Now live across the AI ecosystem: ChatGPT GPT Store · MCP Registry · mcp.so

Foundations

Should you buy a page on a big website to get cited by AI?

By Arnav Mukherjee, founder of TofuBofu · August 31, 2026

On 27 August we finished counting every source link in our own stored AI answers. 882 distinct sources across 55 completed scans, pointing at 432 distinct domains, 292 of which were cited exactly once. That count covers two of our six engines and a sample of firms that already suspected they were invisible, and both caveats are spelled out further down. The next day, Google published a short post about how it takes borrowed domain reputation away.

Those two things are about the same asset, and the category has spent the year selling it to you. Get a page on a big domain. Buy your way into a listicle on a site with authority. The engines cite authoritative sources, so rent some authority. It is the most expensive advice in AEO, because unlike most of it, this one has an invoice attached.

Search Engine Land, Search Engine Journal and Search Engine Roundtable all covered Google's 28 August post inside two days, as a story about Europe and enforcement. It is that. It is also a company describing, in public, how it takes back an asset you may be paying somebody for. Nothing about it is hidden. It just reads differently if you are the buyer of a placement rather than the owner of a big domain.

The sentence that names the mechanism

Start with what the rule is, because the rule is a description of the product being sold to you. Google's spam policy says the site reputation policy applies "where third-party content is published on a host site mainly because of that host's already-established ranking signals, which it has earned primarily from its first-party content", and that "the goal of this tactic is for the content to rank better than it could otherwise on its own". That is not a description of link spam. It is a description of a placement package.

On 28 August 2026 Google announced a change to how that policy is enforced. Not to the rule. Google wrote that "following discussion with the European Commission, we are adjusting our enforcement approach within the European Economic Area (EEA) and clarifying the criteria we consider when applying the policy", and that "beginning August 30, manual actions applied under our site reputation policy will have a different effect for those searching in the EEA than outside of it".

Outside the EEA, nothing moves: a manual action "will directly affect search results for the portion of the site affected", and "as before, the rest of the site won't be affected". That is the half the coverage ran with, usually under a headline about Google going easy on Europe.

Here is the other half, in full, and it is the one worth reading twice: "For users inside the EEA, the impact of the manual action won't apply. The affected section of the site may be separated in our systems so that, over time, it ranks independently from the rest of the site."

Read that as a company telling you what its actual instrument is. When Google is prevented from applying the penalty, it does not shrug. It describes doing the thing the penalty was always a proxy for: stopping the section from inheriting the parent's reputation. The penalty is the visible tool. Severing the borrowed ranking is the mechanism, and the mechanism is aimed precisely at the only thing a bought placement buys.

What you are actually renting

A placement on a big domain is not a page. It is a page plus a ranking history you did not earn, cannot move, and do not control. It is a lease. Two things about that lease are now published by the landlord, in the landlord's own words: taking it out mainly for the ranking signals is against the terms, and the remedy can be to stop the borrowing rather than to punish anybody.

Be fair about the boundary, because this is where most write-ups get lazy and end up telling founders never to publish anywhere but their own site. Google is explicit: "having third-party content alone isn't inconsistent with the site reputation policy; it's only inconsistent if the third-party content is published on a host site mainly because of that host site's already-established ranking signals". Google names wire services, syndicated news, user-generated content, editorial columns and advertorials aimed at that publication's own readers as things it does not consider violations, and says the list is non-exhaustive. Guest posting is not the problem. Buying the domain's ranking power is the problem, and you usually know which one you are doing, because one of them has a rate card.

There is a second, quieter consequence for anyone selling across borders. The split is by where the searcher is, not where the site is. Google says that because many pages are read globally, "it's possible that any given page might have a manual action taken on it, but that change will only affect search results shown to users outside the EEA". One URL, two behaviours. A consultancy in Dublin selling into the United States and an MSP in Vancouver selling into the EU are now on opposite sides of the same policy, holding the same asset.

What you pay for bigdomain.com years of first-party content /your-placed-page reputation flows down What the landlord says it can do bigdomain.com unchanged /your-placed-page ranks on its own nothing inherited

Google's words, on the EEA remedy: the affected section "may be separated in our systems so that, over time, it ranks independently from the rest of the site". The word may is Google's.

Before you rent anyone's authority, find out which sources the engines actually cite when your buyers ask. We put your buying questions to six engines and show you what each one named, and where it got it.

Run a free AI visibility scan

What Google did not say, and where my read begins

Google's post does not mention AI Overviews. It does not mention AI Mode. It does not mention any generative surface at all, and neither does the policy page behind it. Anybody telling you this week that Google just changed the rules for AI citations is making that up, and you should treat the rest of their advice accordingly.

Here is the connection I do draw, and it is mine rather than Google's. Google's own guide to optimizing for generative AI features says those features are "rooted in our core Search ranking and quality systems". So a section that has been separated to rank independently of its parent is a section with a smaller ranking of its own, feeding a surface that draws on the same systems. The borrowed advantage does not survive that in the answer any better than it survives it in the ten blue links.

I have not measured it. Nobody publishing about this has. That is exactly why it is written here as a judgement with the working shown, rather than as a finding with a number bolted on, which is the house style of this category and the reason so little of it survives checking.

The one test to apply before you pay

Ask one question about the page you are about to buy. If this page were moved to a domain of its own tomorrow, with no history behind it, would it still deserve to be cited?

If the answer is yes, the host is a distribution decision and a reasonable one. If the answer is no, you did not buy visibility. You rented a ranking, from a landlord who has just published how it stops the borrowing, and who applies it differently depending on where your buyer happens to be sitting.

