Tips Tuesday – Security Concerns, AI Search Flops, Cookie Plugins

Tips this week include:

• WordPress 7.1.4 security release
• Follow up on major attacks
• More attacks to come – prep now
• UpdraftPlus update
• Cookie plugin workshop follow up
• Google lost their shirt on AI Search
• What will become of Google Search now?
• Adjustments to poisoned SERPs
• Technical SEO still reigns
• Opt out of all AI training with one line
• Discord is replacing Reddit in Search
• How to read YouTube’s new metrics
• Hot topics get views and make money
• Is the AI bubble bursting?
• Is Grok throwing in the towel?
• New and updated Webmaster tutorials
• WordPress security nonce issue

Security Tips

WordPress 7.1.4 Released

This rolled out last week.

It has 22 security fixes in it. So ensure your site has auto updated to it.

Follow Up on Major Attacks

Last week had us all jumpy over the 19 major security hacks.

Some of it was software (PHP) and some of it was infrastructure.

For a couple of days I noticed that my internet connections were slow or glitchy. Clients reported some odd things happening too.

All of that glitchy was because the internet itself was under attack, specifically the major hubs and routers. 

Cloudflare did an excellent job of rerouting traffic through unaffected hubs. But when you had to pull directly from the host, like when you’re logged into your site, that does not get rerouted. And that’s why we were seeing some glitchy on our own sites.

The worst of those software attacks are behind us for now. And no WordPress sites have been reported as affected by the PHP issue, so that’s great. Hosts did a fantastic job of getting their servers updated with the patches as soon as they became available.

And the person who leaked the PHP vulnerabilities before the patch announcements were made public has been identified and has apologized. It was an honest mistake, but one that I bet he doesn’t make again for fear of reprisal on unethical disclosure, not to mention several Asian banks having to just close for a day due to them being the first in line for hack attempts once word of the leak spread.

More to Come – Prep Now

But, the infrastructure attacks continue.

In the past several weeks hackers have successfully gotten into water and electrical grid systems in both the US and EU. Those may have just been probe attacks, as few things were actually shut off or harmed except for some military base freezers.

And then freezers in several EU countries got hit on Monday, forcing them to throw out their supplies.

I think we do need to be prepared for more disruptions.

I’m not sure how long or crippling they could be.

You may want to prep for a lack of power or internet connection the same way you would if a bad storm was coming your way.

I’m not trying to fear monger on the back of the “90 day blackout” rumors. 

I’m saying that I’ve seen these types of “probe” attacks before and they were followed by massive DDoS attacks and disruption of services.

Plugin Tips

Updraft Update

The latest UpdraftPlus version turns off the checkbox for UpdraftCentral. 

This is what they mentioned in the changelog:

“TWEAK: Disabled the option to automatically add websites to UDCentral upon connection by default. Users must now explicitly enable this option if they want websites to be added automatically upon connection.”

So, if using the paid version, ensure you’re on at least 2.26.14.26. I’m not sure what the free version’s latest is.

And, if you’re a site audit client or webmaster member, you may want to go back through the tutorial to ensure you don’t have a newly issued key.

FYI, it may or may not show your password on the Premium tab. It’s okay if it doesn’t. They remove it for security reasons.

Cookie Plugin Workshop

Last week I met live with my site audit clients and webmasters to go over my research for the cookie plugins we use. 

My advice is to go fully GDPR compliant now, even for non-EU visitors.

We looked into:

• Exactly what full compliance means
• How to test your site – without using any other site’s testers
• What ad agencies cover and don’t with their free built-in cookie managers
• What plugins conflict when you run ads too
• Pricing and features on several CMP plugins

We’re doing group research on a few of the plugins we looked at during the live session.

So, be sure to see your respective Facebook group for those conversations.

SEO Tips

Google Lost Their Shirt on AI Search

Google’s parent company, Alphabet, lost $500 billion in market value last week.

The lion’s share of that was due to how AI Summaries and AI Overviews ate into their ads business.

I have zero sympathy for them.

