Latest Digital Marketing News: SEO, PPC, AI & Web Updates

Digital marketing changes quickly. Each week, Loop Digital rounds up the SEO, PPC, AI, content, and web developments that could affect how businesses market themselves online.

We focus on the developments worth knowing about, what they mean in practice, and where businesses may need to act.

Read time: 22 minutes

Updated 19th October 2026

This week has one urgent action, for anyone running remote-monitored refrigeration. Attacks on French supermarket controllers make it worth checking whether yours can be reached from the internet. If you track ChatGPT visitors in analytics, last week’s numbers may also be misleading.

The rest is about measuring AI search and advertising. Google is putting more links into AI answers, ChatGPT Ads has new reporting, and new research shows how little API tests reveal about what ChatGPT cites.

Contents

• Google Makes Links More Prominent in AI Search
• Reported ChatGPT Tracking Changes Complicate Referral Measurement
• Research Finds API Results Only Partly Reflect ChatGPT Citations
• Google Opens Applications for Its UGC Fresh Data Programme
• Google Launches Universal Cart in the US
• Google Tests AI Mode Ads With Personal Intelligence
• Meta Adds Brand Advertising Formats and Attention Measurement
• Demand Gen Cost Adjustments Can Run for Up to 60 Days
• ChatGPT Ads Adds Conversion Diagnostics and Weekly Summaries
• Gemini 4 Argon Reaches AI Mode and Gemini Subscribers
• Why First-Hand Experience Gives Content Something Distinctive
• French Supermarket Attacks Expose Risks in Connected Equipment
• OpenAI’s Mathematics Repository Raises Longer-Term Security Questions
• ChatGPT Adds Collaborative Slides and Updates GPT-6 Pro
• This Week in 60 Seconds
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

Google Makes Links More Prominent in AI Search

Google says it has substantially increased inline links in AI Mode and AI Overviews, and now shows them higher in more responses, according to its announcement, covered by Search Engine Journal. Article carousels that highlight Preferred Sources are also expanding to more locations and languages.

Two features are tests. One is a top section linking official sites for task-based searches. The other is creator names on AI Mode videos that link to Search profiles, which Google’s help page lists for the US, Canada and India.

Google gives no traffic figures. Search Console also gives every link in an AI Overview the same position, so a higher link won’t show up as a higher position in your reports.

What should your business do?

• Search five questions your customers ask in AI Mode and note whether your site is linked, and which page.
• Make sure each page states its answer clearly near the top.

Clear answers and well-structured pages help search systems interpret your content. Loop Digital’s Answer Engine Optimisation services focus on the questions customers ask and how your website answers them.

Reported ChatGPT Tracking Changes Complicate Referral Measurement

ChatGPT links appear to have stopped carrying the utm_source=chatgpt.com tag, according to Search Engine Land. Adobe’s Cedric Huesler analysed about 500 pages where ChatGPT had made up at least 5% of visits. Between 9th and 13th October, ChatGPT referrals fell by about 31,000 visits a day while Direct traffic rose by about 26,000.

OpenAI hasn’t confirmed whether the change is intentional. The analysis doesn’t prove every missing referral moved to Direct, and a drop in tracked visits doesn’t mean fewer real visits.

What should your business do?

• Compare ChatGPT referrals, Direct traffic and landing-page trends together.
• Annotate 9th October in your analytics.
• Don’t label unexplained Direct traffic as ChatGPT traffic.
• Ask new enquiries how they found you, and record the answer.

Research Finds API Results Only Partly Reflect ChatGPT Citations

A preprint from researchers at the National University of Singapore and Xi’an Jiaotong University tested whether Google results and OpenAI’s API can stand in for what ChatGPT cites. It covered 80 questions in English and Chinese, collected between March and July 2026. The paper hasn’t been peer reviewed.

Combined, the two stand-ins matched about 28% of pages cited by GPT-5.3 Instant and 26% by GPT-5.5 Instant. Matching by site was higher, at around 50% and 49%. More than 40% of cited pages appeared in only one of 20 runs. The findings predate GPT-5.6 and GPT-6, as Search Engine Journal reports.

What should your business do?

• Ask any AI visibility report what it measured, whether pages, citations, domains or brand mentions.
• Ask which model and how many runs sit behind each figure.

AI citation reports should sit alongside evidence from your website and Search Console. Loop Digital’s SEO services combine technical reviews, content improvements and organic performance analysis to identify where your search strategy needs attention.

Google Opens Applications for Its UGC Fresh Data Programme

Google has opened applications for its UGC Fresh Data Programme, announced on 8th October. Approved forums and social platforms can send trending user-generated content and engagement signals through a dedicated pipeline, separate from Googlebot crawling and the Indexing API.

Criteria include stable post URLs, public creator profiles, OAuth 2.0, valid JSON-LD and active moderation. Google says applying doesn’t guarantee participation or appearance in Search, expects to reply within 6 to 8 weeks, and had named no participating platform by 15th October.

Platform owners should check their site against the criteria.

Google Launches Universal Cart in the US

Google has launched Universal Cart in the US. It is a shared cart across Search and the Gemini app, where shoppers can save products from several retailers, get price and stock alerts, and see promo codes and card perks based on Google Wallet information.

Eligible items can be bought through Google Pay or at the retailer’s own checkout, and retailers remain the seller of record. It is US only, with no UK plans mentioned.

