Latest Digital Marketing News: SEO, PPC, AI & Web Updates

Digital marketing changes quickly. Each week, Loop Digital rounds up the SEO, PPC, AI, content, and web developments that could affect how businesses market themselves online.

We focus on the developments worth knowing about, what they mean in practice, and where businesses may need to act.

Read time: 22 minutes

Updated: 12th October 2026

This week has one action for anyone with a WordPress website. Version 7.1.3 fixes seven security vulnerabilities, so confirm it has been applied. The ASOS data breach is a reminder of how far a single stolen staff login can reach.

The rest of the news is about credibility and control. Google has finished its spam update and warned against invented author profiles, while advertisers get more settings, previews and measurement options to check.

Contents

• WordPress 7.1.3 Fixes Seven Security Vulnerabilities
• ASOS Confirms Customer Data Was Accessed in Cyberattack
• Google Completes Its September Spam Update
• Google Warns Against Fabricated Author Profiles
• Google Shares Typical Crawling and Indexing Timelines
• Google Ads Adds Automatic Text Overlays to Demand Gen Videos
• Advertisers Can Preview AI Max Copy Before Enabling It
• OpenAI Announces Visual Ads and Expanded ChatGPT Measurement
• Google Introduces Audience Sharing for Retail Media
• Google AI Mode Ads: Eligibility, Controls and Measurement
• Using AI Mode Follow-Up Questions to Find Content Gaps
• Google Recruitment Points to More AI-Generated Discover Content
• Anthropic Updates Rules Against Deceptive AI Sources
• Anthropic Restricts Live Internet Access During Internal Evaluations
• Research Explores a Different Approach to Search Ranking
• This Week in 60 Seconds
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

WordPress 7.1.3 Fixes Seven Security Vulnerabilities

WordPress released version 7.1.3 on 6th October with seven security fixes and four bug fixes, and recommends updating immediately. Sites with automatic background updates should receive it without anyone acting.

WordPress hasn’t published severity ratings or said whether any fix is being exploited. Fixes for older versions are being backported, currently through to 4.7.

Some coverage mentions a critical flaw affecting image uploads. WordPress’s announcement doesn’t list it. It appears to be a separate functional bug linked to servers missing the PHP DOM extension, not an extra security vulnerability.

What should your business do?

This supersedes the 7.1.2 and 7.1.1 advice below. Ask whoever manages your website to confirm three things.

• That 7.1.3 has been applied, not just scheduled.
• That a recent backup exists.
• That image uploads still work.

ASOS Confirms Customer Data Was Accessed in Cyberattack

ASOS has confirmed an attacker accessed some customer personal data after it discovered the incident on 6th October. The retailer’s statement, reported by Reuters, says payment card details were not compromised.

Infosecurity Magazine reports the attacker impersonated a trusted contact to obtain an employee’s login details, then used them to reach third-party platforms ASOS uses to contact customers. Snowflake, named in the attacker’s message to customers, says the incident didn’t result from a flaw in its service.

Keep three things apart. ASOS has confirmed the access. The attacker has made their own claims about what they hold. A sample the BBC reviewed included customer numbers and website search terms. Nothing reported so far shows the whole dataset has been released.

What should your business do?

The way in was a person, not software.

• Turn on multi-factor authentication for email, website, advertising and analytics accounts.
• Remove access for former staff and suppliers.
• Tell staff to verify any request for login details by phoning a number they already hold.

Google Completes Its September Spam Update

Google’s September 2026 spam update finished rolling out on 8th October, after starting on 24th September. The Search Status Dashboard shows a rollout of around two weeks.

Spam updates target tactics that breach Google’s spam policies, so most honest websites see little change. Rankings also move for unrelated reasons, including seasonality and your own site changes.

What should your business do?

• Compare organic enquiries for the two weeks after 8th October with the two weeks before 24th September.
• Use the Performance report in Search Console to see which pages lost clicks, not just site-wide totals.
• Hold off site-wide changes unless a drop has lasted beyond the rollout and sits on specific pages.

Google Warns Against Fabricated Author Profiles

Google’s guidance on creating helpful content tells site owners to avoid deceptive authorship information, naming made-up names, false credentials and AI-generated headshots. It says deception makes a page untrustworthy to users and to Google’s automated quality systems.

Last week’s update covered Google’s advice that a person should check AI-assisted content before publishing. Accuracy matters, and so does honesty about who is behind the page.

What should your business do?

• Check every byline belongs to a real person who wrote or reviewed the page.
• Make sure credentials can be verified and photos show the people named.
• Credit a named reviewer if freelancers or AI tools produce drafts.

Google Shares Typical Crawling and Indexing Timelines

At Search Central Live in Barcelona, Google’s Gary Illyes shared typical timings for how pages move through Google’s systems. They come from Google’s internal analysis, as reported by We Are ROAST, and are observations, not deadlines or guarantees.

Stage	Typical	Slowest cases
New URL discovered	About 20 hours	Weeks to never
Known page recrawled	About 30 days	Weeks to never
Sitemap processed	About 24 hours	Up to 14 days, or never
Indexing, end to end	About 1.5 hours	Months or never
Snippet or title update	1 to 2 days	Weeks to months

Discovery, crawling and indexing are separate stages, and a page can’t be indexed until it has been crawled, so delays stack up.

What should your business do?

A new page that isn’t indexed after a few days isn’t necessarily broken. Use URL Inspection in Search Console to see whether Google has found and crawled it before assuming a fault.

