The Google Search API Leak: What It Does and Doesn’t Tell Us

If your feeds have been full of “Google lied to us” posts this week, you are probably wondering whether you need to change how you do SEO. The short answer: the Google search API leak is real and genuinely interesting. But it is a list of data fields, not a ranking formula, so it should change your SEO thinking a little and your SEO plan very little.

In this article I explain what leaked, what the documents seem to show, what they can’t tell us, and what I think you should actually do now.

What Happened in the Google Search API Leak

The leaked material is internal documentation for something Google calls the Content Warehouse API. It appears to describe the data Google stores about pages, sites, links and searches inside its search systems.

Here is the timeline as it is known today:

• Around March 13, 2024: an automated process committed the documentation to a public, Google-owned code repository on GitHub. From there it was copied to a public documentation site for code libraries.
• May 7, 2024: a later commit removed the material from the repository. By then, copies already existed elsewhere.
• May 27, 2024: a well-known SEO industry figure published an account of the documents, followed by a detailed technical analysis from another practitioner on May 27–28.
• May 29, 2024: Google confirmed to the press that the documents are authentic.

The documents run to more than 2,500 pages. They cover 2,596 modules (groups of related data) and 14,014 attributes (individual data fields).

Nobody hacked Google. As far as anyone can tell, this was an internal mistake that left reference documents public for several weeks.

What the Leaked Documents Actually Are

This point matters more than any single attribute name, so I want to be clear about it.

API documentation is a reference for engineers. It lists the fields a system can store or pass along, with a name, a data type and sometimes a short comment. Think of it as the list of columns in a very large spreadsheet.

What it does not contain:

• The code that calculates each value.
• How much weight any field carries in ranking.
• Whether a field is used in ranking at all, or only for testing, reporting or another product.
• Whether a field is still in use or was retired years ago.

A simple example: knowing that a recipe card has a line for “salt” tells you salt might be involved. It does not tell you how much salt goes in, or whether the cook still uses that recipe.

So when you see a post saying “the leak proves X is a ranking factor”, read it as “the leak shows Google stores something called X”. That is a much smaller claim.

What the Google Search Leak Seems to Show

Even with those limits, some of the attribute names are hard to ignore. Several of them sit uncomfortably next to things Google has said in public over the years.

Clicks and User Behaviour

The documents mention NavBoost, a system that uses click data to adjust rankings. There are attributes with names like goodClicks, badClicks and lastLongestClicks.

NavBoost itself is not new. Google’s own engineers described it in testimony during the US antitrust trial against Google in 2023. What the leak adds is more detail on the kinds of click data being stored.

For years, Google’s public line was that clicks are too noisy to use directly for ranking. The leak suggests click and interaction data plays a real role, at least through systems like NavBoost.

My take: this fits with what most of us suspected. A result that people click and stay on is probably a better result. That is a reason to write pages that satisfy the search, not a reason to fake clicks.

Site-Level Signals

There is an attribute called siteAuthority. Google staff have long said Google does not use a “domain authority” score like the ones third-party SEO tools show.

We still don’t know what siteAuthority measures or how it is used. It is almost certainly not the same as any tool’s authority score. But it does suggest Google looks at some quality signals at the level of the whole site, not just the page.

Other site-level fields include siteFocusScore and siteRadius. These appear to measure how focused a site is on one topic, and how far a given page strays from the site’s main topic.

In my experience, sites that stick to a clear topic tend to do better than sites that publish about everything. These attributes are consistent with that pattern.

Chrome Data

Attributes such as chromeInTotal suggest Google stores some data from its Chrome browser at site level. Google has said in the past that it doesn’t use Chrome data for ranking.

The documents don’t explain how this data is used. It could be for ranking, for features like sitelinks, or for something else. I would not build any strategy around it.

New Sites and the “Sandbox”

For years, SEOs have talked about a “sandbox”, where new sites struggle to rank for a while. Google has denied having one.

The leak includes a hostAge attribute, with a comment linking it to sandboxing fresh spam. That does not prove every new site is held back. It does suggest the age of a site can matter in some spam-related situations.

Links Still Matter

There are many link-related attributes, covering anchor text (the clickable words in a link), link spam signals and how links are valued. There is also a demotion for anchor text that doesn’t match the page it points to.

Nothing here suggests links have stopped mattering. It also fits Google’s stated focus on fighting link spam. If you want to see who links to you today, the Search Console Links report is still the best free place to start.

Authors, Dates and Demotions

The documents include fields about authors, such as whether an entity is the author of a page. They also store several kinds of dates: the date shown in a byline, dates found in the URL or title, and dates found in the content.

There are also named demotions, meaning signals that push results down. Examples mentioned in the documents include:

• Anchor mismatch, where link text doesn’t match the target page.
• SERP demotion, which appears linked to signs of user dissatisfaction.
• Navigational demotion, which appears linked to poor navigation or user experience.
• Exact match domain demotion, for domains built around a keyword.
• Product review demotion, which fits with Google’s reviews updates.
• Location demotion, which appears related to how local a page is.

