SEO plugin shipped malware, check your site
Some paid copies of the Rank Math WordPress plugin downloaded on 15 and 16 October carried a backdoor, and the company says passwords and API keys should be treated as exposed. Google also quietly started showing site owners how often they appear in AI answers.
Read the whole week in one goRank trackers are mostly fixed, but not fully
Why your traffic moved
Rank trackers may still show drops that never happened
Google has been returning incomplete or unreliable results to rank tracking tools across the industry, so keywords can look like they dropped or vanished when nothing moved. SE Ranking says it has corrected its historical data and fixed most cases, but roughly 2% of tracked results are still affected. Mordy Oberstein posted the update.
This can cause keywords to show false drops or appear as not ranking, even when their actual positions haven’t changed.
Who this affects: Anyone who watches their Google positions in a paid rank tracking tool.
- Report any ranking that looks wrong to your tool's support.
- Our take: confirm drops in Search Console before changing anything.
Getting into AI answers
Google now shows how often you appear in AI answers
Google has added a Generative AI performance report inside Search Console (Google's free traffic report) showing how often your pages appear in AI Overviews and AI Mode. Alex Groberman says John Mueller confirmed it is rolling out gradually, and the report also breaks results down by page, country and device. It counts appearances, not clicks.
There is one big limitation, though: this is impression data as opposed to clicks data.
Who this affects: Anyone with a website who wants to know if AI answers use their pages.
- Open Search Console and look for the Generative AI report.
- Give it a few days if you do not see it.
Do not do this
A popular SEO plugin shipped malware last week
Some paid copies of the Rank Math WordPress plugin, version PRO 3.0.123, downloaded on 15 and 16 October carried a backdoor (hidden access for attackers). Rank Math says sites that activated one of those copies should treat passwords and API keys as exposed. If that is your site, change them today.
RankMath accidentally backdoored everyone's site
Who this affects: WordPress sites that installed or updated Rank Math Pro on 15 or 16 October.
- Check if you downloaded Rank Math Pro 3.0.123 those days.
- Change site passwords and rotate API keys if you did.