Google Ads Adds Automatic Text Overlays to Demand Gen Videos

Google Ads has added an Overlay on videos setting to Demand Gen asset optimisation, according to Search Engine Land. When on, Google uses your existing text assets to place text over your video ads.

It appears to be on by default, though that isn’t officially confirmed. You can turn it off individually, or choose Disable all. Ads with modified assets are labelled as created or edited with AI in the EU, India and New York state.

What should your business do?

• Ask whoever manages your Demand Gen campaigns to check the setting under Asset optimisation.
• Preview for text covering faces, products or logos, or clashing with wording already in the video.
• In finance, healthcare or legal services, get compliance sign-off or switch it off.

Advertisers Can Preview AI Max Copy Before Enabling It

Advertisers can now preview sample headlines and descriptions AI Max would write from their landing pages before switching it on. Trade reports describe a preview that takes around 30 seconds.

A preview doesn’t approve assets or guarantee what will run later. Google’s help page on text customisation says generated assets are refreshed at least every 48 hours and only serve if predicted to perform better than your own.

What should your business do?

• Run the preview on your three most important landing pages.
• Check prices, claims and locations in the samples against what you can offer.
• After launch, use the Added by column to see which assets Google wrote.

OpenAI Announces Visual Ads and Expanded ChatGPT Measurement

OpenAI has announced two separate things for ChatGPT Ads. The first is a planned test of visual ads, shown during image generation for Free and Go users. It starts later in October in the US with a small group of advertisers, and the ads are labelled and kept separate from the image.

The second is measurement. Advertisers can send conversion data through partners including Hightouch, Tealium and LiveRamp, and use attribution partners such as AppsFlyer and Triple Whale. Incrementality testing is described as early-stage, and brand suitability controls include Negative Phrases for qualifying advertisers.

Quoted results are partner-reported, such as WeightWatchers’ cost per acquisition being 15.3% below its paid search benchmark. Treat them as case studies, not benchmarks. This builds on last week’s bulk product campaigns.

What should your business do?

• Nothing to switch on, as the visual test is US-only.
• If you test ChatGPT Ads, check your analytics can separate its enquiries from other sources.
• Judge results on qualified enquiries or sales, not clicks.

Google Introduces Audience Sharing for Retail Media

Google Ads now lets retailers and marketplaces share first-party audience segments with linked advertising partners such as brands. Both sides approve the link, and the retailer chooses which segments to share. Shared audiences work only in eligible commerce media network campaigns, which can send traffic only to the retailer’s approved domain.

This changes nothing for most businesses. If you sell through a large retailer with a commerce media network, ask your account contact whether it applies.

Google AI Mode Ads: Eligibility, Controls and Measurement

Search Engine Land has published an explainer on advertising in Google’s AI Mode. It isn’t a new launch. Most formats are still in testing or pilot, aren’t available in every account or country, and UK availability isn’t confirmed.

There is no separate AI Mode campaign. Ads appear through eligible existing campaigns, you can’t target AI Mode as a placement, and reporting doesn’t break out its performance.

AI Mode is the search experience people see. AI Max is a set of targeting and creative features inside a Search campaign, and it isn’t the only route to AI Mode ads.

What should your business do?

• Ask whoever manages your campaigns whether any AI Mode formats are live in your account.
• If you test AI Max, run it as an experiment against standard Search and judge it on enquiries and sales.

Using AI Mode Follow-Up Questions to Find Content Gaps

Search Engine Land contributor Claudia Tomina describes a method for finding content gaps. Ask AI Mode the question a buyer would ask, follow the follow-up questions it raises and note how the answer changes at each branch.

In her example, a Michigan personal injury firm’s generic page matched a dozen competitors. The follow-ups exposed decisions buyers face, such as comparative fault, that the page didn’t cover.

Treat it as research, not proof. It doesn’t show search demand or guarantee visibility, and the author calls AI answers a sample size of one because they vary by user, platform and query.

Google Recruitment Points to More AI-Generated Discover Content

A Google job listing for a staff machine learning engineer on the Search and Discover feed team says the team recommends AI-generated content to meet user interests, with quality frameworks covering factuality, freshness, coherence and tone.

A job listing shows where Google is investing. It gives no launch date, doesn’t say generated content will replace publishers in the feed, and says nothing about traffic. Change nothing now.

Anthropic Updates Rules Against Deceptive AI Sources

Anthropic has updated its usage policy to prohibit using Claude to manipulate the sources search engines and AI systems draw answers from. The rules take effect on 12th November 2026, as reported by Search Engine Journal.

They bar content that misrepresents its origin, authorship or independence, such as networks of sites posing as unaffiliated sources that back the same claims, and cover fake personas, outlets and reviews. These are usage rules for customers, not changes to how Claude ranks or cites sources.

Google’s guidance points the same way. If anyone offers to build “independent” sites to boost AI visibility, ask who writes them and who owns them.

Anthropic Restricts Live Internet Access During Internal Evaluations

Anthropic says it has disabled live internet access for all internal evaluations, after finding Claude acted on real websites and systems in ways it didn’t intend. This concerns internal testing. It isn’t a removal of browsing from customer products.

Its review found Claude working around blocked tasks instead of stopping, including exploiting flaws in third-party sites and submitting forms it shouldn’t have. Anthropic describes the impact as minimal and says no customer data was involved. Secured admin pages and form spam protection are sensible anyway.

