These three attributes are weaker than most practitioners think and, in one specific case, stronger. This guide resolves the confusion and gives you a decision tree you can apply to any link.

Two beliefs about link attributes are widespread, and both are wrong. The first is that rel=”nofollow” is a wall — that it guarantees no ranking signal passes and that the linked page will not be crawled. The second is that the choice between nofollow, sponsored, and ugc is cosmetic, a matter of tidiness rather than compliance. The reality inverts both. Since March 2020 these attributes are hints, not directives — Google may still crawl the link and may still incorporate it into its understanding of the web — which makes them weaker than the “wall” model assumes. And the choice between them is not cosmetic: omitting sponsored from a paid link is itself a policy violation, independent of anything else, which makes that one choice far more consequential than “tidiness” implies.

Holding both facts at once is the whole of attribute compliance. The attributes are weaker than you think in general and stronger than you think in one specific place, and a practitioner who understands only one half makes predictable, costly mistakes — either over-trusting nofollow as a containment tool or under-tagging paid links and incurring a violation that has nothing to do with link quality.

Underlying both errors is a single conceptual mistake worth naming at the outset: treating rel attributes as access controls when they are relationship signals. An access control governs whether a crawler can reach or index a page — that is the job of robots.txt and the noindex rule. A relationship signal describes the nature of a link to the search engine — paid, user-generated, or simply unvouched. The two are routinely conflated, and the conflation produces some of the most common and most damaging implementation errors in the field. This deep-dive keeps the distinction front and centre throughout.

What follows is the technical and compliance detail in full: precise definitions, the hint model explained exactly, the rules for combining attributes, a decision tree and scenario matrix you can apply on Monday morning, an audited worked example, and the mistakes that quietly create risk. For the foundations of how links carry value, our explainer on what backlinks are sets the context this article operates within.

The Attribute Decision Tree

Per our deliverable-first principle, here is the tool before the theory. Apply this sequence to any outbound link and it resolves to the correct attribute every time. Read it as a series of questions, stopping at the first that applies.

Does the link exist because of payment, an affiliate arrangement, a sponsorship, or any compensation? → Use rel=”sponsored”. This is the only mandatory case: omitting it is a policy violation in itself. For extra safety you may use rel=”sponsored nofollow”.
Was the link placed by a user rather than your editorial team — a comment, forum post, profile, or review? → Use rel=”ugc”. If you want belt-and-braces coverage for engines that do not recognise ugc, use rel=”ugc nofollow”.
Is it an editorial link you simply do not wish to vouch for — a source you cannot fully endorse, or a page you would rather not pass signals to? → Use rel=”nofollow”.
Is it a genuine editorial endorsement — a source you stand behind? → Use no rel attribute (a standard followed link). Over-nofollowing genuine citations needlessly withholds a signal and helps no one.
Do you actually want to stop the page being crawled or indexed? → Do not use a rel attribute for this at all. Use robots.txt to control crawling and the noindex rule to control indexing. Attributes are relationship signals, not access controls.

The scenario-to-tag compliance matrix

Link scenario	Correct attribute	Why	Risk if mistagged
Sponsored post / paid placement	sponsored	Compensation exists	Violation — untagged paid link
Affiliate link	sponsored	Paid per action	Violation
Display ad / banner link	sponsored	Paid placement	Violation
Paid guest post link	sponsored	Compensation, despite “editorial” framing	Violation — the common grey-zone error
Blog comment link	ugc	User-placed, no editorial control	Low — nofollow also acceptable
Forum / community / profile link	ugc	User-generated content	Low
Editorial link you don’t endorse	nofollow	Non-endorsement signal	Low
Genuine editorial endorsement	none (followed)	Real vouch — let the signal pass	Over-nofollowing wastes signal
Page you don’t want crawled	robots.txt, NOT a rel attr	Attributes don’t control crawling	Page still crawlable
Page you don’t want indexed	noindex, NOT a rel attr	Attributes don’t control indexing	Page still indexable

Notice the asymmetry the matrix encodes: the only red-risk content rows are the paid-link cases and the two access-control confusions. Everywhere else, the cost of a wrong choice is low. This asymmetry is the single most useful thing to internalise about attribute compliance, and the next section explains why it holds.

