Rank Math Plugin Secretly Granted Itself Admin Access on WordPress Sites

Following the August 10th issue's report that the Generative AI Performance Report had 'quietly rolled out to all users worldwide,' Search Engine Roundtable, Search Engine Journal, and Search Engine Land have now issued coordinated, on-the-record confirmations of that global availability — elevating what was an unannounced rollout into an official milestone. The more significant new development this week: Google has simultaneously rolled out AI search controls to all users globally, allowing site owners to actively manage their presence in AI-generated results. This control layer was not available at the time of prior coverage. Together, the performance reports and control levers represent the first complete official measurement-and-management framework for AI search visibility. SEOs who benchmarked initial data following the August 10th rollout now have both the data and the dials to act on it.

Google's VP of Product for Search, Robby Stein, confirmed via X that Gemini 3.8 Flash has been integrated into AI Mode, arriving just weeks after Gemini 3.7 Flash. But early user feedback is alarming for publishers: according to Search Engine Roundtable, the new model is significantly less likely to cite sources or link out compared to previous versions — a pattern that, if it holds, would further erode referral traffic from Google's AI search surface.

The citation pullback is not a minor footnote. For SEOs and content publishers who have been building strategies around earning AI Mode citations, this development represents a meaningful regression. The rapid model iteration pace — two Flash versions within weeks — also signals Google's aggressive push to upgrade AI Mode's underlying intelligence, with each model swap potentially resetting citation behavior unpredictably.

Following the August 24th issue's report that Google was testing the removal of the 'Show More' button to push full AI Mode-style responses by default, that behavior has now hardened into a broader SERP change: Google is making AI Overviews fully expanded by default for some queries — pushing traditional organic results further down the page without requiring users to opt into AI Mode. This is the next stage of the pattern documented last week. Separately, new data reported by Search Engine Journal shows that AI Mode product selection operates largely independently from the standard product carousel — AI Mode rarely surfaces the same products or sellers as regular Shopping results for identical queries, meaning traditional Shopping visibility does not carry over. Google's new Weather AI integration — AI-generated answers replacing blue links for weather queries — is the latest concrete example of AI displacing organic results across additional query categories.

Following last week's report that Google added flight price tracking, points/miles display, and direct hotel booking via Google Pay to AI Mode, Google is now aggressively monetizing the surface itself. Search Engine Roundtable reports inline shopping carousel ads are appearing within AI Mode results alongside a single ad unit at the bottom — the first significant paid placement expansion into AI Mode's core experience. Separately, Google Ads Liaison Ginny Marvin confirmed a 'small experiment' serving standard Search campaigns with restrictive match types inside AI Mode — opening the door to conventional PPC ads in what was previously a largely organic environment. Together, these moves mark AI Mode's transition from a clean AI experience toward a more heavily commercialized SERP, a meaningful structural shift for both paid and organic search strategies.

New research covered by Search Engine Journal challenges the narrative that users are abandoning Google for AI tools: they are in fact using both simultaneously. However, the dual-usage pattern is producing fewer traditional searches and significantly fewer click-throughs to websites — a finding with direct implications for organic traffic forecasting. Meanwhile, Moz published data on how Google Gemini uses 'grounding queries' to fetch real-time facts, arguing that SEOs should stop chasing zero-volume keywords and instead optimize for machine-readable content that AI models can retrieve and cite.

The most significant trust story of the week: serious allegations emerged that the Rank Math SEO plugin — used by millions of WordPress sites — was silently creating WordPress Application Passwords and granting Rank Math admin-level access to sites when users opened the Help & Support section. Critically, this occurred without any user consent or notification, according to Search Engine Journal. The allegation originated with the developer of The SEO Framework plugin, who flagged the behavior on social media.

By mid-week, Rank Math had paused the controversial feature and issued a statement acknowledging what it called a 'serious consent failure' — while simultaneously announcing the feature would return in a revised form. The dual admission (we did it wrong, but we're bringing it back) has drawn continued scrutiny from the WordPress SEO community. SEOs managing sites with Rank Math installed should audit their WordPress Application Passwords immediately and monitor for updates on the planned return of the feature.

A federal judge in Virginia ruled that Google's ad tech business will not be broken up, despite the court's prior finding that Google operates a monopoly over its ad technology platforms. However, the judge did order Google to cease practices that artificially depress ad rates for web publishers — a remedy that stops short of divestiture but could meaningfully affect publisher revenues if enforced. According to Search Engine Roundtable, this marks the second time Google has avoided a court-ordered breakup (the first being the broader search monopoly case).