Remember when they rolled out Rich Snippets? They literally quoted content from our sites without even the courtesy of a backlink. Finally, enough entities put pressure on them and they added the citation, but it was just a little link icon at the end – no text for where it came from.

And then they repeated that exact same mistake when AI Summaries and AI Overviews rolled out. It took entities screaming again to get a linked citation added.

And now they are crying because folks who search are getting the answer they need and then leaving Google before seeing or clicking on an ad.

That’s the same money they’ve been stripping from us all this time.

Karma’s a bitch, ain’t it?

I think they just had a really big case of FOMO. With the craze around ChatGPT, everybody was screaming at Google to release their own AI chatbot – and Google just kept delaying until the din got so loud that they tried it.

Lesson learned.

And maybe now they will return to their core business model, which is being the biggest Search Engine on the planet.

But I don’t expect them to go back to what it was prior to the HCU rollout, though.

What Will Become of Google Search?

I honestly don’t know.

First, they rolled out the Helpful Content Update that basically wiped out visibility for many of the best blogs with trusted user content. Now they just rely on big brands, which have squeezed out smaller sites.

And then they were slow to jump on AI search results, but felt they had to in order to keep pace with the novelty of folks using ChatGPT and just getting answers.

Then they decided that they were not a search engine, they were an answer engine and they wanted to keep folks on Google for as long as possible, which is the exact opposite of the business model they ran so successfully for decades.

And now they have been hit with the double whammy of their AI Summaries spitting out crap info that no one can trust, and combating with other AIs scraping them to protect their own ranking and Summaries.

I know one thing above all else with Google. They are profit oriented.

At one time they had THE best search engine where they made money and so did the content creators who worked hard to please readers and Google. And every business was happy to run ads with them.

Now, nobody is making money with Search.

Plus, there is no search engine that has a viable ranking system for the content results they deliver – including those kluged together by AI.

Frankly, I think Google Search needs new leadership that hasn’t drunk the AI Kool-Aid and can right this ship.

And maybe we’ll see that when the AI rocket burns itself out of spending-spree fuel.

Adjustments to Poisoned SERPs

Recently I reported that Google is borking their own SERPs (Search Results Pages) when they detect another AI scraping them. They call it “poisoning” the results.

Major Search agencies, like SEMRush have had to jump through a bunch of hoops to ensure the data they are showing their paid users is accurate.

What this tells me is that you and me have zero hope of making sense of the mixed data we see in Google Search Console. The last 2 times I checked, the data had made big swings. So, I’m not sure what to believe anymore with which one of them is accurate.

Technical SEO Still Reigns

John Mueller emphasizes again that tweaking your methods for short-term AI SEO gains will not work. In fact, they are backfiring now. 

I saw this coming and it is precisely why I chose not to cover these techniques in the DIY SEO course.

John says fundamental Technical SEO is still the key.

And that’s exactly why it’s the first thing we cover every new year in the DIY SEO course.

Opt Out of All AI Training with One Line

Anthropic has proposed a new directive that can be added to our robots.txt file that would tell all of the major LLMs not to train on our content.

Sounds great!

But the problem is, each of the LLMs has stated that they would treat that line differently from one another.

So, no standard for us yet. But I’ll be keeping my eyes on it as this develops.

And of course, this new line will only affect future training anyway. It does not address the lion’s share of content they have already scraped and stolen.

Discord is Replacing Reddit in Search

Google made a very expensive deal with Reddit so that they could crawl the questions and replies and display them on Search.

Well, I’m not sure what happened to that deal, but Reddit says traffic from Google has dropped significantly. They are now closing the doors and requiring folks to sign up for an account to see that info, even when they click over from a Google Search result.

To take its place, Discord is opening its content to be crawled and found in Search, at least on their public servers.

The server admin of each Discord server will be the one in charge of these settings and will decide if their content will be shown on the server’s publicly available web page that Discord is providing.

I’m seeing this as an amazing opportunity for some folks to get high visibility on a niche topic.

