Table of Contents
Welcome to this week’s SEO News Roundup from Pathfinder Marketing by Saijo George. Below is everything worth your attention from the past week – new AI models, Google spam policy changes, AI Mode tactics, a nasty WordPress supply-chain attack, and a handful of Chrome and commerce updates that quietly change how your pages get treated. We’ve covered what happened, what we think of it, and linked through to the original source for each so you can dig deeper.
Anthropic releases Claude Opus 4.7
Anthropic has shipped Claude Opus 4.7, its new flagship model, and it’s available across all Claude products and the API. The headline improvements are stronger instruction-following, better high-resolution vision (images up to ~3.75 megapixels, roughly 3× the previous limit), better file-system-based memory across long multi-session work, and notable gains on difficult coding tasks. Anthropic also introduced a new xhigh effort level between high and max for finer control of reasoning depth.
One thing worth flagging before you switch: Opus 4.7 uses an updated tokenizer, so the same input can map to roughly 1.0-1.35× more tokens than Opus 4.6, and it tends to think more at higher effort levels. We’ve started using it in our own workflows and can confirm it burns through more tokens – so if you’re cost-sensitive, measure the difference on real traffic before committing. Pricing is unchanged at $5/M input and $25/M output. If you’ve been running it already, drop your experience in the comments – we’re keen to hear how it’s performing in day-to-day SEO work.
Google changes how spam reports are handled – and what gets sent to the offending site
This is an important one for anyone who files spam reports. Glenn Gabe flagged that Google has updated its spam reporting documentation (around 14 April 2026) with two material changes:
- Google may now use your spam report to issue a manual action against a site. Previously Google’s position was that spam reports were not used for manual actions.
- If a manual action is issued, Google will send the entire text you wrote in the report, verbatim, to the site owner – to give them context on why the action was taken.
The exact wording Google added to the Report Spam page is:
Google may use your report to take manual action against violations. If we issue a manual action, we send whatever you write in the submission report verbatim to the site owner to help them understand the context of the manual action. We don’t include any other identifying information when we notify the site owner; as long as you avoid including personal information in the open text field, the report remains anonymous.
The practical takeaway: if you’re going to report spam, be factual and specific, and don’t include anything in the open text field you wouldn’t want the site owner to read – no names, no email addresses, no phone numbers, no rants. Google will strip their own identifying info about the reporter, but if you self-identify in the text, that goes through too.
Steve Toth’s trick: use Google AI Mode to map your buyer’s journey
Steve Toth shared a clever tactic for reverse-engineering the conversations AI Mode has with your potential customers. The core idea: AI Mode doesn’t just give one answer – it proposes follow-up questions at the bottom that segment users into branches, and each branch can surface different brands and content. If your content doesn’t map to those branches, you’re invisible at that step of the journey.
His workflow:
- Run a broad query in AI Mode (his example was “Best Project Management Software”). Ignore the first answer – it’s generic. Look at the follow-up questions.
- Right-click the browser tab and duplicate it. This copies your exact AI Mode search state so you can fork the conversation without losing your place.
- Take each branch separately – in one tab answer “Team of 20,” in another “Agile,” in another “Waterfall.” Each one produces new follow-up questions.
- Keep branching by duplicating tabs again, and you end up with a map of every sub-journey AI Mode offers for your category.
It’s a manual but effective way to find the conversational intent behind your money keywords. You could also pair this with a Claude skill to scrape and structure the branches automatically – Steve’s video walks through the full workflow if you want to see it in action.
OpenAI launches a new bot: OAI-AdsBot
Pieter Serraris spotted that OpenAI has quietly added a new crawler to its lineup: OAI-AdsBot. Per OpenAI’s documentation, this bot visits landing pages submitted as ads in ChatGPT to validate that they comply with OpenAI’s ad policies and to help decide when to serve those ads. Crucially, content retrieved by OAI-AdsBot is not used for training.
