September 2026 AI SEO Update: 12 Confirmed Changes, 5 Hands-On Tests

Author's Note: Every item below is a first-party product change or a multi-source-confirmed event from July 29 to September 13, 2026. This month we added a rule: where a change could be tested from the outside. A robots.txt, a redirect, a Lighthouse run, a deeplink. We ran the test on our own properties before writing about it, and we report the result even where it doesn't flatter us. Where a platform confirmed something, we say so. Where we're inferring, we say that too. Twelve changes, twelve sources, four hands-on tests, one uncomfortable self-audit.

The 12 Verified Changes:

1. Google rolls out the August 2026 spam update in 2 days 16 hours. The third spam update this year (Aug 18–21).

2. Google confirms it now wraps result links in google.com/goto redirects to block scrapers and AI engines (Aug 26).

3. AI Overviews dynamically expand into AI Mode–style answers and drop the "Show more" button for some queries (confirmed Aug 28).

4. Search Console's Generative AI performance report reaches every site worldwide. Impressions only, no clicks (Aug 31).

5. Google ships a "Add as preferred source" button any publisher can embed (Aug 20).

6. Google rewrites site reputation abuse enforcement for the EEA no manual actions there, still manual actions everywhere else (Aug 28).

7. Cloudflare launches Bot Preference Sync (auto-written robots.txt) and BotBase for operators, two weeks before its September 15 default flip (Aug 21 & 28).

8. ChatGPT Ads passes a $1B run rate and opens self-serve in eleven MENA countries but not the UAE or Saudi Arabia while OpenAI documents a fourth crawler, OAI-AdsBot, that ignores robots.txt (Aug 11 & 31).

9. Anthropic takes its browser-use tool out of beta and launches Claude Fable 5.1 and Mythos 5.1 with 1M-token context (Aug 19 & Sep 1).

10. Next.js 16.3 ships faster SSR, root params for [lang] routes, prefetch bundling, and version-matched docs for AI coding agents (Aug 3).

11. Bing Webmaster Tools retires its SOAP/POX APIs; REST is the only path (Aug 31).

12. GA4 adds Dashboards and its AI Assistant channel still doesn't count Perplexity (Sep 9).

    ---

Key Terms Glossary:

• Passthrough Redirect: A search-engine-owned URL that sits between a result link and the destination page, resolving to the real URL only when clicked.

• Dynamic Expansion: Google's term for an AI Overview that opens to its full AI Mode–style length automatically, without a user tap.

• Bot Preference Sync: Cloudflare's feature that writes crawler rules into your robots.txt from category-level (Search / Agent / Training) settings in its dashboard.

Every SEO tool you pay for reads Google's results page the same way you do: it fetches the HTML and pulls the links out. On August 26, Google confirmed it had quietly started breaking that assumption. The link in the result is no longer your URL. It's a google.com/goto token that only becomes your URL when a real person clicks it.

That's the shape of this month. Google didn't change what ranks. It changed who is allowed to see what ranks, how much of the page an AI answer is allowed to occupy, and for the first time told the whole world how many times AI features showed your pages. Meanwhile Cloudflare started editing robots.txt files on behalf of a few million domains, and OpenAI opened its ad platform to most of the Arab world while skipping its two richest markets.

We went beyond reading the announcements. We pointed the tests at our own sites. Some of the results are below, unedited.

1. The Spam Update Nobody Needed to Explain

Google's third spam update of 2026 ran in under three days and said nothing new.

The August 2026 spam update started on Tuesday, August 18 at roughly 12:30 pm ET and finished on August 21 around 4:50 am, a rollout of two days and sixteen hours. It's global, covers all languages, and Google's own description is that it is "a normal spam update" with nothing specifically new the same language it used for the June 24–26 update we covered in July.

That makes three spam updates in one calendar year, which is itself the signal. Google is running its spam classifiers more often and finishing faster. Independent case-study coverage after the rollout clustered around the usual targets scaled content abuse, programmatic AI pages, thin affiliate sites but that's post-hoc pattern-matching, not a Google statement, so we label it inference.

• The Cadence Shift: When spam updates were annual, a hit was an event. At three a year with sub-72-hour rollouts, a hit is a recurring audit. If you run a GCC lead-gen site with city-by-city programmatic pages ("SEO agency Riyadh", "SEO agency Jeddah", "SEO agency Dammam"…) with the same body text swapped, you are now being re-graded roughly once a quarter.

