Your share feature is working.
But Google keeps indexing every link your users create.

Here are the practical fixes to keep share links, generated reports and AI tool outputs out of Google's index.

What changed

On October 26, 2026, Google updated its Search Central guide "Prevent user-generated spam on your site and platform". The guide now covers "hosting platforms and tools that let users publish shared pages, generated content, or web apps", not just comment forms.

It also adds a new section, "Only index content meant for Search":

When pages are created for direct sharing, collaboration, or utility rather than public search discovery, apply the noindex rule (using a robots meta tag or X-Robots-Tag HTTP response header) or block crawling in robots.txt by default.

Think invoice links, exported reports, AI tool outputs, shared designs, temporary demo pages and public "view-only" boards.

Why it matters

Any feature that lets someone publish a URL in seconds is attractive to spammers. They can create thousands of thin or spammy pages that sit under your domain. Keeping those pages out of the index by default removes most of the reason to abuse the feature.

A 5-step checklist

1. Inventory every URL type users can create. Share links, reports, generated outputs, profiles, embeds, preview pages.

2. Decide which ones belong in Search. Usually only a few, such as public profiles or curated templates.

3. Ship noindex as the default for everything else.

<meta name="robots" content="noindex">

or as an HTTP header, which also works for PDFs and other non-HTML files:

X-Robots-Tag: noindex

4. Use robots.txt only when you also want to stop crawling. Google has to crawl a page to see its noindex. If the URL is blocked in robots.txt, the tag is never read, and Google's robots.txt docs say a blocked URL can still be indexed if other pages link to it. For URLs that are already indexed, use noindex first and leave them crawlable until they drop out.

5. Monitor. Google's updated guide recommends checking the Page Indexing and Search performance reports in Search Console for unexpected spikes, and setting alerts when a small number of users generate a large share of indexable URLs.

One warning

noindex is not privacy. Anyone with the link can still open the page. If a shared page holds private data, protect it with a login or expiring access.

Your turn

How does your app handle indexing for user-generated share links today?