"Back button hijacking" manual action: scripts that trap visitors

Where the script usually comes from

Almost nobody writes this code by hand. On WordPress it arrives through:

• "Back button redirect" or exit-traffic plugins that promise to recover visitors who leave, by sending the back button to another page or offer.
• Ad and monetization scripts, including some native ad and recirculation widgets that insert history entries so pressing back shows a feed of sponsored links.
• Push notification or popup tools with an "exit intent" feature bound to history changes.
• Scripts pasted into the header through a header-and-footer plugin or theme options, often copied from an ad network's setup instructions.
• Malware. Injected JavaScript sometimes does this too, in which case check the Security issues report and Hacked: Code injection.

Single-page applications and some themes use the History API legitimately to update the URL as you scroll or open a gallery. That is fine as long as the back button still takes the visitor back.

Reproducing and pinpointing it

Search Google for one of the affected pages, click through, and press back. If you do not return to the results in one press, you have reproduced it. Try on a phone as well, since some scripts only run on mobile.

To find the script, open Chrome DevTools, go to Sources, and search all files (Ctrl+Shift+F or Command+Option+F) for pushState, replaceState, popstate and history.length. You can also log each call as it happens by pasting this into the Console before interacting with the page:

['pushState', 'replaceState'].forEach((m) => {
  const orig = history[m];
  history[m] = function (...args) { console.trace(m, args); return orig.apply(this, args); };
});
window.addEventListener('popstate', () => console.trace('popstate fired'));

The stack trace points to the file doing it. Then map that file back to a plugin, theme or header snippet. Deactivating plugins one at a time on a staging copy confirms the culprit.

Removing it without breaking the site

Deactivate and delete the plugin, or remove the snippet from your header settings. If the behavior comes from an ad network, check its dashboard for a setting like "back button" or "exit" monetization and turn it off; if you cannot, remove that network's script. Clear page and CDN caches so the old JavaScript stops being served.

Hydrogen SEO outputs server-rendered metadata and schema and does not add history-manipulating scripts, so it will not cause this. It also cannot detect it; this is a JavaScript behavior check you need to do in the browser. After removing the code, repeat the search-click-back test on every affected pattern listed in the report, on desktop and on mobile.

Getting the action reviewed

When the behavior is gone from every page, select Request Review in the Manual actions report. Keep it short and specific:

The back button behavior came from the "exit offers" feature of our
ad provider's script, loaded on all posts. We removed the script and
deactivated the related plugin. Tested on desktop and mobile Chrome
from Google results on /blog/* and /recipes/*: back returns to results.

Google posts review status messages in Search Console and revokes the action if the site no longer violates the policy. Plan for a wait of days, possibly weeks. If you later add a new ad or engagement tool, run the same back-button test before it goes live, because another violation can lead to broader action.