rel="nofollow", "sponsored", and "ugc": The 2026 Link Attribute Guide

Most ecommerce stores audit their internal links and forget about outbound. That's backwards. Internal link mistakes hurt rankings slowly. Outbound link mistakes can trigger a manual action from Google's spam team — and the recovery cycle is brutal.

The lever that controls this is the rel attribute on your <a> tags. There are four meaningful states (nofollow, sponsored, ugc, and "no rel" / dofollow) and most stores get at least one of them wrong.

The 2020 Change That Most Stores Missed

For years, rel="nofollow" was a pure directive: Google did not crawl or pass PageRank through the link. In March 2020, Google reframed nofollow as a hint. They reserve the right to crawl and pass equity through nofollow links if their systems decide it's appropriate. At the same time, they introduced two more specific attributes:

• rel="sponsored" — for paid links and affiliate links
• rel="ugc" — for user-generated content (comments, forum posts, reviews)

The 2026 best practice is to use the most specific attribute that applies. A paid link is rel="sponsored", not rel="nofollow". A blog comment from a logged-in user is rel="ugc" (often combined: rel="ugc nofollow"). Generic untrusted links are still rel="nofollow".

The Decision Tree

For every outbound link on your store, walk this tree:

1. Is the link paid for, or part of an affiliate/referral arrangement? → rel="sponsored" (required by Google's link spam policy and FTC disclosure rules).
2. Was the link added by a user (comment, review, forum post)? → rel="ugc", often combined with rel="nofollow".
3. Is the destination untrusted, low-quality, or irrelevant to your topic? → rel="nofollow".
4. Did you editorially choose to link to a trusted, relevant resource? → no rel attribute (dofollow). This is how you build link relationships and get reciprocal mentions.

That's it. Four cases.

The Affiliate Link Trap

This is where most ecommerce content sites get burned. A blog post lists "the 10 best Bluetooth speakers" with Amazon affiliate links. The affiliate links are dofollow because the writer didn't tag them. Google's link spam policy explicitly calls this out — paid/affiliate links without rel="sponsored" are considered link manipulation.

The penalty cycle:

• Stage 1 (months 1-6): Google's algorithms detect the pattern, reduce trust signals on the page.
• Stage 2 (months 6-12): Algorithmic ranking demotion. The page slowly drops from page 1 to page 3-4. Traffic decays.
• Stage 3 (after manual review): Manual action issued. Search Console shows "Unnatural links from your site." Recovery requires fixing every untagged affiliate link AND submitting a reconsideration request.

Recovery in stage 3 is a multi-month process. Prevention is to tag affiliate links correctly from day one.

The Sneaky Failure Modes

1. Theme/template defaults

Many WordPress and Shopify themes add affiliate disclaimers but don't add rel="sponsored" to the links themselves. The disclaimer satisfies FTC; it does not satisfy Google. You need both.

2. Affiliate plugins that strip rel

Some affiliate link cloakers (ThirstyAffiliates, Pretty Links) redirect through your domain. The internal link to the cloaker page is dofollow, the cloaker page redirects out. Whether Google credits the destination depends on configuration. Best practice: configure the cloaker plugin to set rel="sponsored nofollow" on the on-page links.

3. UGC reviews on product pages

If customer reviews allow links (most don't, but some do), those need rel="ugc nofollow". A spammer dropping a payday-loan link in a review under your bestselling product is exactly the situation this attribute exists to defuse.

4. Sidebar/footer "partners" widgets

Footer reciprocal-link widgets are paid links by definition (if there's reciprocity, there's value exchange). Tag them rel="sponsored". Better: just remove footer link widgets entirely — they're a 2008 SEO tactic that hurts more than it helps in 2026.

5. Author bio outbound links

Author bio sections often link to the author's personal site, social profiles, or affiliated company. These are usually dofollow and usually fine — unless the author was paid to write the post (sponsored content), in which case the bio link inherits the sponsored attribute too.

The Audit

For a single page, the audit is mechanical:

1. Open the page, view source, find every <a href="http" (external links).
2. For each, check the rel attribute.
3. For each link without rel="sponsored" or rel="nofollow", ask: "Would I be comfortable explaining to Google that this is an editorial, unpaid endorsement?" If no, fix the rel attribute.

For a whole site, you need automation. StoreVitals' free Nofollow Link Checker scans up to 200 links on any page, classifies each by rel attribute (nofollow / sponsored / ugc / dofollow / internal / external), flags potential affiliate links that lack rel="sponsored", and gives a Quick Reference summary. It catches the patterns Google's spam systems look for, in 30 seconds.

What About Internal Nofollow?

Don't use rel="nofollow" on internal links. There's no SEO benefit (PageRank sculpting via internal nofollow stopped working in 2009), and you make it harder for Google to crawl your own site. Use noindex on the destination page if you don't want it indexed; don't use nofollow on the link to it.

The 2026 Bottom Line

Google's link spam policy is enforced more aggressively in 2026 than it was even three years ago — partly because affiliate-heavy "review" content has flooded SERPs, and partly because spam classifiers are better at detecting untagged paid links at scale. The cost of getting this wrong is higher; the cost of getting it right is a 30-second tag check per outbound link.

Run the audit on your top 10 pages today. If anything's untagged, fix it before Search Console flags it for you.