This is the third OpenAI user-agent you’ll see in your logs, sitting alongside OAI-SearchBot (for ChatGPT search) and GPTBot (for training). Each is independent – blocking one doesn’t block the others. If you don’t want ad landing-page validation traffic on your site, you can block it in robots.txt:
User-agent: OAI-AdsBot
Disallow: /
The catch: if you’re running ads through OpenAI and block this bot, your ads probably won’t serve, because the validation crawler can’t reach your landing page. Most publishers will want to allow it.
Google launches a desktop Search app for Windows
Google has released a Google app for desktop, currently Windows 10+ only and English-only at launch. It behaves similarly to the ChatGPT and Claude desktop apps – press Alt + Space to summon it, ask anything, and get AI-powered answers with follow-up questions and helpful links.
The more interesting bits are the multimodal pieces. Lens and screen-sharing are built in, so you can ask questions about any part of your screen – a specific window or the entire screen. It can also search across apps and files on your computer, plus your Google Drive, from the same search box. AI Mode in Search is baked in, but is not yet supported for all accounts, countries and languages.
One thing we’re watching: how traffic from this app shows up in analytics. When users click through to your site from the app, do those visits come through as direct, or is a referral passed properly? We haven’t seen a clear answer yet – worth monitoring your traffic sources over the next few weeks.
SearchPilot finds that capitalising title tags gives a surprising SEO boost – and it’s probably not CTR
SearchPilot ran a test capitalising the entire contents of the title tag (including a piped brand) on an ecommerce customer and saw a 17.5% uplift in traffic, with mobile driving a 20.4% lift. But here’s where it gets interesting – when they spot-checked live SERPs, they couldn’t find any instances of the all-caps titles actually rendering in search results. A deeper scrape of top keywords confirmed it: users almost never saw the capitalisation, and the PDPs mostly appeared in product grid features rather than the ten blue links.
So if CTR isn’t the driver, what is?
SearchPilot’s theory is that capitalisation is functioning as a signal in Google’s natural-language processing pipeline. When Google indexes a page it turns the HTML into lexical tokens, and humans use capitals for two reasons: to mark named entities (Apple the company vs. apple the fruit) and to signal emphasis – a convention going back to printed text in the 1600s and internet-era ALL CAPS shouting. Because Google’s NLP is trained on human-written text, unusual capitalisation is read as a cue about what’s important on the page.
Across all SearchPilot customers, 50% of tests involving title-tag capitalisation have been positive, and 0% have been negative – making it their most consistent winning test type. Worth A/B testing on your own clients, though they caution that fully-capitalised titles may send a less clear signal than strategic partial capitalisation.
Google introduces a new spam policy for “back button hijacking”
Google has announced a new explicit spam-policy violation: “back button hijacking.” This is the practice where a site interferes with the browser’s back button, so when a user tries to return to the previous page (usually the SERP) they get sent somewhere they didn’t intend to go – recommendation feeds, ads, pages they never visited – or they’re simply prevented from leaving.
Google’s reasoning is that this breaks a fundamental user expectation and creates a mismatch between what the user wants and what the site delivers, which falls squarely under the existing “malicious practices” category of the spam policies.
Enforcement begins 15 June 2026, giving site owners about two months to audit their own implementations and any third-party scripts, ad widgets, or content recommendation platforms that might be pushing fake history states or redirecting back-button clicks. Sites that don’t clean up can expect manual actions or automated demotions. If you run an ad-heavy publisher site or you’ve bolted on aggressive engagement widgets, this is the one to put on the audit list this week.
Google Business Profile: recurring posts are now live
For anyone managing Google Business Profiles, the long-teased “Repeat” option for Google Posts is now officially live. Announced in Google’s Small Business Bulletin, the feature adds a Repeats dropdown to Events and Offers so you can set a post to republish daily, weekly or monthly and forget about it.
