Google will impose penalties on websites that take control of your browser's back button.

      In summary: Google is categorizing “back button hijacking” as spam, targeting websites that misuse the browser History API to trap users who attempt to leave. Enforcement will start on June 15, 2026, with consequences including manual spam actions and algorithmic ranking penalties. Site owners are accountable even if the problematic code is provided by third-party ad networks or engagement scripts.

      Google is addressing one of the web's ongoing nuisances: websites that take control of the browser’s back button to prevent user navigation. A new spam policy announced on the Google Search Central blog will take effect on June 15, marking “back button hijacking” as a violation that may result in manual penalties or algorithmic ranking drops.

      This tactic exploits the browser's History API by injecting false entries into the user's browsing history via scripts using methods like history.pushState or history.replaceState. Consequently, when users attempt to go back, they are redirected to an interstitial, an ad, a recommendation feed, or the same page they wanted to leave. In certain situations, users might need to press back multiple times before they finally exit.

      Definition of a violation:

      Google's policy is extensive. Any method that adds or modifies “deceptive or manipulative pages” in a user’s browser history, hindering their ability to return to the previous page, is now categorized under the company’s malicious practices. This encompasses exit-intent overlays activated by back navigation, popunder ad scripts, and recommendation tools that intercept the popstate event to redirect users instead of allowing them to return.

      Importantly, site owners bear responsibility even when the problematic code comes from a third-party source. Google’s announcement warns that some instances of back button hijacking “may originate from the site’s included libraries or advertising platform” and advises webmasters to examine their entire technical setup, including ad networks, A/B testing tools, consent modules, and engagement widgets. If any script related to monetization alters browsing history, the responsibility falls on the site owner.

      A two-month grace period:

      Google is releasing this policy two months prior to its enforcement, allowing site owners until June 15 to identify and remove non-compliant code. After this date, pages engaged in back button hijacking may face manual actions from Google's webspam team or algorithmic demotions that could severely impact a site's visibility in search results, presenting significant risks for publishers relying on organic traffic.

      This announcement aligns with Google's trend of gradually expanding its spam management strategies. In March 2024, new policies against site reputation abuse, content scaling abuse, and expired domain abuse were introduced, while an August 2025 spam update further improved detection mechanisms. Back button hijacking is the latest focus, targeting behaviors that clearly represent deceptive practices and poor user experience.

      The rationale for the timing:

      The increase in back button hijacking is not coincidental; it has become more common as publishers seek engagement metrics and ad revenue amidst a landscape altered by AI overviews, zero-click searches, and dwindling referral traffic. A growing industry offers monetization scripts that blend history manipulation with seemingly legitimate features like “scroll-depth analytics” and “exit-intent recovery.” A recent cybersecurity report highlighted a malvertising actor named “D-Shortiez” that exploited a WebKit vulnerability for large-scale browser redirects, indicating that this practice has evolved from low-level affiliate sites to organized ad fraud.

      For users, this change is highly anticipated. Back button hijacking undermines the basic expectation of browser functionality. Clicking back should be a means to exit, and when this action is manipulated, it diminishes trust not just in the offending site but across the wider web. Google acknowledges this in its blog post: users who experience hijacking often feel “manipulated” and are less inclined to visit unfamiliar websites.

      What actions site owners should take:

      Google's instructions are clear. Eliminate any code that modifies history states upon page load solely to interrupt back navigation. Remove any code that redirects users when the back button is pressed. Delete any overlays that appear specifically because the user attempted to navigate away. Additionally, audit all third-party scripts on the site, as ignorance will not be accepted as an excuse.

      The policy applies globally to all pages indexed by Google Search. Sites that have previously encountered a manual action can seek a review through Google Search Console once they have addressed the issue.

      For the broader ecosystem, this action raises ongoing questions about web governance: who is accountable when the open web's rules are primarily enforced by one company's search engine? Google’s spam policies effectively act as regulation for many sites relying on organic traffic, meaning most of the web. When Google deems a practice unacceptable, the incentive to comply is immediate, potentially stronger than any legislative measure. The EU’s Digital Services Act requires platforms to address deceptive design patterns, but the enforcement process can take years, while Google’s deadline is set for eight weeks away.

      The concentration of power presents varied implications depending on one’s perspective.