Google bans back-button hijacking, purges 292 million fake reviews, and Shopify Scripts hits its sunset.

The week of 13–19 April 2026 was Google playing enforcer. A brand-new spam policy outlawed back-button hijacking with a hard June deadline. The annual Maps safety report revealed a purge of 292 million policy-violating reviews and 13 million fake Business Profiles. Fresh data showed Google's own traffic share shrinking as AI assistants eat into sessions. And on the commerce side, Merchant Center product-spec changes took effect while Shopify quietly locked the door on Scripts editing — the first step of a shutdown that will break unmigrated checkouts by 30 June. If your website is how customers find and choose you, here's the week in full, and what we'd actually do about each item.

1. Back-button hijacking is now a named spam violation — fix it by 15 June

What happened

On Monday 13 April, Google Search Central announced a new spam policy explicitly banning back-button hijacking — sites that interfere with the browser's back button so users land on pages they never visited, get served unsolicited ads and recommendations, or simply can't leave. The behaviour is now classified under Google's "malicious practices" spam category. Site owners have until 15 June 2026 to clean it up; after that, offending pages face manual actions or algorithmic demotions.

Why this matters even if you'd never do it deliberately

• Third-party scripts are the usual culprit. Aggressive ad tech, exit-intent tools and some affiliate redirect chains manipulate browser history without the site owner ever writing a line of that code. If a plugin does it, your domain wears the penalty.
• History-API misuse counts. Single-page-app patterns that push junk states into history.pushState, infinite scroll that breaks the back button, and interstitials that re-trap users are all in the blast radius.
• The deadline is real. Google rarely announces a spam policy with a grace period. When it does, enforcement on day one tends to be aggressive — this is the June spam story being written in advance.

2. Google's traffic share is shrinking — about five points in ten months

Data discussed on 13 April put numbers on a shift everyone has felt: Google's share of measured traffic fell from roughly 35.11% to 30.53% over the past ten months — about five points — as AI assistants and social platforms absorb sessions that used to start with a classic search. In the same week, reports surfaced of Google testing an AI Mode experience in Chrome that displays AI answers alongside regular web pages, and a new Google patent hinted at increasingly predictive search — results surfacing before the user finishes asking.

What this means for a business website

• Diversify by design. A site architected only for blue-link Google traffic is optimising for a shrinking pipe. Structure content so AI systems can quote it: direct answers high in each section, clean heading hierarchy, real schema.
• Measure the mix. Segment AI and social referrals in analytics now, so you can see the channel shift on your own numbers instead of industry averages.
• Convert what still arrives. Fewer clicks makes each one worth more — which is a conversion optimization problem before it's a traffic problem. If a visit lands and bounces, no channel strategy saves you.

3. Commerce week: Merchant Center spec changes land, Shopify Scripts starts shutting down

Merchant Center product data specifications

Google rolled out a batch of updates to its Merchant Center product data specifications, with the first wave effective 14 April 2026 and further changes scheduled for 30 June 2026 and 31 January 2027. If you run Shopping ads or free listings, feed attributes that were optional or loosely validated are tightening up — and feed quality increasingly decides which products appear in AI-assisted shopping surfaces, not just classic Shopping results.

Shopify Scripts: the point of no return

From 15 April, Shopify Scripts can no longer be edited or published, ahead of a full execution shutdown on 30 June 2026. Every store still running Ruby Scripts for discount logic, shipping rules or payment customisation is now on a countdown: the logic works today, is frozen as-is, and silently stops at checkout in ten weeks unless it's rebuilt on Shopify Functions. The same April platform cycle brought good news too — Shopify is extending native B2B selling features (company profiles, custom catalogs, volume pricing, net payment terms) to Basic, Grow and Advanced plans at no extra cost.

4. Maps annual safety report: 292M reviews and 13M fake profiles removed

On Friday 17 April, Google published its annual Maps safety report. The numbers are enormous: over 292 million policy-violating reviews blocked or removed, more than 13 million fake Business Profiles taken down, 79 million inaccurate or unverified edits blocked, and posting restrictions on over 783,000 accounts. It landed the same week Google confirmed a broader Maps spam crackdown — fake listings and keyword-stuffed profiles are being flagged faster — and users gained the ability to ask AI-powered questions directly in Maps when discovering local businesses.