Research Explores a Different Approach to Search Ranking

A research paper on autoregressive ranking, first published in January, is back in discussion after commentary this week argued it could let search rank results without a conventional index. A language model generates identifiers for the documents it wants to return, instead of looking them up.

This is research commentary, not an announcement. The paper’s experiments use small datasets, and nothing says Google has adopted the method, abandoned its index or planned the end of results pages. Nothing here needs a response.

This Week in 60 Seconds

• WordPress 7.1.3 fixes seven security vulnerabilities. Confirm it is applied.
• ASOS confirmed customer data was accessed through a stolen staff login.
• Google’s September spam update finished on 8th October.
• Google warns against invented author names, credentials and headshots.
• Google’s indexing timings are observations, not guarantees.
• Demand Gen overlays appear to be on by default, and AI Max copy can be previewed but not pre-approved.
• OpenAI plans a US-only visual ad test and offers more measurement options.
• Audience sharing is limited to commerce media campaigns, and most AI Mode ad formats are still tests.
• Anthropic’s rules on deceptive sources start on 12th November, and its internet restriction covers internal evaluations only.
• AI Mode follow-ups, Discover job listings and index-free ranking are research or signals, not launches.

What Should Your Business Act On Now?

Review

• Whether WordPress is on 7.1.3 and a recent backup exists.
• The Demand Gen overlay setting, the automated offers setting and any AI Max preview.
• Who can access your email, website, advertising and analytics accounts, and whether multi-factor authentication is on.
• Author names, credentials and photos on your website.
• Organic enquiries since the spam update finished on 8th October.

Prepare

• Analytics that separate ChatGPT and other AI traffic before any test.
• Buyer questions checked against your service pages using AI Mode follow-ups.
• A named person for website updates, backups and staff security guidance.

Monitor

• Whether AI Mode ad formats and OpenAI’s visual ads reach the UK.
• Anthropic’s rules from 12th November, and how AI platforms treat deceptive sources.
• Index-free ranking research and Google’s Discover plans, as developments to watch, not act on.

Stay Ahead of Digital Marketing Change

This week’s stories share one thread. A WordPress update, a staff login, an author photo and an AI-written ad all put the risk in something your business can check.

Advertising platforms are also handing back more control, through previews, settings and measurement partners. That only helps if someone looks. The businesses that benefit will have a named owner for each.

Need help understanding which of these changes affect your business?

If you are unsure what needs action, what can wait or where a change may be affecting your enquiries, book a free consultation with Loop Digital.

Book Your Free 30-Minute Strategy Call

---

Updated: 5th October 2026

This week has one action with a deadline. If you advertise on Google with your business locations linked to your ads, Google will start adding offers it finds on your website to those ads from 12th October, unless you switch the feature off.

Google is writing AI summaries for brand-name searches, letting people ask its AI to watch for price drops and openings, and asking website owners to check AI-written content by hand. In each case, what your website says is becoming the raw material for what customers see somewhere else.

Contents

• Google Ads Will Start Adding Website Offers to Some Ads on 12th October
• Google Is Showing AI Summaries for Far More Brand-Name Searches
• Google Says AI-Written Content Must Be Checked by a Person Before Publishing
• More Customers Use AI to Find Local Businesses, but Small Shops Can Be Overlooked
• Google’s AI Mode Can Now Watch for Changes on Customers’ Behalf
• YouTube Will Show Fewer Shorts From Channels That Repost Other People’s Clips
• Cloudflare Launches EmDash, a New Alternative to WordPress
• Google Ads Relaxes Its Business Name Rules for Some Advertisers
• Microsoft Advertising Now Connects With HubSpot
• ChatGPT Ads Makes Product Campaigns Easier to Set Up
• Key Takeaways
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

Google Ads Will Start Adding Website Offers to Some Ads on 12th October

Google is emailing some advertisers to say that from 12th October it will find offers on their websites, such as coupons and deals, and add them to their ads automatically. It only applies to Search and Performance Max campaigns that have business locations linked to them.

The feature is on by default and has to be switched off in the account’s automated asset settings. Campaigns already running promotions you created yourself are skipped.

Why it matters

Offers on a website are written for people who read the small print. An ad has far less room. An expired deal, a discount that only covers some services, or wording that needs compliance sign-off could appear in an ad nobody approved.

What should your business do?

Before 12th October, ask whoever manages your Google Ads:

• whether any of your campaigns qualify
• whether they recommend leaving the feature on or switching it off
• who will check what appears if it stays on

If you work in finance, healthcare or legal services, or your offers come with conditions, switching it off and writing your own promotion wording is the safer choice.

If you need clearer oversight of what Google is changing or automating in your campaigns, Loop Digital’s paid search and PPC services can help review those settings and keep decisions tied to leads, sales and commercial return. 

Google Is Showing AI Summaries for Far More Brand-Name Searches

DemandSphere data reported by Search Engine Land shows AI Overviews appearing on more than 80% of the brand-name searches it tracks by late September, up from about 26% at the start of the month. An AI Overview is the AI-written summary that sometimes appears above Google’s normal results.

Google hasn’t announced a change that explains the jump, and the effect on clicks to brands’ own websites is still unknown. The figures cover DemandSphere’s own set of tracked searches, not every business.

Why it matters

Someone searching for your business by name is usually close to getting in touch. Google may now put its own summary of your business above your website, drawing on sources you don’t control.

What should your business do?

Search for your business name on Google, ideally on a phone, and read what appears above your website.