• Spam Update Takeaway: Speed is the story, not scope. Definition: a spam update adjusts Google's automated spam-detection systems; it is not a core update and does not re-weight quality signals across the index.

2. The Link That Isn't Your Link

Google confirms google.com/goto passthrough redirects — and our own test hit a wall.

On August 26, 2026, Google confirmed to the trade press that it can replace a result's destination URL with one that starts with google.com/goto, which acts as a passthrough before redirecting to the real page. Google's stated reason: "a technical measure to protect against abuse of its search results and protect its services" in plain terms, to make it harder for third-party tools, scrapers, and AI engines to harvest the SERP.

The mechanism matters for anyone who buys rank-tracking data. With plaintext links, a scraper could parse a thousand destination URLs from one HTML fetch. With /goto, each result needs a second request back to Google just to learn where it points slower, more expensive, and a very clean fingerprint when one client resolves hundreds of links in sequence. SerpApi said on September 5 it had deployed a fix and was again returning direct site URLs. SE Ranking and Semrush reported no impact on position tracking; Ahrefs acknowledged a temporary data inconsistency.

• What we tested. We fetched a Google results page from the command line with a desktop Chrome user-agent and a UAE locale gl=ae) and searched the HTML for google.com/goto. Result: zero matches because Google served a JavaScript shell with no results in it at all. That's the honest finding: from a non-browser client, Google now returns nothing parseable, which is the same outcome as /goto by a different route. We couldn't confirm the redirect format from outside a real browser session, and we're not going to pretend we did.

The Visibility Shift: For fifteen years the SERP was a public document that anyone could read programmatically. It is becoming a rendered experience that only a logged-in, JavaScript-executing human (or Google's own agents) can see in full. Your ranking data now depends on your vendor's ability to keep up with Google's anti-scraping engineering, not on Google's willingness to be read.

For MENA teams this has a second-order effect. Arabic rank tracking was already thinner and noisier than English — fewer tools, smaller SERP-feature coverage. Any vendor cost increase from /goto resolution lands hardest on the low-volume, high-value Arabic keyword sets that GCC brands actually care about. Ask your tool vendor, in writing, whether their Arabic-locale tracking was affected and when it was patched.

3. The Overview That Swallowed the Page

AI Overviews now expand on their own, and the "Show more" button is gone for some queries.

Google confirmed on August 28, 2026 that "for some queries, AI Overviews may dynamically expand for topics where our systems determine it's most useful for people." In practice the AI Overview snippet is replaced by a full AI Mode–style answer, the "Show more" button disappears, and the "Ask anything" follow-up box loads by default. Organic results are pushed below the fold. Google also confirmed a courtesy behavior: if the user has already started scrolling, the expansion is cancelled so they don't lose their place.

Google did not say what percentage of queries this affects or whether it will expand. The same month's reporting from Google's own metrics put AI Overviews at more than 2.5 billion monthly users and AI Mode past one billion. So whatever the percentage, the base is enormous.

Dynamic Expansion Takeaway: The "Show more" tap was the last user-initiated barrier between an AI answer and your listing. Definition: dynamic expansion is Google's term for an AI Overview that opens to full length automatically when its systems predict the user wants depth.

This is where the July piece's "binary citation gauntlet" becomes literal. In an expanded Overview, being cited is the click opportunity; being ranked #3 organically below it is a scroll-and-a-half away. Our recommendation for Arabic content hasn't changed but the urgency has: lead every H2 section with a 40–60 word direct answer in the language the query will be asked in, because that's the chunk the expanded Overview is built from.

4. The Impression Ledger Goes Global

Search Console's Generative AI performance report reaches every site with one deliberate hole.

Google's statement is unambiguous: "As of August 31, 2026, we've rolled out these insights to all websites worldwide." The Generative AI performance report first announced June 3 shows impressions from AI Overviews, AI Mode, and generative features in Discover, sliced by page, country, date, and (for Search) device. It ships with a property-level opt-out control; page-level controls are scheduled for March 2027 under regulatory requirements.

What it does not show: clicks. You can see that your Riyadh pricing page appeared in 4,000 AI Overviews last month; you cannot see whether any of those became a session. Properties with very few AI impressions may not see the report at all.