This ruling is significant for the ecosystem of publishers who depend on AdSense and programmatic ad revenue — sectors closely intertwined with SEO-driven traffic monetization.

Two major EU regulatory stories this week. First, the EU has officially designated ChatGPT as a 'Very Large Online Search Engine' under the Digital Services Act, following OpenAI's report of approximately 159.1 million average monthly search recipients. The designation triggers new compliance obligations for OpenAI and formally acknowledges ChatGPT's status as a legitimate search competitor.

Second, Google published detailed eligibility rules, data samples, and key dates for its European Search Dataset Licensing Program — a requirement under the EU's Digital Markets Act stemming from Google's 'gatekeeper' designation. The program mandates Google share ranking, query, click, and view data from EEA Search with competing search engines. Both developments reflect an accelerating regulatory push to reshape the search market in Europe.

Google's John Mueller delivered two significant clarifications this week. First, Google officially stated that ranking recovery after SEO issues are fixed can take months, not days or weeks — a direct confirmation for SEOs managing post-penalty or post-algorithm-update recovery campaigns. Mueller explained that fixing the underlying cause of a ranking drop does not guarantee rankings will return promptly, resetting expectations for site owners expecting quick rebounds after technical fixes.

Second, Mueller confirmed that the disavow tool 'does have effects' — responding to a site owner who saw rankings drop after submitting a disavow file. While acknowledging the tool has 'its place and time,' the confirmation is notable given widespread industry skepticism about whether the disavow tool still functions meaningfully in Google's current link evaluation systems.

John Mueller addressed two additional practitioner questions this week. On the topic of a sitemap manipulation technique being used to force daily crawling, Mueller responded with Google's official stance — cautioning against the approach and clarifying expectations for crawl frequency management via sitemaps. The technique had attracted attention in SEO forums as a potential crawl budget workaround.

On a separate question about old outbound links pointing to domains that have changed ownership and now host shady content, Mueller was unequivocal: Google will not penalize a site for such links. His comment — 'the web is full of turmoil' — underscores Google's pragmatic approach to legacy link profiles, offering reassurance to owners of aged sites with inherited link structures they cannot control.

Search Engine Roundtable flagged a freshly observed anomaly: publishers are reporting that content is disappearing from Google's News tab despite being successfully crawled, indexed, and visible in standard Search results. The issue appears intermittent — content sometimes reappears in the News tab much later — and Search Engine Roundtable confirmed it was able to replicate the behavior, though it seems completely random. Google has not yet commented. News publishers relying on the News tab as a traffic source should monitor their Search Console performance reports for unexplained impression drops.

Two significant data points on how content is being surfaced in AI and forum-style results. A citation study by Ten Speed, covered by Search Engine Journal, found that product pages account for 24% of AI citations in B2B contexts — nearly six times the 4% share held by Reddit and YouTube combined. The data was verified through six rounds of fact-checking, lending it credibility beyond typical AI citation research.

Separately, new Ahrefs data — highlighted in both Search Engine Journal and the Ahrefs Digest — reveals that public Facebook Group posts now appear in 38% of Google's Discussions & Forums results, making Facebook the #2 forum source behind Reddit and ahead of Quora. This is actionable for SEOs advising brands on where to invest in community content for search visibility.

Three complementary frameworks this week extend the GEO measurement and authority conversation built across prior issues. Lumar's ongoing GEO series — which in the August 17th issue distinguished page eligibility, chunk retrieval, and citation as separate optimization stages — this week adds a further refinement: authority in generative search functions as a binary filter rather than a ranked score. Content either clears the threshold to enter consideration or it doesn't, which reframes how SEOs should pursue authority signals.

New data from Search Engine Journal adds a practical complication: Claude and Claude Code behave very differently when browsing the web — crawling at different rates, referencing different brands, and visiting different page types. Treating all AI crawlers as equivalent is a strategic error for multi-platform GEO. Moz's grounding queries analysis rounds out the picture: since Gemini uses grounding queries to fetch real-time facts, machine-readable, factually structured content has more retrieval value than low-volume keyword targeting — a point that dovetails with the measurement frameworks Aleyda Solis published last week.

Two updates this week build on prior coverage. On the Markdown question: John Mueller has now shared first-hand experimental results testing whether AI crawlers actually request Markdown-formatted content from websites — adding rare empirical data to a debate that has been largely theoretical in GEO coverage so far. Mueller's findings offer direct insight into AI crawler behavior that goes beyond the llms.txt v2 coverage from the August 17th issue.