• Is the summary accurate?
• Which websites does it cite?
• Does it mention anything out of date, such as services you no longer offer?

If something is wrong, ask your SEO provider to look at the sources being cited. Your own website and Google Business Profile are usually the first places to correct.

Google Says AI-Written Content Must Be Checked by a Person Before Publishing

On 1st October, Google updated its guidance on AI-generated content to say it is critical to fact-check it by hand before publishing. That covers page titles, the short descriptions shown under pages in Google’s results, image descriptions, and the hidden code that tells search engines facts about a page.

A day later, Google added a definition of a page’s main content to its guidance. It listed four things its human reviewers look at: effort, originality, talent or skill, and accuracy. Google describes both as documentation updates, not a new ranking change or penalty.

What should your business do?

If AI helps your team create website pages, articles, product descriptions or other public content, do not publish the first AI-generated version.

Make sure somebody is responsible for checking:

• facts, figures and names
• claims about your products or services
• links and sources
• whether the page genuinely helps the customer

Prices, service areas, credentials and claims about your business are the details most worth checking.

If AI has become part of your content process, Loop Digital’s content marketing services can help turn AI-assisted drafts into accurate, useful content built around real customer questions, business expertise and measurable goals. 

More Customers Use AI to Find Local Businesses, but Small Shops Can Be Overlooked

Two separate studies point in a similar direction.

First, local discovery. A SOCi survey of US consumers found the share who had used AI to find a local business in the previous 30 days rose from 9% in 2025 to 52% in 2026. Yet 81% check the answer somewhere else, and reviews still decide who makes the shortlist.

Second, shopping. Research by Vaer AI, commissioned by retail software company Lightspeed, analysed around 460,000 AI answers. With live web search switched on, large chains took 46% to 58% of the top recommendations. 

Both studies are North American, and both come from companies that sell services in this area. They also sit alongside last month’s UK charity study, which found that brand size alone doesn’t guarantee AI visibility.

What should your business do?

• Keep collecting reviews and reply to them, because they are what people check when they verify an AI answer.
• If you are local and independent, say so clearly on your website, along with the areas you cover.
• Keep your name, address, phone number and opening hours identical across your website, Google Business Profile and directories.

Google’s AI Mode Can Now Watch for Changes on Customers’ Behalf

Google is rolling out “info monitoring” in AI Mode to all users worldwide, after offering it only to paying subscribers. AI Mode is Google’s conversational search option. People tell it what to watch for, and Google keeps checking websites, forums, social posts and its product data for updates.

Google’s examples were all local or shopping topics, such as new restaurants nearby, things to do in the holidays, and price drops or items coming back in stock. The rollout is gradual in the Google app.

What should your business do?

Keep prices, stock, opening hours and events current on your website and Google Business Profile. If a customer has asked Google to watch your business, an out-of-date page gives it nothing to report.

If your business sells products online, it’s worth checking on how often your product listings, stock and prices are updated.

If important details such as prices, availability, services or locations are difficult for search engines and AI tools to interpret, Loop Digital’s Answer Engine Optimisation services can help structure that information so it is clearer and easier to surface in answer-led search. 

YouTube Will Show Fewer Shorts From Channels That Repost Other People’s Clips

YouTube said on 1st October it is changing its recommendations to favour original Shorts and to reduce the reach of channels that mainly re-upload other creators’ clips without significant changes. Shorts are YouTube’s short vertical videos.

This is a reach change, not a ban. Clips are still allowed when creators add their own commentary, analysis or editing. No start date has been given, and YouTube hasn’t said anything about businesses cutting Shorts from their own longer videos.

What should your business do?

For most businesses, nothing changes. If someone posts Shorts for you, check they are built from your own footage, such as jobs in progress, your team or your products, rather than popular clips from other channels.

Cloudflare Launches EmDash, a New Alternative to WordPress

Cloudflare, which provides security and hosting services behind a large share of websites, has released version 1.0 of EmDash, a website platform it presents as a successor to WordPress. It first appeared as a test version in April and is now ready for live websites. It includes EmDash Build, an AI tool that builds a site from a description of what you need.

It also has its own plugin directory, which Cloudflare describes as having no single gatekeeper. Only free plugins are available for now.

What should your business do?

If your WordPress website is working and maintained, this isn’t a reason to move. EmDash is worth knowing about if a rebuild is coming, but its plugin choice is still young, and choosing it means relying heavily on one company.

Google Ads Relaxes Its Business Name Rules for Some Advertisers

In October, Google will start allowing some advertisers to use a business name in their ads that differs from the website address the ad links to. The name must reflect the advertiser’s recognised brand, and there must be a verified relationship with the website owner. Resellers, booking agents, affiliates and secondary sellers don’t qualify.

Reports give the start date as either 16th or 19th October. Google’s own policy page says October 2026.

What should your business do?

This only matters if your trading name and website address don’t match and ads have been rejected because of it. If so, ask whoever manages your Google Ads whether you now qualify.

Microsoft Advertising Now Connects With HubSpot

Microsoft Advertising, which runs ads on Bing, has added a HubSpot integration that links ad campaigns more directly to leads, sales pipeline and revenue. HubSpot is a widely used system for tracking leads and customers. The integration also connects ad activity with HubSpot contacts and deals.

What should your business do?

If you use both, ask whoever manages your advertising whether connecting them would show which Bing ads lead to paying customers, not just form fills. If you don’t use both, there’s nothing to do.