This is the native version of something that previously required third-party tools. The use case Google gives is spot-on: a Wednesday trivia night, a Friday happy hour, a monthly restaurant special – set it up once and it stays current on Search and Maps on the days you specify. A small change, but for agencies running multi-location clients it’s a real time-saver and removes an excuse for inconsistent posting.
Supply chain attack: someone bought 30 WordPress plugins and backdoored all of them
Austin Ginder at Anchor Hosting published a detailed breakdown of a large-scale WordPress supply-chain attack. Someone acquired the entire “Essential Plugin” portfolio (originally built by an India-based team trading as WP Online Support) via a six-figure Flippa sale, inherited SVN commit access to 30+ plugins on WordPress.org, and planted a backdoor in them.
The backdoor was inserted in version 2.6.7 on 8 August 2025, disguised in a changelog note that claimed “Check compatibility with WordPress version 6.8.2.” It sat dormant for eight months before being activated on 5-6 April 2026. When triggered, the malicious wpos-analytics module called home, downloaded a file disguised as a core file (wp-comments-posts.php, one letter different from the real wp-comments-post.php), and injected roughly 6KB of PHP into wp-config.php. The injected code served spam links and fake pages to Googlebot only – invisible to the site owner – and resolved its command-and-control domain through an Ethereum smart contract so traditional takedowns couldn’t kill it.
On 7 April 2026, WordPress.org permanently closed all 31 Essential Plugin listings in a single day and force-pushed an update to neutralise the phone-home. But the forced update didn’t clean the injected code in wp-config.php – so any site that ran a compromised version between 5-7 April is still sitting on the payload until you go in and remove it manually.
If you manage WordPress sites, audit your fleet for any of these plugin slugs:
accordion-and-accordion-slider
album-and-image-gallery-plus-lightbox
audio-player-with-playlist-ultimate
blog-designer-for-post-and-widget
countdown-timer-ultimate
featured-post-creative
footer-mega-grid-columns
hero-banner-ultimate
html5-videogallery-plus-player
meta-slider-and-carousel-with-lightbox
popup-anything-on-click
portfolio-and-projects
post-category-image-with-grid-and-slider
post-grid-and-filter-ultimate
preloader-for-website
product-categories-designs-for-woocommerce
sp-faq
sliderspack-all-in-one-image-sliders
sp-news-and-widget
styles-for-wp-pagenavi-addon
ticker-ultimate
timeline-and-history-slider
woo-product-slider-and-carousel-with-category
wp-blog-and-widgets
wp-featured-content-and-slider
wp-logo-showcase-responsive-slider-slider
wp-responsive-recent-post-slider
wp-slick-slider-and-image-carousel
wp-team-showcase-and-slider
wp-testimonial-with-widget
wp-trending-post-slider-and-widget
If you find one installed, remove or patch the plugin, and check your wp-config.php – if the file is significantly larger than you remember (~6KB bigger), you were actively compromised and need a proper cleanup, not just an uninstall. Austin’s post has patched versions and the exact steps.
Google publishes a guide for onboarding to the Universal Commerce Protocol (UCP)
Google has added a Merchant Center help article walking through how to onboard to the Universal Commerce Protocol (UCP) – the new open standard for agentic commerce that lets agents and systems work together across the commerce ecosystem. Once integrated, you get a checkout button on eligible product listings in AI Mode on Google Search and on Gemini.
The onboarding flow is straightforward:
- Complete the technical implementation per the UCP developer guide – this has to happen before onboarding.
- Fill out the interest form.
- Once selected, you’ll get access to the onboarding experience in Merchant Center, including a sandbox to validate your UCP profile, identity linking and native checkout APIs.
Two caveats worth noting: this is rolling out gradually in the U.S. only for now, and if you’re on a third-party platform (Shopify, BigCommerce etc.), you’ll need to talk to them directly about their UCP plans. We haven’t tried this ourselves yet, but if you’ve got ecommerce clients in the US this is worth getting on the radar – other countries will almost certainly follow.
