Google wants platforms to decide what belongs in search

What happened

On 26 October 2026, Google updated its Search Central guidance on preventing user-generated spam. The change log describes it as an update to the guide "with guidance on blocking indexing of link-shared content and monitoring abuse in Search Console", intended to help platforms keep user-created pages that are not meant for Search out of the index and detect spam earlier.

The guide itself now covers services that let users create shareable pages, generated outputs or interactive tools. Its new section, "Only index content meant for Search", asks platforms to decide whether user-created content is meant to be found through search engines or only opened by people who have the link. Pages built for direct sharing, collaboration or utility should be excluded from search by default. Google names the methods: a noindex rule in a robots meta tag or an X-Robots-Tag HTTP header, or blocking crawling in robots.txt.

The monitoring advice is concrete. Google says to verify the site or subdomain in Search Console to receive alerts about manual actions and security issues, and to check the Page Indexing and Search performance reports for unexpected spikes in indexed pages, impressions or queries that do not fit the platform's purpose. It also suggests tracking page creation and indexing numbers with alerts for anomalies, watching for redirects, many ad sections, spammy keywords and large blocks of encoded JavaScript, reviewing server logs for sudden traffic spikes, and testing URLs with the Safe Browsing API. The guide names manual actions and security issues as the outcomes of spam on a site.

The documentation does not describe the specific penalties of a manual action in this section, and the change log does not say whether Google is planning new enforcement. Industry commentary has speculated about that. We have no evidence either way, so we do not take a view.

Why it matters

More B2B sites are platforms than they realise. A customer portal, a community, a partner directory, a tool that generates shareable reports or a microsite built with an AI app builder all create pages that a customer, not your marketing team, produced. If those pages are indexable by default, they become part of how Google sees your domain.

Indexing is a brand decision. Pages meant to be shared with a colleague by link, such as a draft proposal, a generated report or a collaborative workspace, were not meant to appear in search. Anything that is findable can be quoted, summarised and surfaced by search and AI answer systems. Teams should decide deliberately what belongs there.

Abuse on your domain is your problem. The guidance is written for platforms, but a spam surge on a subdomain can reach the whole domain's standing. Google lists a manual action and security issues as the consequence of spam, so a lapse in monitoring is a search visibility risk and a security one.

The fix is cheap and the cost of missing it is not. Setting noindex as the default for shared pages is a small piece of engineering. Discovering months later that thousands of low-value generated pages dilute your domain's search presence is a far larger one.

What we would do

1. List every place users can create public pages. Include portals, forums, shared documents, generated outputs, interactive tools and any microsites built outside the main site. Record who owns each and how pages are created.
2. Choose an indexing policy for each. For every type of user-created page, decide whether it is meant for search. Where it is for sharing, collaboration or utility, set noindex by default, using a meta tag or X-Robots-Tag header, and allow indexing only by deliberate opt-in.
3. Verify every subdomain in Search Console. Make sure the right people receive manual action and security alerts, and that those alerts reach a monitored mailbox and not one person's inbox.
4. Alert on anomalies. Track new public pages, indexed pages, impressions and queries by week, and flag spikes. Set a threshold with an owner, and review a handful of outliers each month.
5. Review what is already indexed. Search your domain for user-generated content that should not be there, and remove or noindex it. Check results before and after the change so you know what moved.
6. Add abuse checks to the build. Where users publish content, screen for the patterns Google lists, and rate-limit creation so a handful of accounts cannot generate thousands of pages.

None of this is complicated, which is the point. The sites that get into difficulty are usually those where nobody was assigned to look.