ChatGPT Ads Makes Product Campaigns Easier to Set Up

OpenAI has added bulk product campaigns to ChatGPT Ads. Advertisers can now set up many product campaigns at once from a spreadsheet, see why products are rejected, and get more detailed conversion reporting.

Watch the video here.

Measurement is still developing. One UK agency running a lead-generation campaign on ChatGPT told Digiday that enquiries came in, but the platform still showed no conversions two weeks later.

What should your business do?

This mainly matters for online retailers with large product ranges. If you test ChatGPT Ads, judge the results against your own enquiry and sales records, not the platform’s reporting alone.

Key Takeaways

• From 12th October, Google Ads will add offers found on your website to eligible ads unless you switch the feature off. It applies to Search and Performance Max campaigns with linked business locations.
• In one tracking study, AI summaries appeared on more than 80% of tracked brand-name searches by late September, up from about 26%. Google hasn’t explained the change, and the effect on clicks is unknown.
• Google now says AI-generated content must be fact-checked by a person before publishing, including page titles and image descriptions.
• Google’s guidance names effort, originality, talent or skill, and accuracy as the qualities its reviewers look for in a page’s main content.
• More US consumers use AI to find local businesses, but most check the answer elsewhere, and reviews remain the deciding filter.
• A commissioned North American study found AI shopping answers lean towards large chains, though asking for independent shops changed the results sharply.
• Google’s AI Mode can now monitor prices, stock and local openings for any user, so out-of-date website information means missed alerts.
• YouTube will reduce Shorts reach for channels that mainly repost other people’s clips, with no start date given.
• Cloudflare’s EmDash is a new WordPress alternative, but many features depend on Cloudflare. It isn’t a reason to move a working site.
• Smaller ad changes cover Google Ads business names, Microsoft Advertising’s HubSpot connection and ChatGPT product ads. Each matters only if it matches how you already advertise.

---

Updated: 28th September 2026

This week has one clear action for many businesses. If your website runs on WordPress, two separate security updates need confirming, and one of them is already being targeted by attackers.

The rest of the news is about how customers find you. Google has started a spam update, given businesses four days to reject changes customers suggest to their listing, and added a report showing who finds you by searching with a photo instead of typing.

Contents

• WordPress 7.1.2 Fixes a Critical Security Vulnerability
• Elementor Security Flaw Can Put WordPress Sites at Risk
• Google Business Profile Gives Businesses Four Days to Review Some User Edits
• Google’s September Spam Update Is Still Rolling Out
• Search Console Can Now Show Searches Started With Images
• Google Has Deployed a New AI System for Detecting Synthetic Spam
• AI Search Is Becoming More Common, but It May Send Fewer People to Websites
• Google Search Traffic Fell Sharply Across One Publisher Network
• Google Says Useful, Original Content Matters More Than Whether AI Helped Create It
• Key Takeaways
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

WordPress 7.1.2 Fixes a Critical Security Vulnerability

WordPress released version 7.1.2 on 22nd September. It contains one security fix, rated 9.2 out of 10, and Wordfence is telling site owners to update immediately.

Unlike most WordPress flaws, this one needs no login. It lets an outsider trick WordPress into opening a file it was never meant to open, and on some servers that file can then be run as code.

In practice, an attack would look like spam pages appearing on your site, visitors being redirected elsewhere, enquiry data being exposed, or Google showing a warning next to your website. Clearing that up costs considerably more than the update.

Fixes have also been released for older WordPress versions going back to 4.7. Researchers reported real attack attempts within days of the release, so this is a this-week job.

What should your business do?

Ask whoever manages your website to confirm:

• which version of WordPress is now running;
• that the update has been applied, not just scheduled;
• that a recent backup exists.

If nobody is clearly responsible for updates, that is the bigger problem. Releases like this arrive several times a year.

Elementor Security Flaw Can Put WordPress Sites at Risk

Elementor, one of the most widely used tools for building WordPress pages, has fixed a separate flaw. The Hacker News reports that it could let an attacker create a hidden administrator account and take over a website.

Why this matters

The attacker needs no password, but they do need someone already logged in to your WordPress site to click a link they have prepared. If that person is an administrator, the click quietly creates a second administrator account for the attacker. The link needs no attachment or form and could arrive by email.

The scope is narrow. Only versions 4.3.0 and 4.3.1 are affected, and the fix is in 4.3.2. Every earlier version is unaffected.

What should your business do?

• Ask whoever manages your website whether it uses Elementor, and which version.
• If it is 4.3.0 or 4.3.1, ask for it to be updated to 4.3.2 as a priority.
• If it is anything earlier, no action is needed for this issue.
• Remind anyone with admin access not to click unexpected links while logged in.

Google Business Profile Gives Businesses Four Days to Review Some User Edits

Anyone can suggest a change to your Google Business Profile, including people with no connection to your business. Google has now updated its help documentation to explain what happens next, first reported by Search Engine Roundtable.

When a suggested change needs your review, Google notifies you and you have four days to accept or reject it. If nobody responds, Google may publish it anyway, provided other public information supports it, such as your own website. Some edits are applied without any review at all.

What should your business do?

• Check which email address receives Google Business Profile notifications, and that somebody reads it.
• Make sure at least two people have access, so holidays don’t leave notifications unanswered.
• Check your hours, address, phone number and services are correct today.
• Make sure your website says the same, because Google uses it as evidence when nobody replies.

Google’s September Spam Update Is Still Rolling Out

Google began its September 2026 spam update on 24th September. It applies worldwide and across all languages, and Google says it may take up to two weeks. It is still running.