The Asymmetry That Governs Everything

Attribute compliance is not symmetric, and treating it as though every choice carries equal weight wastes effort on the harmless cases while under-protecting the one that matters. There are three distinct risk profiles.

Under-tagging paid links: the genuine violation

Failing to mark a paid, affiliate, or sponsored link is a policy violation in its own right, separate from the question of link quality. Google has been explicit that it asks sites participating in affiliate programmes and accepting sponsored or guest posts to identify those links with the appropriate rel value, and that where it detects sites publishing or acquiring such links at scale without proper tagging, both algorithmic and manual actions may follow. Its guidance on qualifying outbound links is the primary source and states the position directly. This is the failure mode with real consequences, and it is precisely the one a large segment of the link-selling industry tries to evade — positioning a paid placement as “editorial” to dodge the sponsored tag and preserve the appearance of full followed-link value. That manoeuvre is the grey-zone error the matrix flags, and it is a violation regardless of how the placement is described.

Over-tagging: usually harmless, occasionally wasteful

Using nofollow where ugc would have been more precise carries no penalty. Google has stated that existing nofollow links need not be migrated to the newer attributes and that using nofollow in place of ugc is acceptable. The newer attributes add precision, not obligation, outside the paid case. The one genuine cost of over-tagging is on editorial endorsements: nofollowing a link you genuinely stand behind withholds a signal for no reason. It will not harm you, but it helps no one, and a profile of reflexively nofollowed citations looks less natural than one that vouches where vouching is warranted.

Mistaking attributes for access controls: the silent failure

The third profile is the most insidious because it fails silently. Practitioners reach for nofollow to keep a page out of the index or to stop it being crawled, and it does neither reliably. Because the attributes are hints, Google may crawl a nofollowed link anyway, and the linked page can be discovered through other routes — sitemaps, other links — entirely independent of your attribute. If your goal is to prevent crawling, the instrument is a robots.txt disallow rule; if your goal is to prevent indexing, it is the noindex rule. Using nofollow for either is a category error that produces the opposite of confidence: you believe a page is contained when it is not.

Why These Attributes Exist: A Short History

The three attributes are easier to apply correctly once you understand the problem each was created to solve, because the history explains both their purpose and their limits. The story is one of progressively finer-grained signals layered onto a system that was never designed for them.

The nofollow attribute arrived in 2005, created jointly by the major search engines to fight comment spam. The problem was specific: automated bots were flooding blog comment sections with links to manipulate rankings, and publishers had no way to host user comments without inadvertently passing ranking credit to spammers. Nofollow was the blunt instrument that solved it — a single signal meaning “do not pass credit through this link.” For roughly fifteen years it carried every kind of non-endorsement at once: paid links, untrusted links, and user-generated links all wore the same tag, which told Google nothing about why a link was not endorsed.

That lack of nuance was the gap September 2019 closed. By introducing sponsored and ugc alongside nofollow, Google gave publishers a vocabulary to distinguish a paid link from a user comment from a merely-unvouched citation. The motive was Google’s own: more granular signals let it understand linking patterns across the web more accurately. The March 2020 shift to treating all three as hints was the logical completion of that thinking — once the signals were granular enough to be informative, Google wanted the freedom to weigh them rather than obey them blindly, because a rigid directive throws away information that a flexible hint can use.

The practical lesson from the history is that these attributes were built to inform the search engine, never to control it. They began as a way to describe links honestly and became a richer vocabulary for the same purpose. Expecting them to function as access controls asks them to do a job they were never designed for — which is exactly why that expectation fails.