What this unlocks. Combine it with Bing's Citation Share (June) and GA4's AI Assistant channel (May), and for the first time a MENA brand can build an AI-visibility funnel entirely from first-party data: shown (GSC), cited (Bing), visited (GA4). It's three dashboards instead of one, and none of them agree on definitions, but the era of estimating AI exposure from screenshot samples is over.

The Measurement Shift: A year ago "AI visibility" was a slide agencies made with a scraped sample and a confidence interval. Now it's a report your CFO can open. That also means the excuse is gone: if you can't show which pages earn AI impressions in Saudi Arabia versus the UAE, it's no longer because the data doesn't exist.

5. The Button Google Wants on Your Site

A one-line embed lets readers make you a preferred source in Top Stories and AI Mode and your subdomain qualifies.

On August 20, 2026, Google added a custom "Add as preferred source" button to its documentation. Two lines of HTML render it:

```html

<script async src="https://news.google.com/swg/js/v1/publisher.js"></script>

<div google-add-preferred-source-btn></div>

```

There is also a plain deeplink — https://www.google.com/preferences/source?q=example.com — for sites that don't want Google's script on the page. Content from a preferred source appears with a "preferred" badge in Top Stories, and Google's documentation says it also carries into AI Mode and AI Overviews where those features are available. The feature is global, all languages, and only domain-level or subdomain-level sites are eligible.

What we tested. We hit the deeplink with q=blog.ghayth-abdallah.com. It returned 200 with no redirect, which is the eligible-subdomain behavior — a subdomain blog qualifies on its own, separate from the root domain. We have not yet shipped the button; it's now on the deployment list for this site and for client publishers.

Preferred Source Takeaway: This is the only Google feature in 2026 where the user, not the algorithm, decides you're an authority. Definition: a preferred source is a publication a signed-in user has chosen to prioritize in Top Stories and AI Mode results.

For Gulf news and B2B publishers with a real returning audience — newsletters, WhatsApp broadcast lists, LinkedIn followings — this is the cheapest authority signal available this year. It costs one paragraph asking readers to tap a button. The button supports a data-lang override; check Google's supported-language CSV before assuming Arabic labels render.

6. The Policy That Splits at a Border

Site reputation abuse: no manual actions in the EEA, business as usual everywhere else.

On August 28, 2026, Google updated its spam policies page: "We have made changes applicable to the policy in the European Economic Area (EEA)." For content shown to EEA users, third-party pages hosted on a strong domain (the "parasite SEO" pattern) can now "be categorized as separate from the main domain but won't be subject to the impact of manual action," so that the content "is ranked in a consistent way against other content of the same nature." EEA sites also gain access to a mediation-based alternative dispute resolution scheme and reconsideration requests with guaranteed response windows.

Outside the EEA — which is every MENA market — the text is explicit: "relevant pages may be subject to a manual action when they appear in Search results shown to users outside the EEA."

The Jurisdiction Shift: Google's spam policy is no longer one policy. The same coupon subdomain on a Gulf newspaper's domain is ranked on its own merits when a user in Berlin searches, and can trigger a manual action when a user in Dubai searches. This is the first time an SEO risk profile has depended on the searcher's regulatory zone rather than the site's.

We think — inference, not confirmed — that this widens the gap between what European-headquartered agencies tell GCC clients and what actually applies to them. If your agency's playbook was written for EEA enforcement, it is now wrong for your market.

7. Cloudflare Starts Writing Your robots.txt

Bot Preference Sync, BotBase for operators, and a default flip two days away.

In July we told you Cloudflare split crawlers into Search, Agent, and Training and would block Training and Agent by default on ad-carrying pages from September 15, 2026. That date is now two days out, and Cloudflare spent August building the plumbing around it:

Bot Preference Sync (August 21)

Available "to all customers from the Free tier to Enterprise." Set a policy per category — Allow, Block on ad pages, Block everywhere, or Disallow, and Cloudflare prepends matching User-agent / Disallow rules to your robots.txt, one line per bot, pulled from its BotBase directory. It's enabled by default for new customers. Existing customers on the older managed-robots.txt are prompted to review and confirm before anything is written. Complex custom robots.txt files are out of scope; you can disable sync and edit by hand.

