Link Attributes for Developers: nofollow, ugc and sponsored

The rel attributes nofollow, ugc and sponsored tell search engines about your relationship with a linked page. Google asks site owners to mark paid and affiliate links with sponsored, links inside user-generated content such as comments and forum posts with ugc, and other links you do not want to vouch for with nofollow. These values are treated as hints rather than strict commands, and they can be combined.

Getting them right protects your site from looking like it sells influence, keeps spam in comments from borrowing your reputation and makes your editorial links more meaningful. Getting them wrong, for example by adding nofollow to every internal link, wastes effort or hides your own pages from discovery.

This guide explains each value, the related basics of crawlable links and anchor text, and how to apply attributes automatically in PHP applications.

What nofollow, ugc and sponsored mean

Google's documentation on qualifying outbound links defines three values for the rel attribute of a link.

Values can be combined in a space-separated list, such as rel="ugc nofollow". Using nofollow alone for paid or user content is still acceptable, but the more specific values give Google clearer information.

<a href="https://partner.example/product" rel="sponsored">Partner product</a>
<a href="https://commenter.example" rel="ugc nofollow">Commenter's website</a>
<a href="https://untrusted.example" rel="nofollow">Example of a misleading claim</a>

When to use nofollow, ugc and sponsored

Most links on a business website need no special attribute at all. Editorial links to sources you trust, such as official documentation, partners you genuinely recommend and helpful articles, should be normal links. Google's SEO Starter Guide encourages linking to relevant resources, and to trusted sites.

• Paid relationships: any link that exists because of payment, free products, commissions or other compensation should be sponsored.
• User content: anything users can post, including comments, reviews, Q&A answers and profile websites, should carry ugc, ideally automatically.
• Untrusted destinations: when you must link to a site you cannot vouch for, add nofollow.
• Your own pages: leave internal links as normal links.

Google treats all three values as hints. It may still crawl or consider the linked pages, but the attribute tells it not to treat the link as your endorsement.

A useful test is to ask why the link exists. If the honest answer is "because it helps the reader", a normal link is right. If it is "because someone paid or gave us something", it is sponsored. If it is "because a user put it there", it is ugc. If it is "because we have to mention it but cannot vouch for it", it is nofollow.

Why paid links must be marked

Buying or selling links that pass ranking credit is a link scheme under Google's spam policies. Marking paid links with sponsored keeps legitimate advertising, sponsorships and affiliate programmes within the rules.

• Sponsored articles and guest posts written in exchange for payment.
• Paid listings in directories and marketplaces.
• Affiliate links, including those added by plugins or link-shortening services.
• Links given in exchange for free products, discounts or other benefits.

Disclosure for readers is separate from the attribute. Many countries require paid content and affiliate relationships to be clearly labelled for people, not just for search engines. The rel attribute handles search; a visible label handles readers and regulators.

Add the attribute in the component that renders advertising and affiliate blocks, so editors cannot forget it. Our guide to influencer marketing covers disclosure for partnerships on the marketing side.

User-generated content

Comment sections, forums, reviews and user profiles attract spam because a link on a respected site looks valuable. Google's starter guide recommends automatically adding nofollow or similar annotations to user-posted links. The ugc value describes this case exactly.

// HTML Purifier: add rel="ugc nofollow" to every link in user content.
$config = HTMLPurifier_Config::createDefault();
$config->set('HTML.Allowed', 'p,br,strong,em,ul,ol,li,a[href]');
$config->set('HTML.Nofollow', true);           // adds rel="nofollow" to external links
$config->set('Attr.AllowedRel', ['nofollow', 'ugc']);
$clean = (new HTMLPurifier($config))->purify($userHtml);
$clean = str_replace('rel="nofollow"', 'rel="ugc nofollow"', $clean);

• Sanitise user HTML with an allow-list and add rel values in the same step.
• Consider removing links from new or unverified users entirely until they have a history.
• Moderate links in reviews and profiles, not just in comments, because spammers target every field that accepts a URL.
• Do not add ugc to content written by your own staff, even if it lives in the same system.

Crawlable links and anchor text

Attributes only matter if links are real links. Google's guidance on making links crawlable says Google can reliably follow anchor elements with an href attribute pointing to a resolvable URL. Click handlers on other elements and links without href are not reliably followed.

Links should also lead somewhere useful. A link to a page that returns an error, redirects through several hops or requires a login gives readers and crawlers a poor experience, whatever its attributes.

Anchor text is the visible text of the link, and Google uses it to understand the destination. Good anchor text is descriptive and concise: "our XML sitemap guide" says far more than "click here" or "read more".

• Describe the destination in the link text itself, so it makes sense out of context.
• Avoid generic phrases and long sentences as anchor text.
• Do not stuff keywords into anchors; write them naturally for readers.
• For image links, the image alt text acts as the anchor text.

Our guide to internal linking for online stores applies these principles to menus, categories and product links.

Internal links: leave them alone

Years ago, some sites added nofollow to internal links, such as login pages or footer links, to "sculpt" how ranking credit flowed. It does not work that way, and it can stop Google discovering pages you actually want indexed. Use normal links internally, and control indexing with noindex or robots rules where needed.

If a page should not appear in search, mark that page noindex. If crawlers waste time on endless URL patterns, use robots.txt for those patterns. Neither job belongs to the rel attribute. Internal links are how Google finds and understands the structure of your own site, so they should be as clear and plentiful as your navigation allows. Our guide to SEO myths covers other outdated practices that persist in old themes and plugins.

Security attributes for external links

When external links open in a new tab, browsers now treat target="_blank" as if rel="noopener" were set, which prevents the opened page from controlling yours. Many developers still add noopener explicitly for older browsers, and noreferrer when the referring URL should not be sent. These values are about security and privacy, not search, and they can sit alongside nofollow, ugc or sponsored in the same rel attribute. Opening external links in a new tab is a design choice; many accessibility guides recommend telling users when a link will do so.

Building rel rules into templates and the CMS

Link attributes are easy to forget when they depend on editors remembering them. Build them into the places links are created, so the right value appears by default.

• Link components: a shared link helper that accepts a type such as editorial, sponsored or user, and outputs the correct rel and target values.
• Rich text editors: an option in the link dialog to mark a link as sponsored, stored as an attribute the sanitiser allows.
• Advertising and affiliate blocks: templates that always add sponsored, with no way for content to override it.
• Imported content: a migration step that reviews links in old posts, particularly those from past sponsorships.
• Plugins and widgets: checks that third-party embeds such as review widgets add appropriate attributes to the links they inject.

Make sure your HTML sanitiser allows the rel values you use. A strict allow-list that strips unknown attributes can silently remove sponsored or ugc from content, which defeats the purpose. Add a unit test that saves a link with each value and checks it survives.

Auditing link attributes

1. Crawl the site and export every external link with its rel attribute and the page it appears on.
2. Check that affiliate domains, advertising blocks and sponsored posts all carry sponsored.
3. Check that links in comments, reviews and profiles carry ugc.
4. Check that no internal links carry nofollow by mistake.
5. Find links without href, links built with JavaScript handlers and generic anchor text.
6. Repeat the audit after redesigns, plugin updates and new advertising deals, when attributes are most often lost.

Our guide to JavaScript SEO explains how single-page applications sometimes render links that crawlers cannot follow.

Frequently asked questions

Need a link audit or safe handling of user content? Our SEO services include link reviews, and our developers can build the sanitisation in.