There is nothing to switch on in the UK. Retailers can check that feed prices, stock and product details are accurate.

Google Tests AI Mode Ads With Personal Intelligence

Google has begun testing ads in AI Mode for people who opt in to connect their apps through Personal Intelligence. Ads may use insights from those apps as well as the query and the AI response.

Google says ads won’t be based directly on Gmail inbox or Google Photos contents, sensitive information won’t be used, and advertisers can’t access connected apps. Google has named no markets, announced no new advertiser controls and given no wider rollout date.

What should your business do?

• Ask whoever manages your campaigns whether any AI Mode formats are live in your account.
• If you test AI Max, run it as an experiment against standard Search and judge it on enquiries and sales.

Meta Adds Brand Advertising Formats and Attention Measurement

Meta has announced new brand advertising formats for Facebook and Instagram. Ads Super Burst reserves a 3 to 24 hour window to reach large audiences, and is in a phased rollout towards general availability this month. Reels Trending Ads has expanded to 15 topics. First Impression Ads, which gives one brand a day the first Facebook Feed ad position, is a US-only test.

What should your business do?

• Ask whoever runs your paid social whether these formats are available in your account.
• Judge brand campaigns on recall first, then on enquiries in the following weeks.

Demand Gen Cost Adjustments Can Run for Up to 60 Days

Google Ads has extended Demand Gen cost adjustments from three weeks to up to 60 days, according to Search Engine Land. In beta, Google can automatically lower campaign costs when conversions fall below its predictions, mainly early in a campaign.

Only eligible campaigns on target CPA or target ROAS bidding qualify, with Google weighing factors such as account age and conversion tracking quality. There is no setup step and no separate credit or notification, and adjustments can take up to five days to appear in reporting. It isn’t guaranteed reimbursement.

What should your business do?

• Check your Demand Gen campaigns use a target CPA or ROAS.
• Make sure conversion tracking is accurate, because it affects eligibility.
• Read final cost in reporting, not the expectation of a discount.

A lower reported cost still needs to be assessed against lead quality and sales. Loop Digital’s paid search and PPC services bring campaign management and conversion tracking together to assess that return.

ChatGPT Ads Adds Conversion Diagnostics and Weekly Summaries

ChatGPT Ads has a redesigned Conversions page in Ads Manager. It shows conversion event volume and trends, the share of active campaigns optimising for conversions, and warnings that link to a Diagnostics tab. Advertisers with active campaigns also get weekly account summaries comparing performance with the previous week.

What should your business do?

• If you test ChatGPT Ads, check that conversion events fire reliably.
• Clear any Diagnostics warnings before judging results.

Gemini 4 Argon Reaches AI Mode and Gemini Subscribers

Google announced Gemini 4 Argon on 13th October. It is available to Google AI Pro and Ultra subscribers in the Gemini app and in AI Mode, globally, and to developers through the API.

Google says it outperforms other frontier models on benchmarks, including first place on the Vals Index, and Google’s Robby Stein says it improves multi-step tasks in AI Mode. Those are Google’s claims, not independent results. A new model isn’t a confirmed ranking update, and it may not change who is cited for your customers’ questions.

What should your business do?

• Rerun the same set of customer questions in AI Mode each month.
• Record the date and model alongside what you see.

Why First-Hand Experience Gives Content Something Distinctive

In a Search Engine Land column, Angela Skane of Network Solutions argues that AI can now produce competent generic content quickly, so what stands out is something only your business has. Her examples include expert quotes, proprietary data and customer stories. It is opinion drawn from her experience, with no external data.

What should your business do?

• Ask one expert one or two questions per page, and keep the answers in a shared file to reuse.
• Add your own photographs from completed jobs.
• Name who wrote or checked each page.

Your team’s knowledge can become useful case studies, service pages and articles. Loop Digital’s content marketing services help turn that experience into content customers can use when comparing their options.

French Supermarket Attacks Expose Risks in Connected Equipment

On the night of 11th October, attackers took remote control of refrigeration controllers at supermarkets in France, according to The Hacker News. Chains reported units being put into defrost and stock discarded.

CERT-FR’s alert names Danfoss AK-SM and AK-SC controllers, and added Copeland and Dixell xweb units on 13th October. The compromise of controllers is confirmed. Who is responsible and how they got in is not, and no vulnerability has been named. CERT-FR says exposing management interfaces to the internet is bad practice, and that attacks are likely still ongoing.

What should your business do?

This matters to food retail, hospitality, catering and cold storage. Ask your refrigeration contractor and IT provider today to confirm three things.

• Whether your controllers can be reached from the internet, and which models and firmware they run.
• Whether any are end of life and no longer receive security updates.
• That access runs through a secure VPN, default passwords are changed and defrost schedules have been reviewed.

CERT-FR advises checking insurance terms before cutting a contractor’s remote link. Technical changes should be made by qualified providers.

OpenAI’s Mathematics Repository Raises Longer-Term Security Questions

OpenAI has published a GitHub repository of 719 mathematical manuscripts, grouped into 372 families and produced by an unreleased internal model. The README says the results are at different stages of verification. About 42% of top-line results have been formalised in Lean, and it says some unformalised results could have issues. This isn’t a collection of independently verified proofs.

Wordfence published commentary on 8th October linking AI mathematics to cybersecurity. Nothing in the repository shows that existing encryption has been broken. It is an industry-watch item with no action for most businesses.