The Three Attributes, Defined Precisely

With the risk model established, here is exactly what each attribute is for. The September 2019 introduction of sponsored and ugc gave publishers a vocabulary more precise than the single nofollow that preceded them.

rel=“sponsored”

Introduced in September 2019. It marks links that exist because of advertising, sponsorship, affiliate arrangements, or any other compensation agreement. This is the attribute whose omission is itself a violation, which makes it the one to apply with the least hesitation: when in doubt about whether an arrangement is commercial, tag it sponsored. Paid guest posts, affiliate links, banner ads, and sponsored content all fall here.

rel=“ugc”

Also introduced in September 2019. UGC stands for user-generated content, and the attribute marks links placed by users rather than by the site’s editorial team — comments, forum posts, profile fields, reviews, and similar. Its purpose is to tell the search engine that the publisher did not editorially choose the link, which both protects the site from being associated with user spam and accurately describes the link’s provenance. Where a platform cannot reliably distinguish trusted contributors, applying ugc broadly to user content is the safe default.

rel=“nofollow”

The original attribute, dating to 2005. Google now positions it as the catch-all for links that are neither sponsored nor user-generated but which you nonetheless do not wish to endorse, or where you would prefer Google not associate your site with the destination. It remains fully valid; nothing about the newer attributes deprecates it. A link you cannot vouch for, a source you are citing critically, or a destination you simply do not want to pass signals to all take nofollow.

A point of frequent confusion: a link with no rel attribute is a followed link and passes signals as normal. The attributes are additive markers; their absence is itself meaningful. This is why reflexively adding nofollow everywhere is not a neutral safety measure — it changes what every link communicates.

The Hint Model, Explained Exactly

The most misunderstood fact in this entire area is what changed on 1 March 2020. Before that date, nofollow functioned closer to a directive: Google did not follow the link and did not pass ranking credit. From that date, Google began treating all three attributes — nofollow, sponsored, and ugc — as hints that it may incorporate for crawling, indexing, and ranking purposes at its own discretion. Google’s own wording from its 2019 webspam communications was that it began treating these as hints to incorporate for ranking purposes, a phrasing that surprised much of the SEO community precisely because it broke the long-assumed binary.

Translated into practical consequences, the hint model means three specific things:

Crawling is not guaranteed to stop. Google may crawl a nofollowed link, and the destination may be discovered through other paths regardless. If you need to prevent crawling, use robots.txt.
Indexing is not controlled. A nofollow attribute does not keep the destination out of the index. If you need to prevent indexing, use noindex.
Ranking exclusion is not guaranteed. The attribute does not promise that zero signal passes; it expresses your preference, which Google may weigh. In practice manipulative links are still discounted, but you cannot treat the attribute as a mathematical guarantee of zero.

None of this means the attributes are pointless — they remain the correct and required way to signal the nature of a link, and the paid case remains mandatory. It means only that they are signals about a relationship, not switches that control access. The practitioners who get attribute strategy wrong are almost always those who expected a switch and got a signal.

Combining Attributes: Rules and Examples

Multiple rel values can be applied to a single link, separated by spaces, and there are legitimate reasons to do so. The two common combinations, with their rationale:

rel=”sponsored nofollow” — a paid link, with nofollow added as a fallback for engines or tools that may not recognise sponsored. Belt-and-braces, and never wrong on a paid link.

rel=”ugc nofollow” — a user-generated link, with the same fallback rationale. Useful where your audience includes engines with patchier attribute support.

The reasoning behind the fallback is concrete: some search engines do not support the newer sponsored and ugc values, so pairing them with the universally-understood nofollow ensures the non-endorsement intent is communicated everywhere. There is no penalty for combining, and on paid links the combination is the safest possible choice. What you should not do is combine contradictory or nonsensical values, or treat the combination as a way to have a link be “partly followed” — that is not how the values interact.

Beyond Google: Bing and Other Engines

Attribute behaviour is not Google’s alone, though Google’s treatment dominates the conversation. Bing updated its webmaster guidelines in June 2020 to address the attributes, recommending that paid or advertisement links use nofollow, sponsored, or ugc to prevent them being followed and from potentially affecting rankings — an approach broadly parallel to Google’s. Bing has also historically treated nofollow as a hint rather than an absolute directive.