BotBase for Operators (August 28)

Bot operators including AI companies now get a dashboard to submit and track their bots, declare behavior models, and be listed in the directory that Sync draws from. Cloudflare's stated rule for mixed-use crawlers: if a site blocks Training, a crawler that also trains must offer an opt-out mechanism and URL-level visibility, or it's blocked outright — which is why Googlebot, Applebot, and Bingbot get caught when Training is disallowed.

The September 15 defaults

New domains, new customers, and existing Free-tier customers get the new defaults (Training and Agent blocked on ad pages, Search allowed) with an opt-out window in Security settings before the 15th.

What we tested. We pulled the live robots.txt from a Cloudflare-fronted Next.js e-commerce store we operate in Lebanon (the same store from our Arabic case study). Server header: cloudflare. Prepended Cloudflare rules: none. The file is exactly what we deployed, an explicit Allow list of eighteen named AI and search crawlers, including OAI-SearchBot, ClaudeBot, PerplexityBot, and Google-Extended. That's the expected state for an existing customer who hasn't confirmed the prompt, and it means our allow-everything stance survives the September 15 flip unchanged. But it also means we can't lean on Cloudflare to keep the bot list current; that's on us.

The Delegation Shift: robots.txt was the one SEO file that was always hand-written. Cloudflare is turning it into a rendered output of a dashboard setting — for the majority of the web that never touched it. The upside is that millions of sites get a coherent AI-crawler policy for the first time. The downside is that "Block Training" in a UI now silently blocks Googlebot for anyone who doesn't read the footnote.

For GCC publishers on Cloudflare Free — which is a lot of Arabic news and directory sites — the September 15 default is the most consequential change on this list. If you carry AdSense units and do nothing, Agent crawlers are blocked on those pages by default. Whether that's good depends on whether you'd rather be quoted by an agent or paid by an impression, and that's a business decision, not an SEO one.

8. Ads Inside the Answer — Except in the Two Markets That Matter Most

ChatGPT Ads hits $1B run rate, lands in MENA, skips the UAE and KSA, and brings a crawler that ignores robots.txt.

Three separate facts, three separate sources:

Scale. OpenAI reported on August 11, 2026 that ChatGPT Ads reached a $1 billion annualized revenue run rate in under 200 days, alongside launches in the UK, Mexico, Brazil, Japan, and South Korea, a multi-product carousel format for product-feed campaigns, an oCPC objective, custom audiences, and a "Maximize Results" default bid strategy.

MENA. On August 31, self-serve Ads Manager opened to eleven countries in the region: Algeria, Bahrain, Egypt, Iraq, Jordan, Kuwait, Lebanon, Morocco, Oman, Qatar, and Tunisia. The UAE and Saudi Arabia are not on the availability table, which requires the advertiser's legal entity to be registered in a listed country. Agency partners and direct sales remain routes for larger budgets, and regional coverage notes that a group entity registered in a listed country (Bahrain, Qatar, Kuwait, Oman) is a workable path.

The crawler. OpenAI's bots documentation now lists four user agents, not three: OAI-SearchBot (search, respects robots.txt), GPTBot (training, respects robots.txt), ChatGPT-User (user-initiated fetch, robots.txt does not apply), and the new *OAI-AdsBot**, which exists to "validate the safety of web pages submitted as ads on ChatGPT" and, per the documentation, is not governed by robots.txt.

• Ads Takeaway: ChatGPT is now a paid channel in most of the Arab world. Definition: ChatGPT Ads are sponsored placements shown alongside or within ChatGPT answers, bought through OpenAI's self-serve Ads Manager in eligible countries.

• The Two-Track Shift: Until this month, "AI visibility" in the Gulf meant one thing: get cited. Now it's two tracks — earn the citation, or buy the placement — and the paid track opened everywhere in MENA except the two markets with the highest ad budgets. We expect (inference) UAE and KSA to follow within a quarter; the pattern matches how Meta and TikTok sequenced the region. Until then, the organic citation is still the only ChatGPT visibility a Dubai or Riyadh brand can get without an entity abroad.

9. The Agent Gets a Browser

Anthropic ships browser use, computer use exits beta, and two new frontier models arrive.

Anthropic's release notes for the window contain three items relevant to how the agentic web reads your site:

• August 19: the computer-use tool left beta computer_toolset_20260801) and a new browser-use tool launched browser_toolset_20260801) for client-side browser control. The same day, Claude Managed Agents gained allowed_domains / blocked_domains controls for web search and fetch.

