<b>The crawler indexed one user's name across 5,000 pages</b>

<b>The crawler indexed one user's name across 5,000 pages</b>

A membership site noticed something bizarre in Search Console: thousands of pages showing snippets like "Welcome back, Sarah" and a specific user's dashboard fragments. Rankings for the real content cratered.

The site used full-page SSR with a shared render cache. The cache key ignored the session — so whichever request warmed the cache first got its personalized server render stored and served to everyone after, including Googlebot. A logged-in user named Sarah had triggered the cache fill. Her personalized HTML — greeting, recommended-for-you blocks, account widgets — became the canonical version Google indexed for thousands of URLs.

Google saw 5,000 near-duplicate pages all featuring the same personal greeting and account chrome, and judged them duplicate, low-value, and weirdly identical.

We split rendering: a fully cacheable, personalization-free version for crawlers and logged-out users, with personalization layered in client-side only for authenticated sessions.

—Duplicate-content flags: 5,000 → 0
—Organic to affected pages: recovered +14% over baseline in 9 weeks

A render cache that forgets about sessions doesn't just leak privacy — it teaches Google your whole site is one duplicate page.