Rankings moved sharply for two days and Google has confirmed nothing, while the trackers meant to measure the swing are themselves in doubt. Elsewhere, a Discover filter, a robots.txt parser, and a vendor breach all show how much depends on rules that nobody sees until they bite.
Hidden Gates: Movement Without Confirmation
Two stories describe visibility changing before anyone can point to a cause. One is an unconfirmed swing, the other a filter that decides eligibility before ranking begins.
- Google Rankings Swing Hard Oct 20 and 21, No Update Confirmed Tracker readings and a surge of practitioner reports point to sharp movement, but the call that a change is underway is one analyst’s read, not Google’s. A documented case of three major trackers disagreeing on the dates of a drop and recovery makes any single volatility chart hard to trust.
- Google Discover Quietly Drops Stale Pages Before Ranking A Google research paper describes a two-filter gate that removes superseded and decayed items before the ranker sees them, and says it has run for two years. The results are Google’s own measurements, so which publishers lost eligibility remains unknown.
Say It Exactly: Crawlers Reward Precision and Ignore the Rest
Crawlers do what the signal literally says, not what the site owner meant. A maintenance window and a robots.txt file both fail on small details.
- Google: Answer Crawlers With a 503 During PHP2Shell Patch Downtime Sites taking PHP servers offline should return a temporary-error response, which means it has to come from outside PHP, through DNS, a CDN rule, or another host. The cover only holds for a day or two before indexing risk grows.
- Google: Unparseable robots.txt Lines Are Dropped Silently A rule written in plain English is discarded without an error, and AI crawler blocks work only when they name the published token exactly. Crawling permission and training use are separate questions, and a disallow line answers only the first.
Control Slips Away: Stolen Keys and Switched-On Defaults
In both stories, the party who bears the risk has the least say in how it starts. The fix for each begins with a deliberate check of settings and accounts.
- UpdraftPlus Vendor Breach Hands Attackers Keys To Connected WordPress Sites Attackers who got into the vendor’s own site took connection keys that let them push rogue plugins and hidden admin accounts to linked sites. The patch revokes the old keys but leaves any damage already installed, so a manual audit is still needed.
- ChatGPT Ads Turns On AI Rewrites by Default October 30 Self-serve campaigns will let OpenAI rewrite headlines, resize images, translate text, and adjust destination URLs, with ads running unreviewed unless the advertiser opts out first. The notice cites no performance data for its relevance claim.
Today’s Quick Hits
- Google’s Sharing-Controls Page Now Lists AI Control Beside Robots Tags No new control launched, but snippet and indexing directives now sit on the same help page as the Search generative AI control.
- Mueller: Raw Brackets and %5B/%5D in URLs Count as Different URLs Google crawls both forms and may dedupe them, so filter-parameter sites should pick one format across links, canonicals, and sitemaps.
- Google Ads Rewrites Smart Bidding Learning Page, Caps Status at Seven Days The new page says the Learning label lasts seven days at most and lists which edits do and do not trigger it, with budget and target changes among the safe ones.
- Merchant Center Now Lists Fast Shipping Delivery Targets by Country Eight markets now have a stated delivery window, running from one day in Japan and New Zealand to four in Brazil.
- Performance Max May Be Getting an Asset Group A/B Test Toggle A setting that locks an asset group while creative edits are tested has been spotted, but Google has confirmed nothing, so treat it as a sighting.