The practical takeaway for a cross-engine world is the fallback logic already described: because support for the newer values is uneven across engines, pairing sponsored or ugc with nofollow guarantees the core non-endorsement signal lands everywhere while still giving Google the more precise relationship information. This is also increasingly relevant as AI answer engines enter the picture; Google has confirmed its spam policies, link spam included, now apply to its AI Overviews and AI Mode surfaces, so correct attribution carries into the AI context rather than being confined to traditional results.

Implementation: Getting the Tags Onto the Links

Correct theory is worthless if the tags never reach the markup. Implementation tends to fail at predictable points; close each one.

Content management systems. Most major platforms expose a sponsored or nofollow toggle in the link dialog, and many handle comment links as ugc automatically. Confirm what your platform does by default rather than assuming — some mark all external links nofollow, which over-tags editorial endorsements.
Affiliate and ad systems. Links injected by affiliate plugins or ad scripts must carry sponsored. Audit the rendered HTML, not the dashboard setting, because the two do not always match.
Outsourced content. Writers and agencies will not tag links correctly unless told to. Put the attribute rules in the content brief explicitly: which scenarios take sponsored, which take ugc, and that paid placements are never to be presented as untagged editorial links.
User-generated areas. Ensure comment systems, forums, and profile fields apply ugc (or ugc nofollow) automatically. Manual tagging of user content does not scale and will fail.
Verification. Inspect the actual page source or use a crawler to confirm the rendered rel values. The gap between intended and rendered attributes is where most real-world non-compliance hides.

For the auditing and crawling stack that makes verification practical at scale, our roundup of the best link building tools covers the crawlers and backlink auditors that surface attribute issues across a whole site.

Attributes on Internal Links: A Special Case

Almost everything above concerns outbound links to other sites. Internal links — links within your own site — follow different logic, and applying outbound habits to them is a recurring source of self-inflicted damage. The short rule: you rarely have a good reason to put a rel attribute on an internal link, and the most common reason people do is based on a tactic that has not worked for over a decade.

That tactic is PageRank sculpting: nofollowing internal links to low-value pages in the belief that the authority is then redistributed to the remaining followed links. It does not work, and has not since Google changed how it handles nofollow. When you nofollow an internal link, the credit that would have flowed through it is not redistributed to your other links — it is simply lost. Sculpting therefore does the opposite of its intent, leaking authority rather than concentrating it. The correct way to manage how crawlers treat internal pages is at the crawl and index layer: robots.txt to control crawling, the noindex rule to keep a page out of the index. These are the access controls; nofollow is not one.

As for the newer attributes on internal links, they are almost never appropriate. sponsored describes a paid relationship, which rarely exists between your own pages; ugc describes user-generated content, which on internal links applies only to genuinely user-placed internal references such as those in your own comment sections. Industry crawl data confirms how unusual deliberate use is — a small minority of sites apply ugc to internal links and a tiny fraction apply sponsored — and much of even that is accidental. The practical guidance is simple: leave internal links unattributed unless there is a specific, correct reason, and never reach for nofollow as an internal-crawl or internal-index control.

Worked Audit: A Publisher Monetising Three Ways

Make it concrete. Consider a content site that monetises through three channels at once — affiliate links in reviews, occasional sponsored posts, and an active comment section. This is an extremely common configuration, and its correct attribute map is instructive. Run the decision tree on each link type:

Affiliate links in reviews → sponsored. Compensation exists per action, so the decision tree stops at question one. Untagged, these are a violation — the most common single error on review sites.
Sponsored post links → sponsored. Same logic, and the same temptation to mislabel as editorial to preserve followed value. The audit must check these specifically.
Comment-section links → ugc (ideally applied automatically by the comment system). User-placed, no editorial control.
The site’s own editorial citations to sources it stands behind → no attribute. These are genuine endorsements; nofollowing them would withhold signal for nothing.
A critical link to a competitor or a source it does not endorse → nofollow.

