Sounds like point 2 was a negative seo attack. It could be that your /?s page is being cached and getting picked up via crawlers.

You can avaoid this by no caching search pages and applying noindex via X-robots tag https://developers.google.com/search/docs/crawling-indexing/...

Cache has nothing to do with this

But yes just noindex search pages like they already said they did

I think the question is “how are the behavior of random spammers on your search page getting picked up by the crawler”? The assumption with cache is that searches of one user were being cached so that the crawler saw them. Other alternatives I can imagine are that your search page is powered by google, so it gets the search terms and indexes the results, or that you show popular queries somewhere. But you have to admit that the crawler seeing user generated search terms points to some deeper issue.

You just link to that page from a page that Google crawls. Cache isn't involved unless you call links caching

Ah that makes sense, thanks for clarifying.

Not sure how search result pages can be crawled unless they are cached somewhere?

If I'm reading correctly, it's not that your search results would be crawled, it's that if you created a link to www.theirwebsite.com/search/?q=yourspamlinkhere.com or otherwise submitted that link to google for crawling, then the google crawler makes the same search and sees the spam link prominently displayed.

Yikes.

What could Google do to mitigate?

You noindex search pages or anything user generated, it's really that simple

Not enough. According to this article (https://www.dr.dk/nyheder/penge/pludselig-dukkede-nyhed-op-d... you probably need to translate) its enough to link to an authorative site that accepts a query parameter. Googles AI picks up the query parameter as a fact. The artile is about a danish compay probably circumventing sanctions and how russian actors manipulate that fact and turn it around via Google AI

Yeah all pages should have a proper canonical which would solve this too

In this case, all i had to do was let the crawler know not to index the search page. I used the robots noindex meta tag on the search page.

I don't know what you mean by cache but you aren't using it correctly...

I posted some details in the main thread but I think you might need to check the change in methodology of counting impressions and clicks Google did around September this year.

They say the data before and after is not comparable anymore as they are not counting certain events below a threshold anymore. You might need to have your own analytics to understand your traffic from now own.

This affected only reporting of placement and impressions; basically you don’t get counts for placements below the first 10 or 20 results (can’t remember which). It did not affect clicks which are measured directly regardless of how deep in the SERP they happen.

WRT AI overviews/summaries, was Google smart enough to set up for this long ago?

1) encourage SEO sites to proliferate and dominate search results, pushing useful content down on the page.

2) sell ad placement directly on the search results page, further pushing useful content down on the page

3) introduce AI summaries, making it unnecessary to even look for the useful content pushed down on the page.

Now, people only see the summaries and the paid-for ad placements. No need to ever leave the search page.

> my page impressions were high, my ranking was high, but click through took a dive. People read the generated text and move along without ever clicking.

This been our experience with out content-driven marketing pages in 2025. SERP results constant, but clicks down 90%.

This not good for our marketing efforts, and terrible for ad-supported public websites, but I also don't understand how Google is not terribly impacted by the zero-click Internet. If content clicks are down 90%, aren't ad clicks down by a similar number?

They moved from clicks to pageviews which gives them cover until AI ads make up the difference.

Yes, to me it looks like they are now primarily selling placement in search results (or just space on their various properties). I never really understood the rationale behind click-based prices; someone following a link doesn't necessarily make them buy, and the ad got displayed regardless. But it's probably because Google was a bit coy about ads in the start to protect its reputation, so they didn't look too much like ads. Now they have so much traffic on relevant terms that they can sell the top spots at an expensive price.

Question: If I do a search for say crypto on your blog, how does Google gets to index the resulting page?

I’m imagining something like “blog.example/?s=crypto” which only I should see, not Google.

Edit: Where they linking to your website from their own? (In that case the link with the bad search keywords can be crawled)

They are spamming other websites with links to my website like in your example. Google crawl those other websites, follow the spammy link to mine, and I get penalized for having a page with spam content.

The solution is to tell the crawler that my search page shouldn't be indexed. This can be done with the robots meta tags.

I see, thanks for helping me understand the issue (and also the solution)

Link.com?search=spam from external page

AI overviews likely aren't going anywhere. Techies complain about it, but from seeing average people use google - everyone just reads the overview. Hell I even saw a screenshot of an AI overview in a powerpoint this week...

Anyway, I'd really like to at least see google make the overview text itself clickable, and link to the source of the given sentence or paragraph. I think that a lot of people would instinctively click-through just to quickly spot check if it was made as easy as possible.

That is how duckduckgo has implemented it, I also find it to be a nicer middle ground.

Kagi too (and before DDG).

Citations got worse with AI overviews or AI mode, right, over the past couple months?

IIRC-

Used to take you to cited links, now launches a sidebar of supposed sources but which are un-numbered / disconnected from any specific claims from the bot.

Sorry but how did 2 work before you fixed it? You saved the queries people did and displayed them?

So the spammer would link to my search page with their query param:

    example.com/search?q=text+scam.com+text

On my website, I'll display "text scam.com text - search result" now google will see that link in my h1 tag and page title and say i am probably promoting scams.

Also, the reason this appeared suddenly is because I added support for unicode in search. Before that, the page would fail if you added unicode. So the moment i fixed it, I allowed spammers to have their links displayed on my page.

Reminds me of a recent story on scammers using search queries to inject their scam phone numbers into the h1 header on legitimate sites [1]

[1] https://cyberinsider.com/threat-actors-inject-fake-support-n...

Interesting - surely you'd have to trick Google into visiting the /search? url in order to get it indexed? I wonder if them listing all these URLs somewhere are requesting that page be crawled is enough.

Since these are very low quality results surely one of Google's 10000 engineers can tweak this away.

> surely you'd have to trick Google into visiting the /search? url in order to get it indexed

That's trivially easy. Imagine a spammer creating some random page which links to your website with that made up query parameter. Once Google indexes their page and sees the link to your page, Google's search console complains to you as the victim that this page doesn't exist. You as in the victim have no insight into where Google even found that non-existent path.

> Since these are very low quality results surely one of Google's 10000 engineers can tweak this away.

You're assuming there's still people at Google who are tasked with improving actual search results and not just the AI overview at the top. I have my doubts Google still has such people.

I messed around with our website trying url encoded hyperlinks etc but it was all escaped pretty well. I bet there's a lot of tricks out there for those with time on their hands. Why anyone would bother creating content when Google AI summary is effectively going to steal it to intercept your click is beyond me. So the whole issue will solve it's self when google has nothing to index except endless regurgitated slop and everyone finally logs off and goes outside.

Great blog post. You typically think of people linking to your website as a good thing. This is a good counterexample.

What does Unicode have to do with links?

Lot of spam uses unicode, either for non-English languages or just to swap in lookalike characters to try and dodge keyword filters.

This has been a trick used by "reputation management" people for years.

i imagine the search page echoed the search query. Then, a SEO bot automated search(s) on the site with crypto and spam keywords, which is echo'ed in the search results - said bot may have a site/page full of links to these search results to create fake pages for those keywords for SEO purposes (essentially, an exploit).

Google got smart and found out such exploits, and penalized sites that do this.