Shopify releases an AI Toolkit for agentic app development
Shopify has released the Shopify AI Toolkit, which connects AI coding tools to the Shopify platform so your agent can work with Shopify’s documentation, API schemas, code validation, and the CLI’s store execution capabilities – instead of guessing at how things are implemented.
It supports three install methods: a plugin (the recommended path, auto-updates as new capabilities ship), individually-added agent skills (pick just what you need), or connection via the Shopify Dev MCP server. It works with Claude Code, Cursor, Gemini CLI, Codex (skills and MCP only), and VS Code.
For Claude Code users, the plugin install is two lines:
/plugin marketplace add Shopify/shopify-ai-toolkit
/plugin install shopify-plugin@shopify-plugin
We haven’t had hands-on time with it yet, but if you’re building Shopify apps – or running a Shopify store and want an AI assistant that actually knows the platform – it’s worth a look.
Chrome 141 ships No-Vary-Search for the HTTP disk cache
Here’s a useful performance win hidden in the Chrome 141 release notes. Normally, adding a UTM parameter (or any query string) to a URL breaks the browser cache – the URL is treated as different, so the browser re-fetches it from origin rather than serving it from the local disk cache. That costs latency on every click from an email campaign, ad or social post.
Chrome 141 extends the No-Vary-Search response header into the HTTP disk cache. You can declare which query parameters don’t affect the actual response, and the browser will happily serve a matching cache entry across URL variations.
Typical use for tracking parameters:
No-Vary-Search: params=("utm_source" "utm_medium" "utm_campaign" "utm_content" "utm_term" "fbclid" "gclid")
Now /page, /page?utm_source=newsletter, and /page?utm_source=twitter&utm_campaign=spring all share the same cache entry. It’s a best-effort feature – not every cache will honour it – but it’s a cheap, high-leverage optimisation for any site running campaigns.
Chrome now has a hidden shopping-page classifier – and it only reads the first ~450 words
Last one, and it matters more for ecommerce than people realise. Dejan.ai reverse-engineered a shopping-page classifier that’s now shipping in Chrome. Every page you visit gets scored for whether it’s a shopping page, the score is stored in Chrome’s history database, and it feeds a user-level segmentation model. If you get classified as a “shopping user,” Chrome enables commerce features like price tracking in the omnibox, price drop notifications, shopping insights in the side panel, and shopping cards on the new tab page.
The important bit for SEO is how the classifier actually reads a page. It splits the content into 10 chunks of roughly 100 words each, then truncates each chunk to 64 tokens. Text items under 5 words get appended rather than starting a new passage. Everything beyond the first 10 passages is discarded. In practice that means only the first ~450 words of visible content reach the model – and that’s after navigation menus, cookie banners, sticky headers and hero boilerplate eat into the budget.
When Dejan tested news articles and guides, they scored zero on the shopping classifier. Amazon and actual shopping sites scored high. The takeaway for ecommerce: if your product signals (price, buy buttons, product description, specs) live below a big promotional hero or a heavy navigation stack, Chrome may never see them – and your users won’t get the commerce features that make your site stickier. Put the shopping signals above the fold.
That’s the roundup for this week. If you found this useful, share it with a colleague, and let us know in the comments which stories you want us to go deeper on next week. If there’s a format change or angle you’d like to see more of, tell us – we read everything.
![How much does SEO cost in Australia [year]? 4](https://www.pathfindermarketing.com.au/wp-content/uploads/2024/07/SEO-Pricing.webp "How much does SEO cost in Australia [year]? 4")
![Best Perth SEO Agencies in [year] [Ranked + Compared] 5](https://www.pathfindermarketing.com.au/wp-content/uploads/2026/07/blog1.webp "Best Perth SEO Agencies in [year] [Ranked + Compared] 5")