• August 10: Claude Sonnet 5's introductory pricing ($2 / $10 per million tokens) was made permanent; the scheduled September 1 increase was cancelled.

• September 1: Claude Fable 5.1 and Claude Mythos 5.1 launched with a 1M-token context window, 128k max output, always-on adaptive thinking, and cache-read pricing cut to $0.25 per million tokens.

Anthropic's crawler documentation, checked this week, names exactly three user agents: ClaudeBot (training), Claude-User (user-initiated retrieval), and Claude-SearchBot (search quality). All of which respect robots.txt including Crawl-delay.

What we tested — and failed. Our own blog's robots.txt explicitly allows Claude-Web and Anthropic-AI. Neither appears anywhere in Anthropic's current documentation. They're legacy names from 2023–24 that we carried forward without checking. The User-agent: * line makes the mistake harmless in practice, but the file we publish as a knowledge hub on AI crawlers has been advertising two bots that don't exist. That's fixed this week, and it's a good example of why "allow everything explicitly" lists rot faster than a clean wildcard.

The Browser Shift: A browser-use tool that's out of beta means production agents that click, scroll, and read your DOM the way a person does — which is what Article 2's "Agentic Browsing" score measures. Duplicate element IDs, broken accessibility trees, and layout shift aren't hypothetical failures anymore; they're what a Fable 5.1 agent hits when a procurement manager in Riyadh asks it to compare three suppliers' spec sheets.

10. The Framework Catches Up to the Crawlers

Next.js 16.3: faster SSR, root params for bilingual routes, and docs that ship to your coding agent.

Next.js 16.3 landed on August 3, 2026, the largest release since 16.0. The items that touch search and AI retrieval directly:

Faster server-side rendering

The App Router rendering layer moved from web streams to native Node.js streams. Vercel's benchmark: up to 22% more requests handled under load, with no application code changes. That's TTFB headroom for every crawler and RAG fetch.

Root params

import { lang } from 'next/root-params' reads a root-level [lang] segment from any Server Component without prop-drilling. For an Arabic/English site, that's the difference between threading a locale through forty components and calling one function — and it works inside use cache scopes.

Prefetch bundling and immutable assets

Small prefetches are automatically batched, cutting request count; immutable static assets can be reused across deploys. Both reduce the kind of network churn that shows up as poor Speed Index on mobile.

Better ISR

Routes omitted from generateStaticParams can now serve an instant loading shell to the first visitor and upgrade to the prerendered page in the background — the tradeoff between "show a shell" and "block the first visitor" is gone.

Versioned docs for AI agents

next dev writes a version-matched AGENTS.md block pointing at the bundled docs in node_modules, and Vercel retired its separate Next.js Skills. If your team uses coding agents (we do), this is the first framework to hand them the right documentation without a plugin.

What we tested. This blog runs Next.js 16.1.5. We have not upgraded yet; the migration to Cache Components is scoped for October. We're flagging our own lag deliberately — Article 2 criticized agencies for not practicing what they preach, and the same standard applies here.

Next.js Takeaway: 16.3's wins are latency and i18n ergonomics, not a ranking signal. Definition: root params are dynamic segments above the root layout — like [lang] — that 16.3 exposes to any Server Component via next/root-params.

11. Bing Closes an Old Door

SOAP/POX APIs retire; REST is the only way into Bing Webmaster Tools programmatically.

On August 31, 2026, Microsoft retired the Bing Webmaster Tools SOAP and POX APIs. Every method already exists in the JSON/HTTP REST API with, per Microsoft, identical functionality. If an internal reporting script or an older agency dashboard stopped pulling Bing data in the first week of September, this is why.

It's a small item with a large regional footprint. As we noted in July, Bing is the default surface on a substantial share of enterprise-managed Windows devices across the GCC, and Bing's AI Performance report is still the only first-party Citation Share number in existence. Any automation that reads it now has to speak REST.

12. GA4 Gets Dashboards, Keeps Its Blind Spot

New reporting UI on September 9 — and Perplexity still isn't an AI Assistant.

GA4's September 9, 2026 release added Dashboards with drag-and-drop visualization and new report types. Earlier in the window: custom conversion lookback windows (August 11), a campaign-data import validation report (August 10), and a diagnostic for missing gbraid / gad_ identifiers (July 30).