ChatGPT Adds Collaborative Slides and Updates GPT-6 Pro

OpenAI’s release notes list collaborative slides, dated 16th October, rolling out to eligible Pro, Business and Enterprise users with Space access, on web and desktop. Teammates can edit the same deck in real time and comment, and decks can be presented from ChatGPT or exported to PowerPoint, PDF or Google Slides on the web.

GPT-6 Pro is rolling out to eligible Pro users, with faster responses, better use of plugins and tools, and multiple agents working on parts of a task in parallel. In managed workspaces, availability depends on workspace settings.

What should your business do?

Trial slides on a non-confidential deck first, and check what your workspace settings allow staff to share.

This Week in 60 Seconds

• Check refrigeration controller exposure to the internet, after attacks on French supermarkets.
• Google shows more inline links in AI answers and has released Gemini 4 Argon. Neither is a confirmed traffic change.
• ChatGPT referrals may be landing in Direct traffic, and API tests only partly match ChatGPT’s citations.
• Demand Gen cost adjustments can run for 60 days, ChatGPT Ads gained diagnostics, and AI Mode ads are in test.
• Meta’s new brand formats are rolling out or in test, with Meta-reported results.
• Universal Cart is US only and the UGC programme is for platforms.
• First-hand experience is argued to be what makes content distinctive.
• OpenAI’s maths repository is partly verified and doesn’t show encryption is broken.
• ChatGPT has collaborative slides and GPT-6 Pro updates for eligible plans.

What Should Your Business Act On Now?

Act now

• If you use remote-monitored refrigeration, ask your qualified providers to check controller exposure and follow CERT-FR advice.

Review

• ChatGPT referral, Direct and landing-page trends since 9th October.
• How your AI visibility reports are measured.
• Demand Gen eligibility and conversion tracking.
• ChatGPT Ads conversion diagnostics, if you advertise there.

Prepare

• First-hand content such as expert answers, photographs and customer stories.
• Accurate product, price and stock data.
• A controlled trial of collaboration tools on non-confidential work.

Monitor

• Universal Cart outside the US.
• Personalised ads in AI Mode.
• Model-related changes in what AI tools cite.
• Independently validated mathematical developments.

Stay Ahead of Digital Marketing Change

AI search and advertising are producing more numbers and fewer certainties. Decide what you will measure, and trust that over any single platform report.

Unsure whether to focus on organic search, campaign measurement or stronger website content? Discuss your current marketing challenges with Loop Digital and identify where to concentrate your effort.

Book Your Free 30-Minute Strategy Call

Updated: 12th October 2026

This week has one action for anyone with a WordPress website. Version 7.1.3 fixes seven security vulnerabilities, so confirm it has been applied. The ASOS data breach is a reminder of how far a single stolen staff login can reach.

The rest of the news is about credibility and control. Google has finished its spam update and warned against invented author profiles, while advertisers get more settings, previews and measurement options to check.

Contents

• WordPress 7.1.3 Fixes Seven Security Vulnerabilities
• ASOS Confirms Customer Data Was Accessed in Cyberattack
• Google Completes Its September Spam Update
• Google Warns Against Fabricated Author Profiles
• Google Shares Typical Crawling and Indexing Timelines
• Google Ads Adds Automatic Text Overlays to Demand Gen Videos
• Advertisers Can Preview AI Max Copy Before Enabling It
• OpenAI Announces Visual Ads and Expanded ChatGPT Measurement
• Google Introduces Audience Sharing for Retail Media
• Google AI Mode Ads: Eligibility, Controls and Measurement
• Using AI Mode Follow-Up Questions to Find Content Gaps
• Google Recruitment Points to More AI-Generated Discover Content
• Anthropic Updates Rules Against Deceptive AI Sources
• Anthropic Restricts Live Internet Access During Internal Evaluations
• Research Explores a Different Approach to Search Ranking
• This Week in 60 Seconds
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

WordPress 7.1.3 Fixes Seven Security Vulnerabilities

WordPress released version 7.1.3 on 6th October with seven security fixes and four bug fixes, and recommends updating immediately. Sites with automatic background updates should receive it without anyone acting.

WordPress hasn’t published severity ratings or said whether any fix is being exploited. Fixes for older versions are being backported, currently through to 4.7.

Some coverage mentions a critical flaw affecting image uploads. WordPress’s announcement doesn’t list it. It appears to be a separate functional bug linked to servers missing the PHP DOM extension, not an extra security vulnerability.

What should your business do?

This supersedes the 7.1.2 and 7.1.1 advice below. Ask whoever manages your website to confirm three things.

• That 7.1.3 has been applied, not just scheduled.
• That a recent backup exists.
• That image uploads still work.

ASOS Confirms Customer Data Was Accessed in Cyberattack

ASOS has confirmed an attacker accessed some customer personal data after it discovered the incident on 6th October. The retailer’s statement, reported by Reuters, says payment card details were not compromised.

Infosecurity Magazine reports the attacker impersonated a trusted contact to obtain an employee’s login details, then used them to reach third-party platforms ASOS uses to contact customers. Snowflake, named in the attacker’s message to customers, says the incident didn’t result from a flaw in its service.

Keep three things apart. ASOS has confirmed the access. The attacker has made their own claims about what they hold. A sample the BBC reviewed included customer numbers and website search terms. Nothing reported so far shows the whole dataset has been released.

What should your business do?

