Three of today’s stories describe software taking an action nobody clicked to approve, and Google spent the weekend adjusting both what it punishes and how much of the page it keeps for itself.
Rules Rewritten: What Google Will Punish, And What It Will Bother Telling You
Two changes to Google’s enforcement posture landed together, and both are about the gap between what Google does and what it explains.
- Google Drops EEA Manual Actions for Parasite SEO From August 30 Google stops issuing site reputation abuse manual actions across the European Economic Area, following a European Commission mandate, and says it will rank the offending section independently instead. Manual actions already issued in the region will be lifted. That changes what a parasite SEO penalty actually costs a host domain in Europe: the violating subfolder keeps competing, it just stops borrowing the authority of the domain it sits on.
- Google: Named Updates Signal Transparency, Not Action Items John Mueller drew a line between updates Google announces so the industry knows something moved, and updates that arrive with something a site owner can actually do. When no policy post accompanies the announcement, that absence is the message rather than an oversight. It also means the standard post-update scramble to find a fix is, by Google’s own account, often looking for something that was never published.
The Page Keeps Shrinking: More Answer, Less Result
Google is expanding what it shows before a searcher reaches a link, and clarifying which of its personalization surfaces publishers can actually influence.
- Google Lets Some AI Overviews Expand Fully, No Click Needed Certain AI Overviews now open at full length on arrival instead of waiting for a tap on the expand control. On those queries every organic listing starts further down the page, and the change is invisible in Search Console, which reports no separate figures for AI Overviews. A publisher losing clicks to a taller answer block has no first-party way to identify which queries it happened on.
- Google Confirms Preferred Sources, Discover Feed Are Separate Systems A Google search engineer separated three personalization tools that practitioners routinely discuss as one thing. They carry different stakes for publisher visibility, and only one of them involves a reader deliberately choosing your site. Treating them as a single lever leads teams to optimise for the wrong one.
Acting Without Asking: A Plugin, An Account, And A Booking Button
The through-line of the day sits here. In three separate cases, software did something consequential on a site owner’s behalf before anyone agreed to it.
- Rival Developer Says Rank Math Grants Itself Admin Access Sybre Waaijer, who builds a competing SEO plugin, says opening Rank Math’s support tab hands its parent company an administrator credential before the consent prompt appears. Rank Math has not publicly answered his description of the flow, and its changelog for the release calls it a security update, a characterization Waaijer contests. This is an allegation from a direct competitor and it is unproven, which is the reason to check the plugin’s user list on sites you run rather than the reason to dismiss it.
- Anthropic Locks Out Claude Accounts Hit By Session-Stealing Malware Anthropic is forcing sign-outs and stripping saved payment cards when it detects that infostealer malware has captured a Claude session. Any team running AI tooling from a shared or unmanaged machine sits inside that blast radius, and an agency with a pooled account can lose access mid-deliverable without the compromise having happened on its own hardware.
- Reserve With Google’s Book Button Lands In Search, PMax Ads Merchants who already published a local booking link are getting an automatic Book button on Search and Performance Max, with no opt-in step. The control that turns it off sits inside Google Ads rather than the Business Profile, which is not where a local team would think to look. It is the second time in a week that a booking surface switched itself on for advertisers who never requested it.
Today’s Quick Hits
- Google Search Indexing Stalls For 80 Minutes On August 28 Fresh articles from major publishers fell out of results for roughly eighty minutes before recovering without any action from the sites affected.
- Google Trials A Sign-In Prompt Inside AI Mode Answers A spotted test drops a Google account sign-in button partway through an AI Mode response, which would make part of the answer conditional on being logged in.
- Google Spells Out Which Favicon Formats It Will Index A vague documentation pointer became a fixed list of seven accepted file types, and one format many sites ship did not make the list.