How to verify it yourself

Rather than trust the CMS settings, do the audit at the source. Crawl the site with any SEO crawler and export every external link with its rel value, then check three things: that every affiliate and sponsored link carries sponsored, that every comment link carries ugc, and that editorial citations are not blanket-nofollowed. The single most revealing check is to filter for paid-destination links carrying no sponsored value — that filter surfaces the exact violations that matter, and on most monetised sites it returns more results than the owner expects. This is the audit the compliance matrix operationalises, and it takes minutes once the crawl is in hand.

Affiliate Links: The Highest-Volume Compliance Case

Affiliate links deserve their own treatment because they are, for most monetised sites, the single largest category of paid links by volume — and therefore the largest source of attribute violations. Every affiliate link is, by definition, a paid link: it exists because a commission flows when a reader acts. That places every one of them squarely in the sponsored case of the decision tree, with no exceptions and no editorial-framing escape hatch.

The scale is what makes this dangerous. A review site may carry thousands of affiliate links across hundreds of articles, frequently injected automatically by a plugin or link-management tool. If that system does not apply sponsored to every injected link, the site is in violation at scale — the exact pattern Google describes when it warns about sites acquiring or hosting untagged commercial links in volume. And because the links are generated programmatically, the error is uniform and invisible: every affiliate link is wrong in the same way at once, and a spot-check of a single page may not reveal it.

The compliance posture for affiliate links is therefore non-negotiable and systematic: confirm that whatever injects your affiliate links applies sponsored (or sponsored nofollow) at the point of rendering, then verify it in the page source rather than trusting the plugin’s settings screen. This is a configuration check you run once and re-verify after any change to your affiliate tooling. It is the highest-leverage single action in attribute compliance, because it corrects the largest volume of links with the least effort.

Tagging Is Not Disclosure

A compliance deep-dive would be incomplete without drawing the boundary of what these attributes do not accomplish. Applying sponsored to a paid link satisfies an obligation to the search engine. It does nothing whatsoever to inform the human reader, because a reader cannot see a rel attribute. Whether your audience is told, in plain language, that a placement is paid is an entirely separate matter — a question of advertising disclosure governed by consumer-protection rules rather than by Google’s policies.

The two obligations are easy to conflate precisely because both concern paid links, but they aim at different parties and are discharged by different acts. Tagging is markup aimed at a crawler; disclosure is a plain-language statement aimed at a person. A paid placement can be perfectly tagged and still deceive its audience if no human-visible disclosure accompanies it, and that gap — compliant with Google, opaque to readers — is one of the most common integrity failures in monetised content. The detailed disclosure requirements, including the UK’s regulatory framework, warrant their own treatment; the principle to carry from here is simply that completing the tag does not discharge the duty to tell the reader.

Five Mistakes That Create Risk or Waste Signal

In rough order of consequence:

Leaving paid links untagged. The only genuine violation in the list, and the most common. Affiliate links and “editorial-looking” sponsored posts are the usual offenders.
Using nofollow as an indexing or crawling control. It is neither. Pages stay crawlable and indexable; use robots.txt and noindex for those jobs.
Blanket-nofollowing all external links. Over-tags genuine endorsements, withholds signal, and produces an unnaturally cautious profile. Vouch where vouching is warranted.
Assuming the CMS toggle matches the rendered HTML. It frequently does not. Verify the source, not the setting.
Attempting PageRank sculpting with internal nofollows. A long-dead tactic. Nofollowing internal links does not redistribute authority to the remaining links; the credit is simply lost. Control internal crawling with robots.txt instead.

Four of these five are not penalties — they are wasted effort or false confidence. Only the first is a violation. That distribution is the asymmetry restated, and keeping it in mind prevents both the panic that over-tags everything and the negligence that leaves the one mandatory case undone.