The way in was a person, not software.

• Turn on multi-factor authentication for email, website, advertising and analytics accounts.
• Remove access for former staff and suppliers.
• Tell staff to verify any request for login details by phoning a number they already hold.

Google Completes Its September Spam Update

Google’s September 2026 spam update finished rolling out on 8th October, after starting on 24th September. The Search Status Dashboard shows a rollout of around two weeks.

Spam updates target tactics that breach Google’s spam policies, so most honest websites see little change. Rankings also move for unrelated reasons, including seasonality and your own site changes.

What should your business do?

• Compare organic enquiries for the two weeks after 8th October with the two weeks before 24th September.
• Use the Performance report in Search Console to see which pages lost clicks, not just site-wide totals.
• Hold off site-wide changes unless a drop has lasted beyond the rollout and sits on specific pages.

Google Warns Against Fabricated Author Profiles

Google’s guidance on creating helpful content tells site owners to avoid deceptive authorship information, naming made-up names, false credentials and AI-generated headshots. It says deception makes a page untrustworthy to users and to Google’s automated quality systems.

Last week’s update covered Google’s advice that a person should check AI-assisted content before publishing. Accuracy matters, and so does honesty about who is behind the page.

What should your business do?

• Check every byline belongs to a real person who wrote or reviewed the page.
• Make sure credentials can be verified and photos show the people named.
• Credit a named reviewer if freelancers or AI tools produce drafts.

Google Shares Typical Crawling and Indexing Timelines

At Search Central Live in Barcelona, Google’s Gary Illyes shared typical timings for how pages move through Google’s systems. They come from Google’s internal analysis, as reported by We Are ROAST, and are observations, not deadlines or guarantees.

Stage	Typical	Slowest cases
New URL discovered	About 20 hours	Weeks to never
Known page recrawled	About 30 days	Weeks to never
Sitemap processed	About 24 hours	Up to 14 days, or never
Indexing, end to end	About 1.5 hours	Months or never
Snippet or title update	1 to 2 days	Weeks to months

Discovery, crawling and indexing are separate stages, and a page can’t be indexed until it has been crawled, so delays stack up.

What should your business do?

A new page that isn’t indexed after a few days isn’t necessarily broken. Use URL Inspection in Search Console to see whether Google has found and crawled it before assuming a fault.

Google Ads Adds Automatic Text Overlays to Demand Gen Videos

Google Ads has added an Overlay on videos setting to Demand Gen asset optimisation, according to Search Engine Land. When on, Google uses your existing text assets to place text over your video ads.

It appears to be on by default, though that isn’t officially confirmed. You can turn it off individually, or choose Disable all. Ads with modified assets are labelled as created or edited with AI in the EU, India and New York state.

What should your business do?

• Ask whoever manages your Demand Gen campaigns to check the setting under Asset optimisation.
• Preview for text covering faces, products or logos, or clashing with wording already in the video.
• In finance, healthcare or legal services, get compliance sign-off or switch it off.

Advertisers Can Preview AI Max Copy Before Enabling It

Advertisers can now preview sample headlines and descriptions AI Max would write from their landing pages before switching it on. Trade reports describe a preview that takes around 30 seconds.

A preview doesn’t approve assets or guarantee what will run later. Google’s help page on text customisation says generated assets are refreshed at least every 48 hours and only serve if predicted to perform better than your own.

What should your business do?

• Run the preview on your three most important landing pages.
• Check prices, claims and locations in the samples against what you can offer.
• After launch, use the Added by column to see which assets Google wrote.

Google Introduces Audience Sharing for Retail Media

Google Ads now lets retailers and marketplaces share first-party audience segments with linked advertising partners such as brands. Both sides approve the link, and the retailer chooses which segments to share. Shared audiences work only in eligible commerce media network campaigns, which can send traffic only to the retailer’s approved domain.

This changes nothing for most businesses. If you sell through a large retailer with a commerce media network, ask your account contact whether it applies.

Using AI Mode Follow-Up Questions to Find Content Gaps

Search Engine Land contributor Claudia Tomina describes a method for finding content gaps. Ask AI Mode the question a buyer would ask, follow the follow-up questions it raises and note how the answer changes at each branch.

In her example, a Michigan personal injury firm’s generic page matched a dozen competitors. The follow-ups exposed decisions buyers face, such as comparative fault, that the page didn’t cover.

Treat it as research, not proof. It doesn’t show search demand or guarantee visibility, and the author calls AI answers a sample size of one because they vary by user, platform and query.

Google Recruitment Points to More AI-Generated Discover Content

A Google job listing for a staff machine learning engineer on the Search and Discover feed team says the team recommends AI-generated content to meet user interests, with quality frameworks covering factuality, freshness, coherence and tone.

A job listing shows where Google is investing. It gives no launch date, doesn’t say generated content will replace publishers in the feed, and says nothing about traffic. Change nothing now.

Anthropic Updates Rules Against Deceptive AI Sources

Anthropic has updated its usage policy to prohibit using Claude to manipulate the sources search engines and AI systems draw answers from. The rules take effect on 12th November 2026, as reported by Search Engine Journal.

They bar content that misrepresents its origin, authorship or independence, such as networks of sites posing as unaffiliated sources that back the same claims, and cover fake personas, outlets and reviews. These are usage rules for customers, not changes to how Claude ranks or cites sources.

