoc record, the master container for a document, includes this registration information and says it is extracted from a signal called domainedge.

First-seen dates appear throughout the documentation. Links carry a firstseenDate showing when Google first saw them, with a flag for whether that date is likely close to when the link was actually added. A site-level record called QualityCopiaFireflySiteSignal stores the most recent first-seen time, a first boosted time, impressions during a boosted period and counts of URLs and articles sliced into 30-day periods. The boost-related fields and the first-seen field have no description, so what is being boosted, and why, is not stated.

The 2003 patent

Google's Information retrieval based on historical data patent was filed on 31 December 2003 and granted on 18 March 2008, and Google Patents now lists it as expired. Its inventors include Matt Cutts and Jeffrey Dean. The patent describes generating or altering a document's score from its inception date, defined as when the search engine first learns of or indexes it. It also describes judging the legitimacy of a domain from its registration data, noting that spammers often use throwaway "doorway" domains. One example it gives: legitimate domains are often paid for several years in advance, while doorway domains are rarely used for more than a year, so a domain's future expiry date could help predict whether it is legitimate.

It was filed in the same period that site owners started describing a sandbox. A patent shows what Google's engineers designed, not what Google runs today.

Google's own timelines

Google does not promise new sites fast results. Its SEO Starter Guide says some changes take effect within hours while others can take several months, and suggests waiting a few weeks before judging whether work has helped. In 2005, Search Engine Roundtable reported Cutts saying there was no sandbox as such, but that the algorithm might affect some sites in some circumstances. Our own record of the crawling, indexing and re-ranking timelines Gary Illyes shared also shows how slowly some signals move.

Timeline: Google statements against Google documents

Date	Source	What it says
31 December 2003	US patent 7,346,839 filed	Document inception dates and domain registration data can feed scoring
2005	Matt Cutts, as reported by Search Engine Roundtable	No sandbox, but the algorithm may affect some sites in some circumstances
18 March 2008	US patent 7,346,839 granted	Patent granted, with Cutts and Dean among the inventors
12 December 2016	Gary Illyes on X	Google does not have a sandbox
12 April 2017	John Mueller, as reported by Search Engine Roundtable	Answers "no" when asked if domain age affects rankings
5 July 2019	John Mueller, as reported by Search Engine Journal	Domain age helps nothing
19 August 2019	John Mueller, as reported by Search Engine Roundtable	States there is no sandbox
10 December 2023	John Mueller, as reported by Search Engine Journal	Aged-domain claims come mainly from people selling aged domains
28 March 2024	Version 0.4.0 of the client library carrying the documentation published	hostAge described as used to sandbox fresh spam at serving time
29 May 2024	Google statement to The Verge	Documents confirmed as genuine, with a warning about missing context

Evidence for: what 38 live SERPs show

Documents can only show what Google built. To see what Google actually ranks, we looked up the registration date of every domain in the top 10 organic results for 40 US English searches, split into four groups of 10: brand-new AI topics (such as "gemini 4 review" and "mcp server list"), evergreen how-to and definition searches, "best" product searches, and long-tail problem searches. Two searches returned unresolvable redirect links, leaving 38 searches and 295 results with a verified registration date.

The pattern is stark. In established topics, Google's top 10 is dominated by old domains: the median ranking domain was 22.6 years old for "best" product searches and 21.7 years for evergreen and long-tail searches, and 85% of evergreen results came from domains registered more than 20 years ago. For new AI topics, the median fell to 15.0 years and 13% of results came from domains under two years old.

Query group	Dated results	Median domain age	Results from domains under 2 years old	Searches with at least one
New AI topics	83	15.0 years	11 (13.3%)	4 of 10
"Best" product terms	84	22.6 years	0	0 of 10
Evergreen how-to and definitions	62	21.7 years	0	0 of 9
Long-tail problems	66	21.7 years	0	0 of 9
All	295	21.7 years	11 (3.7%)	4 of 38

Read on its own, this looks like support for a sandbox: in 212 dated results for established topics, Google ranked no domain younger than two years. But there is an obvious alternative explanation.

Evidence against: young domains can rank

New domains reached the top. For "gemini 4 review", the first organic result was on a domain whose registry record shows it was registered on 27 February 2026, eight months before our check. For "mcp server list", the first result was on a domain registered in December 2024. In all, four of the 11 results from domains under two years old ranked in positions 1 to 3. Every one of those domains was at least eight months old, so this rules out a long hold on all new domains, not necessarily a shorter one.

The old-domain pattern has a simpler cause. Evergreen and product topics have been contested for decades. The sites that rank for them have had years to build links, content and the click history that, as our investigation into Navboost found, Google pools over 13 months. A new site entering "best vpn" competes with that accumulated history; a new site writing about a protocol launched last year does not. Our data cannot separate a deliberate age filter from this competitive effect, and the fact that young domains rank only where incumbents have little history fits the competitive explanation at least as well.

The leaked field is narrow. The hostAge description says the data is used to sandbox fresh spam, not fresh sites. If the description is accurate and current, the mechanism is a spam control applied to new hosts that other systems have already flagged, or that look like known spam patterns. That is consistent with Illyes and Mueller denying a general sandbox while Google still treats new hosts with caution. This is our reading; Google has not explained how the twiddler works.

hostAge is measured by first sight. hostAge is based on when Google first saw pages on the host, not on registration. The patent defines inception mainly as when the search engine first learns of a document, though it lists domain registration date as one possible proxy. That is one reason buying an old but unused domain is unlikely to work as a shortcut, and why Google's spam policies separately list expired domain abuse: buying an expired domain and repurposing it to manipulate rankings with low-value content.

