Your website has a feature you probably never think about. It sits in the top corner of most pages, a little magnifying glass and a box that lets visitors search your site. Useful. Harmless. Until it is not.
Google has just restated something that turns that quiet little box into a real business risk. Left unguarded, it can let spammers create thousands of junk pages in your name, and Google can then hold those pages against your whole site. The check takes two minutes. The fix is a one-off job.
Here is what Google said, how the problem happens on a normal WordPress site, and how to check yours today.
What Google actually said
On 30 July 2026, Google published Episode 113 of its Search Off the Record podcast, with John Mueller and Martin Splitt from the Search Relations team. This is Google speaking on the record.
The old instruction to block internal search pages is no longer written into Google Search Essentials. So having indexable search pages does not automatically make your site spam. Mueller said, “it’s not necessarily something where we would say, ‘We think your site is spam if you allow your search results pages to be indexed.’ It’s just like, you’re being very inefficient.”
But Google still strongly recommends blocking them. The sharper risk is quality. If people can search your site for things unrelated to your business, and those results get indexed, Google may treat the junk as a sign your site has been compromised.
How a search box becomes a spam tool
Take a Perth plumber on WordPress. A customer searches for “hot water repair”, and the site creates a results page showing relevant services. That is healthy. The page helps the visitor, but Google does not need to store it.
Now the spam version. A bad actor fires automated searches at the same box for cheap watches, casino bonuses, pharmaceuticals, or adult terms. Each search creates a URL on the plumber’s domain, such as yourbusiness.com.au/?s=cheap-watches. The page then repeats the spam term under the business’s trusted name.
If those pages are indexable, Google can store them. Suddenly a plumbing site has thousands of URLs for services it has never offered, sometimes with a spammer’s phone number or contact details in the search result.
Mueller confirmed Google has seen this happen at scale. Bad actors identify common content management systems with open search pages, then link to millions of generated URLs. He said Google “might flag that as hacked” in Search Console. Its systems may block some of the junk automatically, but not reliably or immediately.
You do not have to be hacked to look hacked. Your own search function can create the pages freely.
The likely costs are lost visibility while Google assesses the site, reputational damage when customers see the junk, and a cleanup job. This is closely related to the way Google can quietly ignore parts of your robots.txt, another case where a small technical detail causes real damage.
The two-minute check to run today
You do not need a developer to see whether junk search pages are already indexed. Go to Google and type this, replacing the domain with your own:
site:yourbusiness.com.au inurl:?s=
This asks Google to show pages from your site that look like WordPress search results. A clean site should show nothing, or only a small number of genuine pages.
Look for foreign-language results, casino or pharmaceutical terms, adult content, unexpected phone numbers, or anything unrelated to your business. A wall of results is a warning sign. It means generated search URLs are in Google’s index under your name.
If the search is clean, you can stop worrying for now. If it is not, the issue needs fixing at the source.
The fix, in plain terms
The fix has two parts.
First, stop Google crawling these pages in future. On WordPress this usually means adding the correct search pattern to robots.txt. That prevents the problem growing and reduces wasted crawling and server load.
Second, add a “noindex” instruction to the search-results template. Blocking crawling alone does not remove URLs Google has already stored. The noindex tells Google to drop those pages when it processes them.
The exact path varies by WordPress theme and setup, so do not copy a generic rule into your live site without checking it. A slightly wrong robots.txt change can block pages you want ranking. Confirm it with your developer or with us. For many clients this check belongs inside ongoing website care and maintenance.
What this does and does not mean
Having a search box does not mean Google will penalise you. The risk is irrelevant pages being generated and indexed at scale. Millions of sites run search safely.
Blocking internal search pages is also a strong recommendation, not a current Search Essentials rule. You are not out of compliance. You are carrying a preventable risk.
Key takeaways:
- Google confirmed blocking internal search pages is no longer an official rule, but it is still strongly recommended.
- Spammers can generate junk pages through an open search box, and Google may flag the site as hacked.
- Check Google for
site:yourdomain.com.au inurl:?s=and look for unrelated or foreign-language results. - The fix needs a crawl block in robots.txt and a noindex on search pages.
- Confirm the exact change before touching a live WordPress site.
If you want to know whether your site is exposed, see how our Perth SEO team works. A two-minute check today can save a difficult cleanup later.
Frequently asked questions
Will Google penalise my site just for having a search box?
No. Google’s John Mueller was clear in Episode 113 that a search box alone does not make a site spam. The risk is irrelevant pages being generated and indexed at scale.
How do I know if my WordPress site is affected?
Search Google for site:yourdomain.com.au inurl:?s=. Junk pages, foreign-language terms, or content unrelated to your business are warning signs.
Is blocking the pages in robots.txt enough?
No. It stops future crawling but does not remove pages already stored by Google. Add noindex to the search-results template so indexed pages can drop out.
Source
- Google Search Off the Record, Episode 113, “Should you block your Search result pages?”, John Mueller and Martin Splitt, published 30 July 2026, retrieved 2026-08-03, https://search-off-the-record.libsyn.com/should-you-block-your-search-result-pages