The local visibility read

• Enforcement helps honest businesses. Less spam in the pack means legitimate, complete profiles rank on merit. Keep categories, hours, photos and services exhaustively accurate.
• Shortcuts are now liabilities. Review gating, bulk review buying and keyword-stuffed business names are precisely what this machinery is tuned to catch.
• AI questions change local discovery. When a user asks Maps "which agency near me does e-commerce sites?", the answer is assembled from your profile, reviews and website together. Searches like "web developers near me" increasingly resolve through that AI layer — so the proof (case studies, testimonials, services) needs to live on your own site too, where you control it.

5. Platform notes: canonical selection explained, Ads Safety Report, Gutenberg 23.0 RC

• Canonical URLs: Google may overrule you. Google explained this week how it selects canonical pages — and confirmed that a declared canonical tag is a hint, not a command. If your internal links, sitemap and redirects disagree with your canonical tags, Google picks its own winner. Consistency across all four signals is the only reliable fix.
• Ads Safety Report. Google's latest report showed a significant jump in blocked ads, with AI now doing much of the scam-and-misleading-content detection. If your ad creative sails close to the policy line, automated enforcement is getting less forgiving.
• AdSense Offerwall went generally available on 16 April — a monetisation option worth testing for publishers, and worth watching for its UX cost on content sites.
• WordPress: Gutenberg 23.0 hit release candidate on 15 April, following Gutenberg 22.9 on 8 April, while the WordPress 7.0 release cycle remained extended to fix the real-time collaboration architecture. Translation for site owners: hold off on major WordPress platform bets for a few weeks, keep plugins updated, and let the 7.0 dust settle.

What this week means for your website strategy

Three threads worth pulling together if you own a business website or are scoping a redesign or build:

• User experience is now spam policy. Back-button hijacking, trapping interstitials, dark patterns — Google is converting UX sins into named violations with deadlines. Build quality and search performance are the same discipline now; ask any website development company you evaluate to show you how their builds respect the browser, not just the crawler.
• Platform deadlines are business risks. Shopify Scripts on 30 June, back-button fixes by 15 June, Merchant Center waves through January — the cost of ignoring a migration is always paid at the worst moment, usually at checkout.
• Trust signals compound. With 292 million fake reviews purged and AI answering local queries, the businesses that win are the ones whose profiles, feeds and websites all tell the same verifiable story.

Frequently asked questions

What is Google's new back-button hijacking spam policy?

Announced 13 April 2026, it classifies interfering with the browser back button — redirecting users to pages they never visited, or trapping them behind ads — as spam under Google's malicious practices category. Sites have until 15 June 2026 to fix the behaviour or risk manual actions and algorithmic demotions. Audit your ad scripts and exit-intent tools now; third-party code is the most common offender.

Is Google really losing search traffic share?

Data discussed on 13 April showed Google's traffic share dropping roughly five points in ten months — from about 35.11% to 30.53% — as AI assistants and social platforms absorb sessions. Google remains dominant, but the trend argues for building a website that converts visitors from every channel, not one optimised solely for blue links.

What happens now that Shopify Scripts can no longer be edited?

As of 15 April 2026, Scripts are frozen — no edits, no new publishes — and they stop executing entirely on 30 June 2026. Discount, shipping and payment logic still running on Scripts must be rebuilt on Shopify Functions before then, or it silently disappears at checkout. Start the migration audit now rather than in June.

What did Google's 2026 Maps safety report reveal for local businesses?

Published 17 April, it reported over 292 million policy-violating reviews blocked or removed, 13 million fake Business Profiles taken down, 79 million inaccurate edits blocked, and 783,000+ accounts restricted. Honest, complete profiles benefit; review-gating and bought reviews are exactly what the enforcement machinery now catches.

Do the 14 April Merchant Center changes affect my online store?

If you run Shopping ads or free product listings, yes. The first wave of product data specification changes took effect 14 April 2026, with more coming 30 June 2026 and 31 January 2027. Audit your feed attributes against the updated spec — non-compliant feeds lose eligibility, and feed quality increasingly determines visibility in AI-assisted shopping results.

The takeaway

The thread running through this week: enforcement. Google spent 13–19 April naming violations, publishing removal statistics and setting deadlines, while Shopify started the clock on its own legacy shutdown. None of it punishes well-built websites — every item rewards the same fundamentals: honest UX, clean structure, accurate data and platforms kept current. The sites that treat those as build-quality features, not compliance chores, are the ones that get to ignore weeks like this.