On listicles: Kevin Indig's Growth Memo follows up on the August 24th issue's finding that Google is demoting 'commodity listicles' across 5.32 million search results. This week Indig adds a new data point — listicles appear in top-10 results for 55.1% of queries — and explores which structural and content elements differentiate high-performing listicles in both traditional and AI search environments. The combination of demotion risk (last week) and format durability (this week) makes the full picture more nuanced than either finding alone.

Following the August 17th issue's report that ChatGPT advertising was rolling out to 31 European countries, OpenAI this week released a significant product update to the ChatGPT Ads platform itself: an Ads Manager plugin, custom audience improvements, conversion matching, new ad unit formats, and budget pacing controls — the infrastructure layer behind the geographic expansion reported two weeks ago. Search Engine Roundtable also confirmed that shopping results in ChatGPT appear limited to merchants who submit product feeds, a critical eligibility requirement for e-commerce brands.

On the content side, the Ahrefs Digest flagged a narrowing of the sources ChatGPT searches — a trend that, combined with last week's finding that Reddit content is fetched but systematically filtered out before citation, suggests OpenAI is actively tightening its source pool. Brands not represented on ChatGPT's contracting reference sources risk invisibility in its outputs.

Microsoft this week made login mandatory for direct Copilot access, though the requirement does not yet apply to Copilot Search answers surfaced within Bing Search results — suggesting Microsoft is prioritizing frictionless AI search access over gated AI assistant access. Separately, Bing is testing the removal of site names from search result snippets, showing only URLs — mirroring a similar test Google ran approximately a year ago. If adopted broadly, the change could affect branded visibility and CTR in Bing SERPs.

Following three weeks of coverage of the August 2026 spam update — the initial rollout and completion (August 17th issue), the post-official-end-date volatility and AI content targeting findings (August 24th issue) — Google VP of Engineering Rajan Patel has now stepped in with an unusually public endorsement: the search spam team is well-resourced and actively fighting spam. The statement, delivered publicly and coinciding with the update's aftermath period, represents a notable escalation in Google's communications posture on spam quality. Unlike prior weeks' technical details about the update's scope, this week's signal is organizational — a senior executive visibly staking out Google's commitment to spam enforcement heading into Q4. SEOs in competitive or content-heavy niches should continue monitoring for volatility, as Patel's statement suggests sustained enforcement activity beyond the named update window.

A notable cluster of Google platform bugs hit this week. Search Engine Roundtable confirmed that Google Analytics showed zero traffic across all installs for September 1, 2026, affecting main reporting charts — a widespread data gap that could distort week-over-week comparisons for any site with reporting tied to that date. Google Discover simultaneously experienced loading failures and significant slowdowns, with users reporting articles failing to load or loading after extended delays. A separate bug was also identified in Google's job search feature, with new job listings failing to appear in results for at least a week, potentially affecting structured data performance for recruitment-focused sites.

SpeedCurve updated its synthetic testing infrastructure to Chrome 148 (up from 138), Firefox 153 (up from 135), and Lighthouse 13.4.1 (up from 12.8.0). The company flagged that these updates may cause baseline shifts in performance data due to hardware, browser optimizations, and methodology changes. Specifically, Chrome 148 introduces lazy-loading for video, which may reduce measured page weight. SEOs and developers using Lighthouse scores for Core Web Vitals monitoring should account for potential metric fluctuations when comparing historical data.

Google Business Profiles appears to be testing a fifth verification method — submitting a photo of the business location — adding to the existing options of phone/text, email, live video call, and postcard. The new photo-based option could simplify verification for businesses with a clear physical presence. Local SEO practitioners managing GBP listings should test eligibility for the new method when it becomes available.

Two stories this week captured the dual pressure AI is placing on the industry. A report highlighted by The Guardian and Search Engine Journal found that job listings for AI content cleanup have surged 87%, reflecting growing demand to fix poor-quality AI-generated content — while freelancers report being underpaid for the complexity of the work. The trend illustrates a new content quality gap: AI creates volume, humans clean up the mess.

On the technology trajectory side, an interview with Google DeepMind leadership revealed that Gemini is being repositioned from a conversational chatbot to a proactive AI agent capable of using tools and completing multi-step tasks. This strategic shift has downstream implications for how Google Search and AI Mode will evolve — moving toward an experience where users delegate tasks rather than enter queries, fundamentally changing what 'search' means.

The FTC, joined by 22 states, filed suit against Amazon this week, alleging the company manipulated its ad auction systems to overcharge advertisers by more than $20 billion. The complaint centers on alleged changes to Amazon's auction mechanics that inflated advertiser costs. While primarily a paid advertising story, the case has downstream implications for Amazon's advertising ecosystem and the competitive dynamics of product search — a space where Amazon competes directly with Google Shopping.