A spam update is not a broad quality update. It targets tactics that breach Google’s spam policies, such as pages mass-produced purely to rank. Most businesses running an honest website are not the target.

Rankings and traffic move during any rollout for reasons unconnected to it. A few unsettled days are not evidence that something is wrong.

What should your business do?

Watch enquiries rather than rankings. If organic enquiries are still down once Google marks the rollout complete, check with your SEO provider which specific pages changed before making changes across the site.

Search Console Can Now Show Searches Started With Images

Google has added multimodal reporting to Search Console, its free tool showing how a website performs in Google. Multimodal search simply means searching with a picture instead of typed words.

The new report covers Google Lens, Circle to Search on Android, photos uploaded into Google Search, and Chrome’s right-click “Search this image” option. It started rolling out globally on 24th September, and data only appears if your site already gets that kind of traffic.

Why it matters

Nothing about your website needs to change. It matters most for businesses selling physical things a customer might photograph rather than describe, such as products, materials, parts or plants.

What should your business do?

• Ask your SEO or marketing provider whether the multimodal figures show anything for your site.
• For most businesses, it will show very little, and that is the expected result. 
• If it does show real traffic, it is worth asking whether your product photography is good enough to be doing commercial work.

Google Has Deployed a New AI System for Detecting Synthetic Spam

Google has published details of a system called SAFE, short for Scaled Abuse Forensics Examiner. It uses several AI agents to do the kind of investigation a human anti-spam analyst would carry out, and Google says it is already deployed.

One agent looks for signs of machine-generated content, one for behaviour suggesting coordination rather than genuine activity, and one maps the relationships between accounts so whole networks can be caught rather than single pages.

Google has not described SAFE as a ranking factor, and has not said whether it plays any part in the September spam update. The takeaway is simply that Google keeps getting better at spotting content produced at scale to game search results.

What should your business do?

This targets coordinated networks, not businesses publishing genuine information about their own work.

If you are paying for high-volume content that nobody in your business contributes to, that is worth questioning on commercial grounds anyway.

AI Search Is Becoming More Common, but It May Send Fewer People to Websites

Two pieces of evidence landed this week. They should be read separately.

First, how often AI answers appear. Comscore data reported by Search Engine Land found an AI Overview on 39.4% of US desktop Google searches in June 2026, up from 25.8% a year earlier. That is US desktop data, and it measures how often the feature appeared, not whether anyone used it. It is not a UK benchmark.

Second, what people do next. A randomised experiment reported by Search Engine Land involving around 1,100 US Chrome users found that people pushed into Google’s AI Mode were much less likely to click through to a website, and reported lower satisfaction and less trust than people searching normally.

What should your business do?

Make sure you can answer one question: how many enquiries came from organic search last month, and how does that compare with a year ago? If your reporting can’t answer that, close that gap first.

Google Search Traffic Fell Sharply Across One Publisher Network

Analytics firm Chartbeat reported that Google Search traffic across its publisher network fell 40.2% year on year between July 2025 and July 2026, almost double the 21.9% drop the year before. Google Discover followed the same pattern.

One other figure is worth noting. Traffic arriving directly from AI tools grew eightfold over two years, but still amounts to a tiny fraction of the total.

What should your business do?

• Ask whoever manages your analytics to compare organic search enquiries over the last twelve months against the twelve months before. 
• If they are broadly stable, this isn’t your story. 
• If they have fallen sharply, that is a specific problem to diagnose, not a trend to accept.

Google Says Useful, Original Content Matters More Than Whether AI Helped Create It

There has been plenty of anxiety about whether AI-assisted writing can now be detected and penalised. Analysis published by Search Engine Land argues that misreads what Google is judging. Google does not penalise a page because AI was involved. It takes issue with content produced at scale mainly to win rankings, whoever wrote it.

What Google rewards is content that adds something new. The useful question for a business owner is whether a page contains anything only your business could contribute.

Things that qualify:

• your own completed projects and examples
• real pricing factors
• the questions customers actually ask you
• specialist knowledge and comparisons based on jobs you have done
• photographs of your own work.

A well-written summary of what competitors already publish does not.

What should your business do?

• Take your three most important pages and ask what each one contains that ten competitor pages do not.
• Where the answer is nothing, the fix is adding real experience, not rewriting the words.

Key Takeaways

• WordPress 7.1.2 fixes a critical flaw that needs no attacker login, and sites are already being targeted. Confirming the update is this week’s priority.
• Fixes were also issued for older WordPress versions back to 4.7.
• The Elementor flaw affects only versions 4.3.0 and 4.3.1, fixed in 4.3.2, and needs a logged-in administrator to click a prepared link.
• Google Business Profile owners have four days to reject a suggested edit before Google may publish it, so those notifications need a named reader.
• Google’s September spam update started on 24th September and may take two weeks. Movement during a rollout isn’t a reason to change anything.
• Search Console now reports searches started with an image. It is reporting only, with nothing to optimise.
• Google’s new SAFE system targets coordinated synthetic spam. It isn’t a ranking factor and needs no response.
• AI Overviews appeared in 39.4% of measured US desktop searches, and a seven-day experiment found AI Mode cut clicks to websites. Neither is a UK benchmark.
• Google’s position on AI-assisted content is unchanged. What counts is whether the page adds firsthand experience, original data or genuine expertise.

---

Updated: 21st September 2026

This week has one clear action for many businesses, that is if your website runs on WordPress, make sure the latest security update has been applied.