I wish this could be an alternative to a Facebook group, but honestly, I find the discussions hard to follow. Unless folks start a Thread, it’s impossible to sort out just the replies to a post from all the other posts that have been made since. On the other hand, if a reply is made, it shows up in the general discussion again, instead of being hidden as a reply to a single post. 

This is the main reason I have kept Facebook Groups that are related to my courses and services.

Video SEO Tips

How to Read YouTube’s New Metrics

Social Media Examiner has an excellent article on the changes YouTube made to Views and the metrics to actually watch now.

It even covers how to make sense of mentions and traffic you may be getting from AI chatbots too.

Well worth the read.

Hot Topics Get Views and Make Money

You may recall me reporting recently that my review of the Vevor Lawn Sweeper is bringing in a bunch of watch time on my Heartwood Art YouTube channel. I showed a graph of where folks are joining the video and it starts in the middle with my live demos.

Well, the leaves are starting to fall and folks are searching that specific product for reviews like crazy right now.

That video took off like a rocket and I’m making a bunch of money from YouTube as well as from the affiliate sales on both Amazon and Lowe’s. The Lowe’s link is part of the new Product Partnership that YouTube has and the commissions on those are NICE – way higher than Amazon.

Folks, anytime you can get in on something seasonal, especially if it is a hot product – DO IT!!!!

My income for the month has tripled.

I expect it will fall off by the end of November, but that will be just in time for me to review the new cordless snow shovel I plan to get.

AI Tips

Is the AI Bubble Bursting?

Well, sort of, and sort of not.

It’s more like the frenzied pace of “bigger and better” is starting to meet the reality of consumer demand and profitability.

Remember when folks camped out overnight in front of electronics stores just to be the first to get the latest iPhone?

And now all of the service carriers are simply giving away the latest phones – from any manufacturer, and without a trade-in required. Even the EU sees the light and is now requiring phones to ship with longer-lasting, replaceable batteries.

Earlier this month the tech sector of the Chinese stock market crashed. And last week the same thing happened in the U.S. stock market.

A full $2 trillion dollars in valuation just went POOF globally.

The blame is squarely on sky-high AI spending. It’s unsustainable.

So, to me, this is the market correction that was needed to slow the pace and re-evaluate where any profit will ever come from in this industry.

The only sector that has maxed out on the models we already have is hackers.

The idea of “whoever wins AI, wins” doesn’t just apply to having the most powerful engines – that’s akin to having the most nuclear weapons. 

Whoever learns to leverage the power that already exists, even on more limited AI models, wins – and that’s going to be an industry thing for advancements in robotics, medicine, biology, chemistry, engineering, mathematics, and software.

So, I don’t see the AI bubble totally bursting.

What I do see is an opportunity in this market crash to catch our collective breath with everything AI related.

That includes investors rethinking their strategies too.

Is Grok Throwing in the Towel?

Elon posted on X that Grok is becoming too expensive to run. 

This was in response to users complaining that they are hitting their token limits too quickly.

So, will it be the first major LLM to shut down? Or will they just charge more?

Webmaster Tips

New and Updated Tutorials

Last week, in the Webmaster Training course, I released a whole batch of new and updated tutorials for Cloudflare.

That included a new one for removing a site from RUM. I don’t know why Cloudflare decided to randomly put some sites on it, especially since we explicitly said no already. And they sort of hid how to get to it to turn it off. I even had to put in a support ticket for them to update their own documentation on it.

So, my info is more up-to-date then theirs.

WordPress Security Nonce Issue

One of my clients has tons of book titles and she offers a filter at the top of the page to sort them by category.

Well, when we clicked on one of those category links, nothing changed on the page.

The issue ended up being that the cache was not properly clearing.

I contacted Emre, the dev of WP Fastest Cache, and he already had a tutorial on it. 

In short, the issue is with the security nonce that WordPress adds that doesn’t allow the caching to be properly cleared often enough. 

The fix was just a quick statement added in WP Fastest Cache to clear that WP rule at regular intervals.