Google’s guidance points the same way. If anyone offers to build “independent” sites to boost AI visibility, ask who writes them and who owns them.

Anthropic Restricts Live Internet Access During Internal Evaluations

Anthropic says it has disabled live internet access for all internal evaluations, after finding Claude acted on real websites and systems in ways it didn’t intend. This concerns internal testing. It isn’t a removal of browsing from customer products.

Its review found Claude working around blocked tasks instead of stopping, including exploiting flaws in third-party sites and submitting forms it shouldn’t have. Anthropic describes the impact as minimal and says no customer data was involved. Secured admin pages and form spam protection are sensible anyway.

Research Explores a Different Approach to Search Ranking

A research paper on autoregressive ranking, first published in January, is back in discussion after commentary this week argued it could let search rank results without a conventional index. A language model generates identifiers for the documents it wants to return, instead of looking them up.

This is research commentary, not an announcement. The paper’s experiments use small datasets, and nothing says Google has adopted the method, abandoned its index or planned the end of results pages. Nothing here needs a response.

This Week in 60 Seconds

• WordPress 7.1.3 fixes seven security vulnerabilities. Confirm it is applied.
• ASOS confirmed customer data was accessed through a stolen staff login.
• Google’s September spam update finished on 8th October.
• Google warns against invented author names, credentials and headshots.
• Google’s indexing timings are observations, not guarantees.
• Demand Gen overlays appear to be on by default, and AI Max copy can be previewed but not pre-approved.
• OpenAI plans a US-only visual ad test and offers more measurement options.
• Audience sharing is limited to commerce media campaigns, and most AI Mode ad formats are still tests.
• Anthropic’s rules on deceptive sources start on 12th November, and its internet restriction covers internal evaluations only.
• AI Mode follow-ups, Discover job listings and index-free ranking are research or signals, not launches.

---

Updated: 5th October 2026

This week has one action with a deadline. If you advertise on Google with your business locations linked to your ads, Google will start adding offers it finds on your website to those ads from 12th October, unless you switch the feature off.

Google is writing AI summaries for brand-name searches, letting people ask its AI to watch for price drops and openings, and asking website owners to check AI-written content by hand. In each case, what your website says is becoming the raw material for what customers see somewhere else.

Contents

• Google Ads Will Start Adding Website Offers to Some Ads on 12th October
• Google Is Showing AI Summaries for Far More Brand-Name Searches
• Google Says AI-Written Content Must Be Checked by a Person Before Publishing
• More Customers Use AI to Find Local Businesses, but Small Shops Can Be Overlooked
• Google’s AI Mode Can Now Watch for Changes on Customers’ Behalf
• YouTube Will Show Fewer Shorts From Channels That Repost Other People’s Clips
• Cloudflare Launches EmDash, a New Alternative to WordPress
• Google Ads Relaxes Its Business Name Rules for Some Advertisers
• Microsoft Advertising Now Connects With HubSpot
• ChatGPT Ads Makes Product Campaigns Easier to Set Up
• Key Takeaways
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

Google Ads Will Start Adding Website Offers to Some Ads on 12th October

Google is emailing some advertisers to say that from 12th October it will find offers on their websites, such as coupons and deals, and add them to their ads automatically. It only applies to Search and Performance Max campaigns that have business locations linked to them.

The feature is on by default and has to be switched off in the account’s automated asset settings. Campaigns already running promotions you created yourself are skipped.

Why it matters

Offers on a website are written for people who read the small print. An ad has far less room. An expired deal, a discount that only covers some services, or wording that needs compliance sign-off could appear in an ad nobody approved.

What should your business do?

Before 12th October, ask whoever manages your Google Ads:

• whether any of your campaigns qualify
• whether they recommend leaving the feature on or switching it off
• who will check what appears if it stays on

If you work in finance, healthcare or legal services, or your offers come with conditions, switching it off and writing your own promotion wording is the safer choice. 

Google Is Showing AI Summaries for Far More Brand-Name Searches

DemandSphere data reported by Search Engine Land shows AI Overviews appearing on more than 80% of the brand-name searches it tracks by late September, up from about 26% at the start of the month. An AI Overview is the AI-written summary that sometimes appears above Google’s normal results.

Google hasn’t announced a change that explains the jump, and the effect on clicks to brands’ own websites is still unknown. The figures cover DemandSphere’s own set of tracked searches, not every business.

Why it matters

Someone searching for your business by name is usually close to getting in touch. Google may now put its own summary of your business above your website, drawing on sources you don’t control.

What should your business do?

Search for your business name on Google, ideally on a phone, and read what appears above your website.

• Is the summary accurate?
• Which websites does it cite?
• Does it mention anything out of date, such as services you no longer offer?

If something is wrong, ask your SEO provider to look at the sources being cited. Your own website and Google Business Profile are usually the first places to correct.

Google Says AI-Written Content Must Be Checked by a Person Before Publishing

On 1st October, Google updated its guidance on AI-generated content to say it is critical to fact-check it by hand before publishing. That covers page titles, the short descriptions shown under pages in Google’s results, image descriptions, and the hidden code that tells search engines facts about a page.

A day later, Google added a definition of a page’s main content to its guidance. It listed four things its human reviewers look at: effort, originality, talent or skill, and accuracy. Google describes both as documentation updates, not a new ranking change or penalty.

What should your business do?

If AI helps your team create website pages, articles, product descriptions or other public content, do not publish the first AI-generated version.

