You’ve been there. You click a result from Google, the page isn’t what you wanted, and you hit back. Nothing. Or you end up somewhere you never intended. That experience has a name now, and Google has officially run out of patience with it.
On April 13, 2026, Google’s Search Quality team added back-button hijacking to its spam policies as an explicit violation under the malicious practices category. Enforcement starts June 15. You have two months.
What back-button hijacking actually is
When someone clicks the back button in their browser, the expectation is clear: go back to where they came from. Back-button hijacking breaks that. Google defines it as any site interference with browser navigation that prevents users from returning to the previous page.
In practice, this shows up a few ways:
- The back button sends users to pages they never actually visited
- Clicking back triggers an unsolicited ad, pop-up, or content recommendation
- Users get stuck in a loop where the page reloads instead of navigating away
The technical mechanism is usually the browser’s History API. A page loads and quietly inserts extra entries into the browser history using history.pushState or history.replaceState, then intercepts back-button clicks to redirect or trap users. The goal is almost always to inflate session duration metrics or squeeze one more ad impression out of someone who’s already trying to leave. It works. Users also notice, and they don’t forget. Google’s announcement cited research showing people “report feeling manipulated and eventually less willing to visit unfamiliar sites.” That’s not just a UX problem. It’s a trust problem, and trust is hard to get back.
The enforcement is new. The rule isn’t.
This behavior has been against Google’s guidelines since at least 2013. Google’s blog post references a post from that year specifically warning against inserting deceptive pages into browser history.
So why act now? Google says it has seen a rise in the behavior. My read: ad tech got more aggressive, content recommendation widgets proliferated, and the behavior became widespread enough that case-by-case enforcement wasn’t cutting it. By naming it explicitly and adding it to the malicious practices category (alongside malware and unwanted software installation), Google can now enforce it consistently through SpamBrain, their AI-based spam detection system.
The two-month window before June 15 likely reflects two things. Time for site owners to fix their implementations. And time for Google to tune its detection models. Single-page applications have legitimate reasons to manage browser history state. Distinguishing that from deceptive manipulation isn’t trivial to automate.
The part that should worry most site owners
The most dangerous aspect of this policy isn’t the obviously bad actors. It’s the site owners who have no idea anything on their pages is doing this.
Google was explicit in its announcement: “Some instances of back button hijacking may originate from the site’s included libraries or advertising platform.”
That sentence puts responsibility on you regardless of where the code came from. If a third-party ad network, content recommendation widget, or engagement tool running on your site is manipulating browser history, you’re on the hook. Not the vendor.
A lot of these scripts are installed and forgotten. A widget that was clean when you set it up two years ago may have added navigation manipulation in a subsequent update. It happens quietly, in the background, and you won’t know until you go looking.
How to audit before the deadline
Start with the simplest test: visit your site by clicking a result in Google Search, then hit back. You should land immediately on the results page. If you don’t, something is interfering and you need to find it.
These are the technical patterns most likely to be the cause:
- history.pushState or history.replaceState used on page load without a clear UX reason
- Exit-intent overlays that intercept popstate events to show pop-ups before a user can leave
- Programmatic ad scripts that insert interstitial pages or redirect chains
- Affiliate landing pages or content recommendation widgets that modify history state
Once you find the source, remove or reconfigure it. If it’s coming from a third-party vendor, ask them directly whether their implementation touches browser history. Some will have a configuration option to disable it. Others won’t, and you’ll need to decide whether the tool is worth the risk.
What happens if you don’t fix it
Sites that miss the June 15 deadline face two types of enforcement from Google.
Manual spam actions show up in Search Console and require a reconsideration request after you’ve resolved the issue. Recovery takes time and proof. Automated demotions happen algorithmically, without notification, which makes them harder to diagnose. Your rankings just drop and you’re left trying to work out why.
One more thing worth knowing: in December 2024, Google began linking manual search penalties to advertising eligibility. A manual spam action for back-button hijacking could affect your ability to run Google Ads under that same policy. If paid search generates any part of your revenue, that’s a real compounding problem, not a theoretical one.
What this actually tells us
I keep coming back to the pattern here. Over the past two years, Google has added site reputation abuse, scaled content abuse, and now back-button hijacking as named spam violations. All three target the post-click experience. All three affect behavior that site owners often outsource to third parties and stop thinking about.
That’s the thread. Google is making it clear that you’re responsible for what happens on your site after someone clicks through from Search. Not your ad platform. Not your widget vendor. You.
The audit list keeps getting longer. If you haven’t reviewed your third-party scripts from an SEO compliance angle in the last twelve months, now is a good time to start. Back-button hijacking is on the list today, but it won’t be the last one.
Run the audit. Check your ad tech. Remove anything that traps users. June 15 is the deadline, but the habit of reviewing what’s running on your pages is worth keeping after that date too.