Our own data says the same thing from the other direction, and it comes with two caveats that travel with every number we publish. Of the 882 distinct sources we counted, 48 were a bare homepage with no path at all, 5.4%. Engines cite pages that answer a question, not companies. The caveats: that count covers two of our six engines, because Google AI Mode and Bing Copilot attach a reference list to the answer while Claude, Perplexity and Gemini do not put their sources in the text we store, and the sample is 55 scans from firms that mostly came to us already suspecting they were invisible, with four scans supplying 95.8% of the sources.

The other shape in that count is the one that undercuts the whole premise of renting authority. 432 distinct domains, and 292 of them cited exactly once. That is not a market where five big sites own the answers and you need to be on one of them. It is a long, thin tail of pages that happened to answer the question.

What to do instead

Write the page and own it. The work of producing something worth citing is the same either way. The difference is whether the asset sits on a domain you control or on one you are renting by the month. A placed page that stops inheriting its host's reputation leaves you with nothing. The same page on your own site is at worst a slow start.

If you do place, place for readers. Google's own carve-outs describe the safe version precisely: content whose purpose is to reach that publication's audience. If you would still want the placement with the link stripped out, it is a real one. Ask yourself whether the host would run the piece if it had no ranking power at all.

Then measure the thing you are actually trying to change. Not domain rating, not a category league table of most-cited sites, but which sources the engines reach for when somebody asks the buying question you want to win. That answer is specific to your category and it changes, which is why it has to be measured rather than assumed. SEO is the floor here and it still matters, but ranking and being named in an answer are different outcomes, and you can win the second while losing the first.

Frequently asked questions

Is parasite SEO still risky in 2026?

Yes, and Google restated the rule on 28 August 2026 rather than relaxing it. The site reputation policy applies, in Google's words, 'where third-party content is published on a host site mainly because of that host's already-established ranking signals, which it has earned primarily from its first-party content'. What changed is enforcement geography, not the rule. From 30 August a manual action still directly affects search results for people searching outside the European Economic Area, and inside the EEA the manual action's impact does not apply, with Google saying the affected section 'may be separated in our systems so that, over time, it ranks independently from the rest of the site'. Neither outcome leaves the borrowed advantage intact.

What changed in Google's site reputation policy on 28 August 2026?

The enforcement, split by where the searcher is rather than where the site is. Google wrote that 'following discussion with the European Commission, we are adjusting our enforcement approach within the European Economic Area (EEA) and clarifying the criteria we consider when applying the policy', and that 'beginning August 30, manual actions applied under our site reputation policy will have a different effect for those searching in the EEA than outside of it'. Outside the EEA a manual action still hits the affected portion of the site. Inside it, the impact does not apply, and Google describes a different remedy instead: separating the affected section so it ranks independently of its parent. Site owners are still notified in Search Console either way, and can file a reconsideration request.

Does Google's site reputation policy apply to AI Overviews or AI Mode?

Google's announcement does not mention AI Overviews, AI Mode, or any generative surface, not once, and neither does the policy page. Anyone telling you this week that Google just changed the rules for AI citations is inventing that. Our own read, labelled as ours, is that it still matters for AI answers, because Google's optimization guide describes its generative AI features as 'rooted in our core Search ranking and quality systems'. A section that ranks independently of its parent has a much smaller ranking of its own, and a surface fed by that index inherits the smaller number. We have not measured that and we are not going to state it as a finding.

Does buying a page on a high-authority site help you get cited by AI?

It can, and the question is what happens to it afterwards. What you buy is the host domain's ranking history, which is precisely the thing Google's policy is written to remove when the borrowing is the point of the arrangement. There is also a simpler problem underneath the policy one. In our own count of 882 distinct sources across 55 completed scans, only 48 of them, 5.4%, were a bare homepage with no path. Engines cite pages that answer a question, not companies. If the placed page is genuinely the best answer to a buying question it will do work for you, and if it is not, no amount of host authority makes it into an answer worth quoting. That count describes two of our six engines, and the sample is firms that already suspected they were invisible.

Is site reputation abuse allowed in Europe now?

No. Google has changed how it enforces, not what it considers a violation. Manual actions are still issued and site owners in the EEA are still notified in Search Console. What Google says is that for people searching inside the EEA the impact of that manual action will not apply, and that the affected section 'may be separated in our systems so that, over time, it ranks independently from the rest of the site'. Note the word may, which is Google's, not a commitment. And because a manual action can be applied to a page that people read globally, Google says that change 'will only affect search results shown to users outside the EEA', so a firm selling across both markets is exposed on one side of the same URL.

What is the difference between a guest post and site reputation abuse?

Intent and integration, and Google is unusually clear about it. The policy page states that 'having third-party content alone isn't inconsistent with the site reputation policy; it's only inconsistent if the third-party content is published on a host site mainly because of that host site's already-established ranking signals'. Google explicitly lists wire and press release services, syndicated news, user-generated content such as forums, editorial columns and opinion pieces, and advertorials whose purpose is to reach that publication's own readers, as things it does not consider violations, and calls the list non-exhaustive. The test is whether the host would still run the piece if it had no ranking power at all.

How do I know which sources AI engines cite for my category?

Ask the engines your buyers' questions and read the answers, rather than reasoning from a published league table of most-cited domains. When we counted our own stored answers, across a sample of two engines and of firms that already suspected they were invisible, we found 432 distinct domains and 292 of them cited exactly once, which is not the shape of a market where a handful of big sites own the answers. Category-level rankings also hide the split between engines: on 12 of the 34 questions where both of those engines answered, they shared no cited domain at all, a comparison that rests on four reports across three brands. A scan that runs your own buying questions across the engines and shows you what each one cited is the only version of this that is about you.

Sources and further reading

Related reading