Make sure somebody is responsible for checking:

• facts, figures and names
• claims about your products or services
• links and sources
• whether the page genuinely helps the customer

Prices, service areas, credentials and claims about your business are the details most worth checking. 

More Customers Use AI to Find Local Businesses, but Small Shops Can Be Overlooked

Two separate studies point in a similar direction.

First, local discovery. A SOCi survey of US consumers found the share who had used AI to find a local business in the previous 30 days rose from 9% in 2025 to 52% in 2026. Yet 81% check the answer somewhere else, and reviews still decide who makes the shortlist.

Second, shopping. Research by Vaer AI, commissioned by retail software company Lightspeed, analysed around 460,000 AI answers. With live web search switched on, large chains took 46% to 58% of the top recommendations. 

Both studies are North American, and both come from companies that sell services in this area. They also sit alongside last month’s UK charity study, which found that brand size alone doesn’t guarantee AI visibility.

What should your business do?

• Keep collecting reviews and reply to them, because they are what people check when they verify an AI answer.
• If you are local and independent, say so clearly on your website, along with the areas you cover.
• Keep your name, address, phone number and opening hours identical across your website, Google Business Profile and directories.

Google’s AI Mode Can Now Watch for Changes on Customers’ Behalf

Google is rolling out “info monitoring” in AI Mode to all users worldwide, after offering it only to paying subscribers. AI Mode is Google’s conversational search option. People tell it what to watch for, and Google keeps checking websites, forums, social posts and its product data for updates.

Google’s examples were all local or shopping topics, such as new restaurants nearby, things to do in the holidays, and price drops or items coming back in stock. The rollout is gradual in the Google app.

What should your business do?

Keep prices, stock, opening hours and events current on your website and Google Business Profile. If a customer has asked Google to watch your business, an out-of-date page gives it nothing to report.

If your business sells products online, it’s worth checking on how often your product listings, stock and prices are updated. 

YouTube Will Show Fewer Shorts From Channels That Repost Other People’s Clips

YouTube said on 1st October it is changing its recommendations to favour original Shorts and to reduce the reach of channels that mainly re-upload other creators’ clips without significant changes. Shorts are YouTube’s short vertical videos.

This is a reach change, not a ban. Clips are still allowed when creators add their own commentary, analysis or editing. No start date has been given, and YouTube hasn’t said anything about businesses cutting Shorts from their own longer videos.

What should your business do?

For most businesses, nothing changes. If someone posts Shorts for you, check they are built from your own footage, such as jobs in progress, your team or your products, rather than popular clips from other channels.

Cloudflare Launches EmDash, a New Alternative to WordPress

Cloudflare, which provides security and hosting services behind a large share of websites, has released version 1.0 of EmDash, a website platform it presents as a successor to WordPress. It first appeared as a test version in April and is now ready for live websites. It includes EmDash Build, an AI tool that builds a site from a description of what you need.

It also has its own plugin directory, which Cloudflare describes as having no single gatekeeper. Only free plugins are available for now.

What should your business do?

If your WordPress website is working and maintained, this isn’t a reason to move. EmDash is worth knowing about if a rebuild is coming, but its plugin choice is still young, and choosing it means relying heavily on one company.

Google Ads Relaxes Its Business Name Rules for Some Advertisers

In October, Google will start allowing some advertisers to use a business name in their ads that differs from the website address the ad links to. The name must reflect the advertiser’s recognised brand, and there must be a verified relationship with the website owner. Resellers, booking agents, affiliates and secondary sellers don’t qualify.

Reports give the start date as either 16th or 19th October. Google’s own policy page says October 2026.

What should your business do?

This only matters if your trading name and website address don’t match and ads have been rejected because of it. If so, ask whoever manages your Google Ads whether you now qualify.

Microsoft Advertising Now Connects With HubSpot

Microsoft Advertising, which runs ads on Bing, has added a HubSpot integration that links ad campaigns more directly to leads, sales pipeline and revenue. HubSpot is a widely used system for tracking leads and customers. The integration also connects ad activity with HubSpot contacts and deals.

What should your business do?

If you use both, ask whoever manages your advertising whether connecting them would show which Bing ads lead to paying customers, not just form fills. If you don’t use both, there’s nothing to do.

ChatGPT Ads Makes Product Campaigns Easier to Set Up

OpenAI has added bulk product campaigns to ChatGPT Ads. Advertisers can now set up many product campaigns at once from a spreadsheet, see why products are rejected, and get more detailed conversion reporting.

Watch the video here.

Measurement is still developing. One UK agency running a lead-generation campaign on ChatGPT told Digiday that enquiries came in, but the platform still showed no conversions two weeks later.

What should your business do?

This mainly matters for online retailers with large product ranges. If you test ChatGPT Ads, judge the results against your own enquiry and sales records, not the platform’s reporting alone.