The rest of the news is more about what is changing around you. Google is giving advertisers more information about competitor spend, AI-powered search is becoming more conversational, and OpenAI is testing adverts that let customers speak to a business before visiting its website.

For business owners, the priority is simple: protect your website, keep marketing spend tied to real results and make sure customers can quickly understand why they should choose you.

Contents

• WordPress 7.1.1 Fixes 11 Security Issues
• Google Ads Now Shows How Your Spend Compares With Similar Businesses
• Google Is Testing Payments to Websites for AI Answers
• New Research Suggests Nobody Can Guarantee Where AI Cites You
• ChatGPT Tests Adverts That Open a Conversation With a Business
• Google’s Voice Search Gets a More Capable AI Model
• Google Ads Can Now Dub Video Adverts Into 33 Languages
• Google Extends New European Search Results to Local Businesses
• OpenAI’s Maths Breakthrough Claim Is Disputed
• OpenAI Launches ChatGPT for Financial Services
• Key Takeaways
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

WordPress 7.1.1 Fixes 11 Security Issues

WordPress released version 7.1.1 on 17th September. It is a security and maintenance release with 11 security fixes and 38 bug fixes, and WordPress recommends updating immediately.

The security issues include flaws that could let someone plant harmful code on a page, or see information that should stay private, such as the title of a private page. Most require the attacker to have some form of login already. One can be triggered by someone without an account if a comment containing it is approved.

Fixes have also been released for older versions of WordPress going back to 4.7. However, only the latest version is actively supported, and sites on 4.6 or earlier get no security fixes at all.

What should your business do?

1. If your website is managed by an agency, developer or hosting provider, ask them to confirm that it has been updated to WordPress 7.1.1 and that a recent backup was taken beforehand. 
2. Ideally, they should also be able to confirm when the update was completed.
3. If nobody looks after your website, that is the bigger risk. Updates, backups and security checks need a named person or company responsible for them.

Google Ads Now Shows How Your Spend Compares With Similar Businesses

Some Google Ads accounts now show a Spend Benchmarks report on the account overview. It compares your weekly ad spend and clicks with a group of businesses Google considers similar, based on factors including your industry and where you advertise.

In one example, an account spending €284 a week was shown a peer figure of €268. It had 912 clicks against 765 for the peer group.

The context is useful. The risk is treating it as a target. The benchmark can come with recommendations to spend more, and two businesses in the same industry can have very different margins, order values and conversion rates.

Spending less than similar businesses doesn’t mean you’re underinvesting, and spending more doesn’t mean you’re overspending. What matters is whether each extra pound brings in enquiries or sales that make you money.

What should your business do?

If Google says similar businesses spend more than you, it’s describing them, not your business, your margins or your customers.

Do not increase your budget simply because Google says similar businesses are spending more. Instead, ask whoever manages your advertising:

• How much does each enquiry or sale currently cost us?
• How many of those enquiries become paying customers?
• Are we missing worthwhile opportunities because the budget runs out?
• If we spend more, is there evidence it will produce more profitable business?

If the answer is based on clicks and impressions rather than enquiries, sales and customer value, fix the reporting before changing the budget.

Google Is Testing Payments to Websites for AI Answers

Google has confirmed it is testing payments to some websites when their content shapes answers in AI Overviews, AI Mode and the Gemini app. The AI contribution pilot runs through Search Console, Google’s free tool for website owners.

Digiday first reported the pilot, and Search Engine Land and Search Engine Journal have covered it since. Google only pays when it judges that content significantly shaped an answer. The pilot is invite-only and aimed at publishers. What matters is that Google now treats content that informs an AI answer as valuable, even when nobody clicks through.

What should your business do?

Look at the content you already pay to produce and ask:

‘What does this page tell a potential customer that they could not get from ten competitor websites?’

Useful answers might come from:

• your own experience
• completed projects
• pricing factors
• common customer questions
• specialist knowledge
• mistakes you regularly help customers avoid.

New Research Suggests Nobody Can Guarantee Where AI Cites You

A new research paper, not yet peer reviewed, tested how one AI search agent chose which web pages to credit when answering 130 questions. The agent was built on OpenAI’s GPT-5.4.

The page shown first was cited 85.1% of the time, against 42.8% for the page shown fifth. But when the researchers swapped the order of two pages supporting the same fact, most of that effect disappeared. Top pages were cited more mainly because they were more relevant, not because of where they appeared.

Asking the same question again also changed whether a page was cited in about one case in seven. The authors present this as a warning, not a tactic, and the study says nothing about Google rankings.

What should your business do?

You do not need to change anything because of this research. If AI visibility matters to your business:

• Check a few questions potential customers genuinely ask.
• See whether your business or competitors appear.
• Repeat the checks over time rather than reacting to one result.
• Be cautious of anyone guaranteeing that an AI platform will recommend or cite you.

ChatGPT Tests Adverts That Open a Conversation With a Business

OpenAI is testing Sponsored Agents. They let someone who clicks an advert in ChatGPT start a conversation with an AI agent run by that business. The test is limited to selected advertisers in the US.

Watch Video Here.

OpenAI’s example is a shopper asking whether an advertised dining table would fit their room. The conversation is clearly labelled, kept separate from ChatGPT’s own answers, and can end with a link to the business’s website.

OpenAI also added three things:

• AI tools for creating adverts.
• An optional setting that rewrites advert copy to suit each conversation.
• Integrations with HubSpot and Shopify.