What we checked. The live Default Channel Group documentation, as of September 13, still lists the AI Assistant channel's recognized sources as ChatGPT, Gemini, DeepSeek, Copilot, and Grok. Perplexity is still absent. Our July advice stands: build a manual Perplexity segment into every property, or your AI Assistant total is structurally undercounted.

The Self-Audit: What Our Own Lighthouse Said

We ran the tests we tell clients to run. Here's the number.

Article 2 on this blog set a standard: 95+ to 99+ across PageSpeed, Accessibility, Best Practices, and SEO, consistently. We ran Lighthouse 13.4.1 (mobile emulation, local headless Chrome, September 13, 2026) against this blog:

Home page

Performance 81 · Accessibility 89 · Best Practices 100 · SEO 100. LCP 3.2 s, CLS 0.006, TBT 270 ms, Speed Index 6.1 s, 659 KiB total.

The July article page

Performance 76 · Accessibility 91 · Best Practices 100 · SEO 100. LCP 2.1 s, CLS 0, TBT 630 ms, root document 1,470 ms. Accessibility failures: color contrast, heading order, link-in-text-block, label/content name mismatch.

Two of four categories are perfect. Two are not, and Performance is fifteen to twenty points under the bar we set publicly. Caveats that are true but don't excuse it: a single local lab run on a Windows machine is noisier than PageSpeed Insights' data-center run (which we couldn't use the anonymous API quota was exhausted for the day), and the 1.47-second server response on the article page looks like a cold edge function, not steady-state. The CrUX field data will settle it. But the honest version is: we would not accept a 76 from a client, so we don't get to accept it from ourselves. The fixes — TBT from a script we can defer, the contrast ratio on secondary text, heading order in the article template are scheduled before the next post in this series.

The Mirror Shift: The point of a "verified changes" series is that verification cuts both ways. If we only ran tests on competitors, this would be a marketing page.

The Quiet Corrections

Three places where this blog's earlier claims need an update.

Cloudflare's September 15 scope. In July we wrote that "new domains onboarding to Cloudflare" get the new defaults. Cloudflare's August materials widen that to new customers and existing Free-tier customers, with an opt-out window. If you're on Free and read our July piece as "doesn't apply to me," re-read it.

Our robots.txt. As described in §9, this blog's robots.txt allowed two Anthropic user agents that Anthropic doesn't document. Corrected. The current, verified list is ClaudeBot, Claude-User, Claude-SearchBot; OpenAI's is OAI-SearchBot, GPTBot, ChatGPT-User, OAI-AdsBot.

The 95+ standard. Article 2's promise is the standard we hold clients to. This month's lab run shows this blog at 76–81 on mobile Performance. We're not softening the standard; we're reporting the miss.

What didn't need correcting: the GA4 Perplexity gap (still open), the FAQ-schema retirement (still retired), and the llms.txt verdict (still an ingestion aid with no confirmed citation weight — Next.js now publishes a /docs/llms.txt, which is adoption on the publisher side, not a platform commitment to read it).

The G.A.I.T.H. Framework™ Integration

Twelve unrelated events, five pillars.

• G (Generative Intelligence): Dynamic expansion means the first 40–60 words under each H2 are the unit of competition. We now draft that answer chunk first — in Arabic and English separately, not translated — and build the section around it.

• A (Analytics Integration): The funnel is now first-party end to end: GSC Generative AI report (shown) → Bing Citation Share (cited) → GA4 AI Assistant channel plus a manual Perplexity segment (visited). We're wiring all three into every client's monthly report, and re-pointing any Bing automation to the REST API.

• I (Intent Mapping): ChatGPT Ads in eleven MENA countries changes the intent map for commercial queries: a Kuwait or Qatar brand can now test whether an AI-answer placement converts before betting on organic citation for the same query. UAE and KSA brands can't yet — so their organic citation work carries more weight, not less.

• T (Technical Precision): Three concrete tasks came out of this month's tests: ship the preferred-source button, fix the two retired crawler names, and close the Lighthouse gap. Plus the Cloudflare rule for any client with ads: decide Search / Agent / Training explicitly before the 15th, and remember Training-block catches Googlebot.

• H (Human Psychology): The preferred-source button is a psychology feature disguised as a technical one. It only works if a reader trusts you enough to tap it. That's earned in the writing, not the markup — which is why this series reports its own failures.