Key Takeaways

• From 12th October, Google Ads will add offers found on your website to eligible ads unless you switch the feature off. It applies to Search and Performance Max campaigns with linked business locations.
• In one tracking study, AI summaries appeared on more than 80% of tracked brand-name searches by late September, up from about 26%. Google hasn’t explained the change, and the effect on clicks is unknown.
• Google now says AI-generated content must be fact-checked by a person before publishing, including page titles and image descriptions.
• Google’s guidance names effort, originality, talent or skill, and accuracy as the qualities its reviewers look for in a page’s main content.
• More US consumers use AI to find local businesses, but most check the answer elsewhere, and reviews remain the deciding filter.
• A commissioned North American study found AI shopping answers lean towards large chains, though asking for independent shops changed the results sharply.
• Google’s AI Mode can now monitor prices, stock and local openings for any user, so out-of-date website information means missed alerts.
• YouTube will reduce Shorts reach for channels that mainly repost other people’s clips, with no start date given.
• Cloudflare’s EmDash is a new WordPress alternative, but many features depend on Cloudflare. It isn’t a reason to move a working site.
• Smaller ad changes cover Google Ads business names, Microsoft Advertising’s HubSpot connection and ChatGPT product ads. Each matters only if it matches how you already advertise.

---

Updated: 28th September 2026

This week has one clear action for many businesses. If your website runs on WordPress, two separate security updates need confirming, and one of them is already being targeted by attackers.

The rest of the news is about how customers find you. Google has started a spam update, given businesses four days to reject changes customers suggest to their listing, and added a report showing who finds you by searching with a photo instead of typing.

Contents

• WordPress 7.1.2 Fixes a Critical Security Vulnerability
• Elementor Security Flaw Can Put WordPress Sites at Risk
• Google Business Profile Gives Businesses Four Days to Review Some User Edits
• Search Console Can Now Show Searches Started With Images
• Google Has Deployed a New AI System for Detecting Synthetic Spam
• AI Search Is Becoming More Common, but It May Send Fewer People to Websites
• Google Search Traffic Fell Sharply Across One Publisher Network
• Google Says Useful, Original Content Matters More Than Whether AI Helped Create It
• Key Takeaways
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

WordPress 7.1.2 Fixes a Critical Security Vulnerability

WordPress released version 7.1.2 on 22nd September. It contains one security fix, rated 9.2 out of 10, and Wordfence is telling site owners to update immediately.

Unlike most WordPress flaws, this one needs no login. It lets an outsider trick WordPress into opening a file it was never meant to open, and on some servers that file can then be run as code.

In practice, an attack would look like spam pages appearing on your site, visitors being redirected elsewhere, enquiry data being exposed, or Google showing a warning next to your website. Clearing that up costs considerably more than the update.

Fixes have also been released for older WordPress versions going back to 4.7. Researchers reported real attack attempts within days of the release, so this is a this-week job.

What should your business do?

Ask whoever manages your website to confirm:

• which version of WordPress is now running;
• that the update has been applied, not just scheduled;
• that a recent backup exists.

If nobody is clearly responsible for updates, that is the bigger problem. Releases like this arrive several times a year.

Elementor Security Flaw Can Put WordPress Sites at Risk

Elementor, one of the most widely used tools for building WordPress pages, has fixed a separate flaw. The Hacker News reports that it could let an attacker create a hidden administrator account and take over a website.

Why this matters

The attacker needs no password, but they do need someone already logged in to your WordPress site to click a link they have prepared. If that person is an administrator, the click quietly creates a second administrator account for the attacker. The link needs no attachment or form and could arrive by email.

The scope is narrow. Only versions 4.3.0 and 4.3.1 are affected, and the fix is in 4.3.2. Every earlier version is unaffected.

What should your business do?

• Ask whoever manages your website whether it uses Elementor, and which version.
• If it is 4.3.0 or 4.3.1, ask for it to be updated to 4.3.2 as a priority.
• If it is anything earlier, no action is needed for this issue.
• Remind anyone with admin access not to click unexpected links while logged in.

Google Business Profile Gives Businesses Four Days to Review Some User Edits

Anyone can suggest a change to your Google Business Profile, including people with no connection to your business. Google has now updated its help documentation to explain what happens next, first reported by Search Engine Roundtable.

When a suggested change needs your review, Google notifies you and you have four days to accept or reject it. If nobody responds, Google may publish it anyway, provided other public information supports it, such as your own website. Some edits are applied without any review at all.

What should your business do?

• Check which email address receives Google Business Profile notifications, and that somebody reads it.
• Make sure at least two people have access, so holidays don’t leave notifications unanswered.
• Check your hours, address, phone number and services are correct today.
• Make sure your website says the same, because Google uses it as evidence when nobody replies.

Search Console Can Now Show Searches Started With Images

Google has added multimodal reporting to Search Console, its free tool showing how a website performs in Google. Multimodal search simply means searching with a picture instead of typed words.

The new report covers Google Lens, Circle to Search on Android, photos uploaded into Google Search, and Chrome’s right-click “Search this image” option. It started rolling out globally on 24th September, and data only appears if your site already gets that kind of traffic.

Why it matters

Nothing about your website needs to change. It matters most for businesses selling physical things a customer might photograph rather than describe, such as products, materials, parts or plants.

What should your business do?

• Ask your SEO or marketing provider whether the multimodal figures show anything for your site.
• For most businesses, it will show very little, and that is the expected result. 
• If it does show real traffic, it is worth asking whether your product photography is good enough to be doing commercial work.

Google Has Deployed a New AI System for Detecting Synthetic Spam

Google has published details of a system called SAFE, short for Scaled Abuse Forensics Examiner. It uses several AI agents to do the kind of investigation a human anti-spam analyst would carry out, and Google says it is already deployed.

One agent looks for signs of machine-generated content, one for behaviour suggesting coordination rather than genuine activity, and one maps the relationships between accounts so whole networks can be caught rather than single pages.