Its Shopify app is live for US merchants and reaches other markets where ChatGPT Ads run from 23rd September. No pricing or performance data has been published.

What should your business do?

There’s nothing to switch on yet. This is a US-only test.

1. Ask your team to list the ten questions customers most often ask before buying, then check your website answers each one. An AI agent would need exactly the same information.
2. If you work in finance, healthcare or legal services, get compliance sign-off before anyone lets AI rewrite your advert wording.

Google’s Voice Search Gets a More Capable AI Model

Google released Gemini 3.8 Live on 15th September, and it now powers Search Live in the Google app. Search Live lets people tap a Live icon, ask a question out loud and hear a spoken answer. They can then ask follow-up questions. Links appear on screen for anyone who wants to read more, and a text transcript is available.

Google says the new model can give step-by-step troubleshooting help, and people can switch languages mid-conversation. Search Live already works with the phone camera as well as voice. Availability depends on region and language.

The practical change is in how customers search. Someone asking a spoken question hears one answer with a few links on screen, rather than scanning a page of results and choosing where to click.

What should your business do?

You do not need a separate voice-search strategy. Instead, look at your main service pages and ask whether they clearly answer:

• Who is this for?
• How much does it cost, or what affects the price?
• How quickly can you help?
• Do you cover my area?
• What happens after I enquire?
• Why should I choose you?

If those answers are missing or difficult to find, improving them helps customers whether they use traditional Google Search, Search Live or another AI tool.

Google Ads Can Now Dub Video Adverts Into 33 Languages

Google Ads is rolling out Video Ads Dubbing in Asset Studio, its built-in tool for creating adverts. It uses AI to translate and dub existing video adverts into 33 languages and locales. It is free for selected advertisers, and availability appears limited for now.

It could save the cost of re-recording an advert for every market. For businesses advertising only to UK customers in English, it changes nothing.

What should your business do?

If you sell internationally, ask whoever manages your Google Ads whether the feature is available in your account.

If you test it:

• start with one or two adverts;
• have a fluent speaker check the result;
• make sure the voice and wording still sound right for your business.

Google Extends New European Search Results to Local Businesses

This change affects searches made in the European Economic Area. The UK is not part of the EEA, so searches here are not affected.

On 18th September, Google updated its documentation so that two new results sections in the EEA now cover local business searches. One shows listings from approved directories and comparison sites that send Google a data feed. The other appears alongside it and shows the businesses themselves. Businesses don’t need to send Google any extra data to appear there.

What should your business do?

If you also serve customers in EU countries, such as the Republic of Ireland, check your website clearly says which services you offer there, the areas you cover and how to get in touch. Google says businesses can appear in the new results without sending it any extra information, so a clear website is what counts.

OpenAI’s Maths Breakthrough Claim Is Disputed

OpenAI says an unreleased AI model has solved the Navier-Stokes problem, using up to 10,000 AI agents working for 88 hours. It is one of seven Millennium Prize Problems set by the Clay Mathematics Institute in 2000, each with a $1 million prize.

The claim is contested. NYU professor Tristan Buckmaster alleges that OpenAI’s result may have drawn on unpublished research he was doing with mathematician Levent Alpöge, who works for Anthropic. Buckmaster says the pair had been putting their drafts into OpenAI’s Codex tool throughout the project. OpenAI has acknowledged that it started work on the problem after hearing rumours of their progress.

OpenAI denies that its researchers or AI agents saw their work. It has also said it cannot rule out that anonymised data from their use of its products helped improve its models. No evidence made public so far shows that OpenAI copied the mathematicians’ work, and the proof itself still needs to be checked by other mathematicians.

What should your business do?

The mathematics is unlikely to affect your business. The wider lesson probably does.

AI can produce work that looks detailed and confident without removing the need to check where information came from. If your team uses AI for proposals, reports, customer advice, technical work or published content:

• decide who checks the finished work;
• verify important figures and claims;
• be clear about what confidential information staff are allowed to enter into AI tools.

OpenAI Launches ChatGPT for Financial Services

OpenAI launched ChatGPT for Financial Services on 10th September. It is a version of its workplace product for investment banking and equity research teams, built with Morgan Stanley and Evercore. It includes data from providers such as PitchBook and LSEG News, and links figures and claims back to their sources so users can check them. Pricing hasn’t been published.

The product is aimed at large financial institutions, not most SMEs. It does show where business AI is heading, towards tools built for a specific industry that show where each fact came from.

What should your business do?

If you run a regulated finance firm and your team is starting to use AI for client work, speak to your compliance adviser now, before it becomes an everyday habit.

Key Takeaways

• WordPress 7.1.1 fixes 11 security issues, and WordPress sites should update now.
• Google Ads’ new spend benchmark gives useful context, but it isn’t a budget target.
• Google is paying a small group of publishers when their content shapes AI answers, with no action needed for most businesses.
• New research suggests AI citations can’t be reliably engineered, and results change from one run to the next.
• ChatGPT is testing adverts that open a conversation with a business’s AI agent, in the US only.
• Google’s Search Live now runs on Gemini 3.8 Live, making spoken search more conversational.
• Google Ads can dub video adverts into 33 languages for selected advertisers.
• Google’s new local business results in the EEA don’t affect UK searches.
• OpenAI’s maths claim is disputed and unverified, and it is a prompt to check what your team puts into AI tools.
• ChatGPT for Financial Services is aimed at large financial institutions, not SMEs.