FAQs

What is the google.com/goto redirect and does it hurt my rankings?

Since late August 2026, Google can wrap a search result's link in a google.com/goto passthrough URL before sending the click to your page. Google confirmed it on August 26 as an anti-abuse measure aimed at scrapers and third-party tools. It does not change rankings, and the click still lands on your page — but rank-tracking tools that read destination URLs from raw HTML broke until they patched (SerpApi shipped its fix on September 5).

Did Google remove the "Show more" button from AI Overviews?

For some queries, yes. Google confirmed on August 28, 2026 that AI Overviews can "dynamically expand" into a full AI Mode–style answer with the follow-up box loaded by default, pushing organic results further down. Google has not said what share of queries this affects. If a user has already started scrolling, the expansion is cancelled.

Can I see AI Overview and AI Mode impressions in Search Console now?

Yes. As of August 31, 2026, the Generative AI performance report is available to all websites worldwide, showing impressions from AI Overviews, AI Mode, and generative features in Discover by page, country, date and device. It does not show clicks, and properties with very few AI impressions may not see it.

What does Cloudflare's Bot Preference Sync actually write to my robots.txt?

When you set a policy for the Search, Agent, or Training categories in the Cloudflare dashboard, Cloudflare prepends matching User-agent / Disallow rules — one per bot from its BotBase directory — to your robots.txt. It's on by default for new customers on every plan including Free; existing customers are prompted to confirm, and until they do nothing is written. We verified this on one of our own Cloudflare-fronted stores: no synced rules present yet.

Are ChatGPT Ads available in the UAE and Saudi Arabia?

Not through self-serve Ads Manager as of September 13, 2026. The August 31 MENA expansion covers Algeria, Bahrain, Egypt, Iraq, Jordan, Kuwait, Lebanon, Morocco, Oman, Qatar, and Tunisia. The UAE and KSA are absent from the availability table, which requires the advertiser's legal entity to be registered in a listed country. Agency and direct-sales routes exist for larger budgets.

Should I upgrade to Next.js 16.3 for SEO reasons?

Upgrade for the performance and i18n wins, not for a ranking signal — there isn't one. 16.3 handles up to 22% more SSR requests under load, bundles small prefetches, adds root params so a [lang] segment is readable from any Server Component, and lets non-prerendered ISR pages serve an instant shell. All of those reduce the latency and rendering friction that AI retrieval and Core Web Vitals both punish.

Sources

1. Google Search Status Dashboard — August 2026 spam update (Aug 18–21, 2 days 16 hours).

2. Search Engine Land / SERoundtable — Google confirms google.com/goto redirects (Aug 26); SerpApi fix (Sep 5).

3. Search Engine Land — Google confirms dynamic AI Overview expansion (Aug 28).

4. Google Search Central — Generative AI performance report worldwide rollout statement (Aug 31); Search Console Help "Generative AI performance report (Search)".

5. Google Search Central documentation — Preferred sources (custom button added Aug 20; page updated Sep 10).

6. Google Search Central documentation — Spam policies, site reputation abuse (EEA changes, Aug 28).

7. Cloudflare Blog — "Say it once: Introducing Bot Preference Sync" (Aug 21); "BotBase for Operators" (Aug 28); Cloudflare changelog "New options to manage AI traffic" (Jul 1, Sep 15 defaults).

8. OpenAI — "A milestone in expanding access to AI" (Aug 11); OpenAI bots documentation OAI-AdsBot); Campaign Middle East — "ChatGPT Ads arrive in MENA" (Aug 31).

9. Anthropic — Claude platform release notes (Aug 10, Aug 19, Sep 1); Anthropic support — "Does Anthropic crawl data from the web".

10. Vercel — Next.js 16.3 release post (Aug 3).

11. Microsoft Bing Webmaster — SOAP/POX API retirement (Aug 31), via SERoundtable.

12. Google Analytics Help — "What's new in Google Analytics" (Jul 30, Aug 10, Aug 11, Sep 9); Default Channel Group definitions (AI Assistant sources).

Hands-on tests (September 13, 2026): robots.txt and response-header probes on blog.ghayth-abdallah.com, ghayth-abdallah.com, and a Cloudflare-fronted Lebanese store; Google SERP fetch from a non-browser client; preferred-source deeplink check; Lighthouse 13.4.1 mobile runs on two blog URLs.