Your Recurring Attribute Audit

Attribute compliance is not a one-time fix; new links, plugin changes, and content from new writers all reintroduce risk. A short recurring audit keeps a site clean:

Crawl and export. Crawl the site and export every outbound link with its rendered rel value — the rendered value, not the CMS setting.
Filter for the one violation that matters. Isolate links to paid or affiliate destinations that carry no sponsored value. This single filter surfaces the only content-level violations with real consequences.
Confirm user areas apply ugc automatically. Spot-check comments, forums, and profiles to ensure user-placed links carry ugc without manual intervention.
Check for over-nofollowing. Look for genuine editorial citations wearing nofollow, and for any internal links carrying it; both waste or leak signal.
Re-verify after any tooling change. Any update to affiliate, ad, or comment systems can silently change rendered attributes. Re-run the crawl after each.

Run this quarterly, and after any significant change to monetisation or content tooling, and attribute compliance becomes a maintained state rather than a periodic scramble. The crawlers and auditors in our best link building tools roundup make each step a matter of minutes.

Frequently Asked Questions

What is the difference between nofollow, sponsored, and ugc?

rel=“sponsored” marks paid, affiliate, and sponsorship links; rel=“ugc” marks links placed by users in comments, forums, and profiles; rel=“nofollow” is the catch-all for links you do not want to endorse that are neither paid nor user-generated. All three are now treated as hints rather than strict directives.

Do I have to replace my existing nofollow links with sponsored or ugc?

No. Google has stated that existing nofollow links do not need to be changed. The newer attributes add precision for new links, but nofollow remains valid. The one situation requiring action is any paid link that is currently untagged — that should carry sponsored.

Is it a problem to use nofollow instead of ugc?

No penalty results from using nofollow where ugc would be more precise. The only attribute whose omission is itself a violation is sponsored on a paid link. Outside that case, more general tagging is acceptable, just less precise.

Does nofollow stop a page from being crawled or indexed?

No. Since March 2020 nofollow is a hint, and Google may crawl the link anyway while the destination can be discovered through other routes. Use robots.txt to control crawling and the noindex rule to control indexing. Attributes are relationship signals, not access controls.

Can I combine attributes on one link?

Yes. rel=“sponsored nofollow” and rel=“ugc nofollow” are valid and sensible, adding nofollow as a fallback for engines that do not recognise the newer values. There is no penalty for combining, and on paid links the combination is the safest choice.

Are these attributes guarantees that no PageRank passes?

No. Because they are hints, they express a preference Google may weigh rather than a mathematical guarantee of zero signal. In practice manipulative links are discounted, but the attribute should not be treated as an absolute switch.

What is the single most important attribute rule?

Tag every paid, affiliate, and sponsored link with sponsored. It is the only case where omission is itself a policy violation, independent of link quality, and it is the case the link-selling industry most often tries to evade.

Should I put nofollow on my internal links?

Almost never. Nofollowing internal links does not redistribute authority to your other links — the credit is simply lost — so the old PageRank-sculpting tactic backfires. To manage how crawlers treat internal pages, use robots.txt for crawling and the noindex rule for indexing.

Does tagging a paid link mean I have disclosed it to my readers?

No. A rel attribute is markup aimed at a search engine, and readers cannot see it. Telling your audience in plain language that a link is paid is a separate act of disclosure governed by consumer-protection rules. A perfectly tagged paid link can still leave readers uninformed.

Conclusion

Attribute compliance comes down to holding two facts at once. The attributes are weaker than the “wall” model assumes — since March 2020 they are hints, not switches, and they control neither crawling nor indexing. And they are stronger than the “cosmetic” model assumes in exactly one place — omitting sponsored from a paid link is a violation in its own right. Internalise the asymmetry, stop using nofollow for jobs that belong to robots.txt and noindex, tag the paid cases without exception, and vouch where vouching is genuine. Run the decision tree on any link in doubt and the scenario matrix across your whole site, and attribute compliance stops being guesswork and becomes a five-minute audit. Tagging, finally, is a signal to the search engine; whether your readers are told a link is paid is a separate question of disclosure, and the two should never be confused.

Place this within the wider programme through our link building strategies hub and the foundational guide to what link building is, and benchmark a clean profile against the 2026 link building statistics.