Again, we don’t know how strong any of these are or how often they apply.

Allow Lists for Sensitive Topics

Some attributes point to lists of trusted sources for sensitive topics. Names like isElectionAuthority and isCovidLocalAuthority suggest Google flagged certain sites as authoritative for elections and COVID-19 information.

That is not shocking. Google has said it takes extra care with “Your Money or Your Life” topics, which can affect people’s health, money or safety. For most businesses, this has no practical effect.

What the Leak Doesn’t Tell Us

This is the part most hot takes skip. Before you act on anything you read this week, keep these limits in mind:

• No weights. We have thousands of field names and zero information on how much each one counts.
• No dates for each field. Some attributes may be years old and no longer used. The documents don’t say.
• No formulas. We don’t know how fields combine into a final ranking.
• Not the whole system. These documents cover one set of APIs. Other parts of Google Search may not appear at all.
• Not only for ranking. Some fields may support other products, debugging or experiments.

Here is how I’d separate the claims you’ll see from what the documents can support:

How Google Responded

Google first declined to comment. On May 29, 2024, a Google spokesperson confirmed the documents were real, and cautioned against “making inaccurate assumptions about Search based on out-of-context, outdated, or incomplete information.”

Google also pointed out that it has shared a lot of public information about how Search works, and that it doesn’t comment on specific ranking elements because that would help spammers.

I think both sides have a point. The documents are out of context and incomplete. But some public statements over the years were clearly simplified, and it is fair for SEOs to be frustrated about that.

Should the Google Search API Leak Change Your SEO Strategy?

In my view, not much. Almost everything in the leak points back to things good SEOs already do:

• Make pages that answer the search well, so people click and don’t bounce straight back.
• Build a site that is clearly about something, not a random mix of topics.
• Earn real links from relevant sites, and stay away from link schemes.
• Show who wrote the content and keep dates honest.
• Build a brand that people search for by name.

That last point is the one I’d underline. Clicks, site-level quality signals and Chrome data all point in the same direction. Google appears to reward sites that real people know, choose and come back to.

This is also consistent with Google’s public guidance on creating helpful, reliable, people-first content. That guidance has been around since the 2022 helpful content update, and it became part of Google’s core ranking systems in the March 2024 core update.

What I would not do is chase individual attribute names. If someone sells you a “leak-optimised” service built on one field name, be careful. Nobody outside Google knows how those fields are weighted.

What to Do Now: A Practical Checklist

If you want something concrete to do this week, this is the order I’d work in:

1. Check your top pages against search intent. Pick your 10 to 20 most important pages. Search their main keyword and ask whether your page answers it better than the top results. If not, fix that first.
2. Look for pages that disappoint visitors. In your analytics, find pages with high exits and short engagement time from organic search. These are the pages most likely to send “bad click” signals.
3. Tighten your topic focus. List the content that has nothing to do with your core business. Improve it, merge it into stronger pages, or remove it if it serves no one.
4. Review your links. Check where your links come from and what anchor text they use. Make sure your internal links use descriptive anchors that match the page they point to.
5. Make authors and dates clear. Add real author names with short bios. Only change a page’s date when you make a meaningful update.
6. Invest in brand demand. Look at how many people search for your brand name in Search Console. Then put effort into things that grow it, like email, social, PR and useful tools.

None of these steps depend on any single leaked attribute. That is the point. They are worth doing whether every field in the documents is live or not.

Common Mistakes to Avoid After the Leak

I expect to see a few bad reactions in the coming weeks. Here are the ones I’d avoid:

• Buying fake clicks. Click data being stored doesn’t mean bot traffic will help. Google has had years to filter it, and it is a fast way to waste money.
• Buying old domains just for age. A hostAge field doesn’t mean an old domain will rank. Repurposing expired domains to rank unrelated content is now treated as spam under Google’s expired domain abuse policy.
• Deleting large parts of your site in a panic. Topic focus matters, but removing good content without a plan can hurt more than it helps.
• Ignoring Google’s guidance completely. Some statements were simplified, but the official documentation is still the best public guide to what Google wants.
• Renting space on big sites to borrow their authority. Google’s site reputation abuse policy already targets this, whatever the leak says about site-level signals.

Conclusion: Keep the Google Search API Leak in Perspective

The Google search API leak is the most detailed look at Google’s internal search data that SEOs have ever had. It confirms that clicks, site-level signals, links, authors and dates are all stored. It also shows that some of Google’s public answers were simpler than reality.

But it is a list of ingredients, not the recipe. My advice is to read the analyses with curiosity, ignore anyone who claims to know the weights, and keep building pages and a brand that people actually choose.

A good next step is to run the six-step checklist above on your most important pages this week.