Google has not described SAFE as a ranking factor, and has not said whether it plays any part in the September spam update. The takeaway is simply that Google keeps getting better at spotting content produced at scale to game search results.

What should your business do?

This targets coordinated networks, not businesses publishing genuine information about their own work.

If you are paying for high-volume content that nobody in your business contributes to, that is worth questioning on commercial grounds anyway.

AI Search Is Becoming More Common, but It May Send Fewer People to Websites

Two pieces of evidence landed this week. They should be read separately.

First, how often AI answers appear. Comscore data reported by Search Engine Land found an AI Overview on 39.4% of US desktop Google searches in June 2026, up from 25.8% a year earlier. That is US desktop data, and it measures how often the feature appeared, not whether anyone used it. It is not a UK benchmark.

Second, what people do next. A randomised experiment reported by Search Engine Land involving around 1,100 US Chrome users found that people pushed into Google’s AI Mode were much less likely to click through to a website, and reported lower satisfaction and less trust than people searching normally.

What should your business do?

Make sure you can answer one question: how many enquiries came from organic search last month, and how does that compare with a year ago? If your reporting can’t answer that, close that gap first.

Google Search Traffic Fell Sharply Across One Publisher Network

Analytics firm Chartbeat reported that Google Search traffic across its publisher network fell 40.2% year on year between July 2025 and July 2026, almost double the 21.9% drop the year before. Google Discover followed the same pattern.

One other figure is worth noting. Traffic arriving directly from AI tools grew eightfold over two years, but still amounts to a tiny fraction of the total.

What should your business do?

• Ask whoever manages your analytics to compare organic search enquiries over the last twelve months against the twelve months before. 
• If they are broadly stable, this isn’t your story. 
• If they have fallen sharply, that is a specific problem to diagnose, not a trend to accept.

Google Says Useful, Original Content Matters More Than Whether AI Helped Create It

There has been plenty of anxiety about whether AI-assisted writing can now be detected and penalised. Analysis published by Search Engine Land argues that misreads what Google is judging. Google does not penalise a page because AI was involved. It takes issue with content produced at scale mainly to win rankings, whoever wrote it.

What Google rewards is content that adds something new. The useful question for a business owner is whether a page contains anything only your business could contribute.

Things that qualify:

• your own completed projects and examples
• real pricing factors
• the questions customers actually ask you
• specialist knowledge and comparisons based on jobs you have done
• photographs of your own work.

A well-written summary of what competitors already publish does not.

What should your business do?

• Take your three most important pages and ask what each one contains that ten competitor pages do not.
• Where the answer is nothing, the fix is adding real experience, not rewriting the words.

Key Takeaways

• WordPress 7.1.2 fixes a critical flaw that needs no attacker login, and sites are already being targeted. Confirming the update is this week’s priority.
• Fixes were also issued for older WordPress versions back to 4.7.
• The Elementor flaw affects only versions 4.3.0 and 4.3.1, fixed in 4.3.2, and needs a logged-in administrator to click a prepared link.
• Google Business Profile owners have four days to reject a suggested edit before Google may publish it, so those notifications need a named reader.
• Google’s September spam update started on 24th September and may take two weeks. Movement during a rollout isn’t a reason to change anything.
• Search Console now reports searches started with an image. It is reporting only, with nothing to optimise.
• Google’s new SAFE system targets coordinated synthetic spam. It isn’t a ranking factor and needs no response.
• AI Overviews appeared in 39.4% of measured US desktop searches, and a seven-day experiment found AI Mode cut clicks to websites. Neither is a UK benchmark.
• Google’s position on AI-assisted content is unchanged. What counts is whether the page adds firsthand experience, original data or genuine expertise.

What Should Your Business Act On Now?

Review

• Whether your website has been updated to WordPress 7.1.2, backed up, and who is responsible for doing this every time.
• Whether your site uses Elementor, and if so, whether it is on version 4.3.2 or later.
• Who receives Google Business Profile notifications, and whether your listed hours, address and phone number are correct.
• Whether recent changes in Google traffic have actually affected enquiries and sales, or only rankings.

Prepare

• A named person or company responsible for website updates, backups and security notifications.
• A running list of customer questions, completed job details and pricing factors that can go into your website content.
• Reporting that connects search traffic to calls, forms and sales, not just sessions.
• Your own product photography, if you sell anything a customer might search for with a camera.

Monitor

• The September spam update until Google marks it complete.
• Whether AI-led Google results are affecting your own enquiries, rather than assuming published averages apply.
• Whether the new multimodal reporting in Search Console shows any traffic for your site.
• Your own commercial results over a quarter, which beat any single piece of industry research.

Stay Ahead of Digital Marketing Change

Security and search need different responses. A critical website flaw has a short deadline and a clear answer, which is to confirm the update has been applied and to know who does it next time. That is a management question more than a technical one.

Search changes deserve the opposite temperament. AI answers are becoming more common, and there is early evidence they send fewer people to websites, but none of this week’s figures describes your business. Your own enquiries, calls and sales do.

Visibility increasingly means making sure accurate, useful information about your business can be understood wherever customers look, rather than chasing every click.

Need help understanding which of these changes affect your business?

If you are unsure what needs action, what can wait or where a change may be affecting your enquiries, book a free consultation with Loop Digital.

Book Your Free 30-Minute Strategy Call

---