Documentation is not usage. The leaked files list fields without weights, some are marked as deprecated, and the patent has expired.

The denials are carefully worded. Neither Illyes nor Mueller, in the posts reported, claimed that Google ignores a site's history. They denied a named sandbox and denied that domain age itself helps. Both statements can be true at the same time as a spam twiddler that uses host age.

Verdict: likely, in a narrow form

Likely: Google holds age data on hosts, domains, documents and links, and its own documentation describes using host age to hold back fresh spam at serving time. Statements that there is no sandbox are accurate only if "sandbox" means a waiting period for every new site.

Not supported: the strong form of the theory. A domain registered eight months earlier held a first place during our check, and domains under two years old ranked in four of the 10 new-topic searches. We found no evidence of a fixed probation period that every new site must serve, although our data cannot rule out a hold shorter than eight months.

Unproven: that domain age itself is a positive ranking factor. Old domains dominate established topics in our data, but the competitive explanation fits the data as well, and Google's John Mueller has said that domain age helps nothing.

What this means for SEO teams

• Launch where incumbents are thin. In our data, young domains ranked only where the topic itself was new. A new site's first content plan should target emerging subjects, new product categories and questions that established sites have not yet covered, then expand into contested terms.
• Avoid patterns that look like fresh spam. If the hostAge twiddler targets new hosts that look spammy, the riskiest launch is the one that publishes hundreds of thin, templated or AI-generated pages in its first weeks and acquires links in a sudden spike. The 2003 patent describes a sudden spike in links as a possible spam signal.
• Do not buy aged domains for their age. The leaked hostAge field is based on first sight, the registration record resets the creation date when a domain lapses and is registered again, and repurposing an expired domain to manipulate rankings breaks Google's spam policies.
• Measure from first indexing, not from launch. Use URL Inspection and the Pages report in Search Console to record when pages become indexed, checking from launch, and judge progress over months, in line with Google's guidance that some changes take several months to show. Check our 2026 update calendar before blaming a slow start on age.

Methodology

Leaked documentation. On 27 October 2026 we downloaded the API reference for version 0.4.0 of the google_api_content_warehouse package on HexDocs, extracted the 2,590 model module pages it lists and downloaded each one. Parsing each page's attribute list gave 13,976 attributes across 2,485 modules. We searched attribute names and descriptions for sandbox, age, first-seen, registration, creation and expiry terms and read every match.

SERP data. On 27 October 2026, at about 09:19 UTC, we collected Google desktop organic results (US, English, top 10) for 40 searches through a commercial SERP data API, 10 in each of four groups chosen before collection: new AI topics, evergreen how-to and definition searches, "best" product searches and long-tail problem searches. Ads and other features were excluded. Two searches ("what is a roth ira" and "sourdough starter not rising") returned Google redirect links that could not be resolved to the destination site, so we excluded them, leaving 38 searches and 302 organic results on 200 registrable domains.

Domain age. We reduced each result to its registrable domain using the public suffix list and queried each registry's RDAP service, found through IANA's RDAP bootstrap file, for the registration event. We found dates for 193 domains covering 295 results. Seven domains (five .edu, one .net.au and nhs.uk) had no RDAP registration date and were excluded from the age figures. Age was calculated in years to 27 October 2026. A registration date is not the same as Google's first-seen date: a domain that lapsed and was registered again shows its latest registration, and a domain can be registered years before it hosts content. Thirty-eight usable searches from one location is a small sample, not the whole index.

Conclusion

The public denials and the documents are less contradictory than they look. We found no sign that every new site waits in a holding pen: an eight-month-old domain held a first place, and young domains ranked across four new-topic searches. But Google does keep detailed age data on hosts, domains and links, and its own documentation describes using host age to hold back fresh spam at the point results are served.

For anyone launching a site, the practical lesson is that age is not something to buy or wait out. In established topics, new domains face years of accumulated competition; in new topics, they can rank within months. The sites most at risk from the narrow sandbox that the documents describe are the ones that launch looking like spam.

What do you think?

If you have launched a new domain in the last two years, how many weeks passed between its first indexed page and its first page-one ranking, and was that ranking for a new or an established topic? Share your dates with us; we would like to compare them with our data.

Questions and answers

Is there a Google sandbox for new websites?

Not in the blanket sense. Google's Gary Illyes and John Mueller have both said Google has no sandbox, and in our check of 38 US searches a domain registered eight months earlier held a first place. But Google's leaked Content Warehouse documentation describes a hostAge field used to sandbox fresh spam at serving time.

What is the hostAge attribute in the Google leak?

hostAge is a field in the PerDocData record of Google's leaked Content Warehouse API documentation. It holds the earliest date Google first saw any page on a host or domain, counted in days after 31 December 2005, and its description says the data is used in a twiddler to sandbox fresh spam at serving time.

Does domain age help Google rankings?

There is no evidence that it does by itself. John Mueller has said domain age helps nothing. In our data old domains dominated established topics, but that fits the years of links and history those sites have built, and domains under two years old still ranked for new topics.

Does Google store domain registration dates?

Yes, according to the leaked documentation. A RegistrationInfo record stores the date a domain was last created and last expired, counted in days since 1 January 1995, and the CompositeDoc record for each document includes it.

Should I buy an aged or expired domain to rank faster?

No. The leaked hostAge field is based on when Google first saw pages on a host, not on registration, and Google's spam policies list expired domain abuse, which is buying an expired domain and repurposing it to manipulate rankings with low-value content.

###