September was the month the free routes started closing. Facebook put a meter on links, Google’s answer box took another bite out of clicks, and a WordPress flaw went from patch to live attack in five hours. Three different companies, one direction of travel. Here is what held up, what fell over, and what you should do about it now that the dust has settled.
The three biggest changes
Facebook started charging business pages to post links
We first reported this on 21 September as a test affecting some pages. It is not a test any more. Meta has expanded the restriction so that a free business page gets two link posts a month, and beyond that you need a Meta One subscription. Publisher pages stay exempt. Meta’s own figures soften the blow slightly, since only 1.3 percent of widely viewed American content carried an external link in the first quarter of this year, so organic link reach was already poor. The change simply makes that official.
Why this matters for your business: Your Facebook page is no longer a reliable way to send people to your website for free. Spend your two monthly link posts on the things that actually sell, a promotion or a new service page, and stop burning them on blog posts. Put your effort into the channels you own instead. An email list costs you nothing per send and nobody can cap it.
A WordPress core flaw went from patch to live attack in five hours
CVE-2026-87902 was the single worst event of the month for anyone running a website. It is a remote file inclusion flaw in WordPress core, rated 9.2 out of ten. We covered the patch on 23 September and the fallout on 26 September. Attackers reverse engineered the fix and had working exploits running within five hours. Roughly 350,000 sites took webshells. CrowdSec tracked about 30,000 attacking IP addresses across five days. Since then the flaw has been added to the CISA known exploited vulnerabilities catalogue, which is the formal signal that this is being used in the wild rather than theorised about.
Why this matters for your business: Patching now is not enough on its own. If your site was running unpatched for more than a few hours after 23 September, assume someone tried. Check your uploads folder and your theme directory for PHP files you did not put there, look at your admin user list for accounts you do not recognise, and force a password reset. If you cannot do that yourself, ask whoever hosts your site to confirm in writing that they checked.
The answer box stopped being a feature and became the page
Several September stories turn out to be one story. AI Overviews now appear on nearly four in ten American desktop searches. Almost every People Also Ask answer is now written by AI. Fresh quarterly data shows the top two results take 29 percent of clicks on a search with no AI Overview and 10 percent on a search with one, and that gap widened by six points in a single quarter. Google sent publishers 40 percent fewer visitors this year than last. None of these numbers moved back during the month.
Why this matters for your business: Ranking first is worth roughly a third of what it used to be on any query that triggers an answer box. Go into Search Console, find the queries that actually bring you enquiries, and search them by hand. Where an answer box appears, your job changes from ranking to being quoted inside it, which means short factual answers near the top of the page and real detail further down. Where no box appears, those queries are now your most valuable ones, so protect them.
What turned out to be noise
Three September panics that were all reporting bugs
On 3 September we reported that Google Analytics was showing zero traffic. On 13 and 26 September we covered missing Search Console crawl stats. On 4 September the story was that Google’s newest AI model had stopped citing sources. All three were bugs or misreadings, and all three resolved. The citation one corrected itself inside a day. The sites that dropped on 4 September were back by the 13th. The crawl stats returned.
One more worth naming. The September spam update, which Google launched on 24 September with a two week window, is still running as this goes out. Google has not confirmed completion. The volatility people attributed to it in the week before the announcement was unrelated.
Why this matters for your business: Before you act on a scary number in a dashboard, check whether anyone else is seeing it. A reporting outage looks exactly like a traffic collapse for the first two days. Give an unexplained drop a week before you rebuild anything, and never make a structural change to your site in the middle of a confirmed update rollout. You will not be able to tell which change caused what.
Automotive
Rates went up, buyers went used, and dealer chat became a legal problem
The Reserve Bank raised the repo rate to 7.25 percent on 23 September, taking prime to 10.75 percent. That is the second hike this year. South Africans are buying used vehicles at the fastest rate in years and affordability has overtaken brand loyalty as the deciding factor. Alongside that, dealers started receiving legal demand letters about website chat tools recording visitors without consent, one dealership chatbot was talked into agreeing a one dollar truck sale, and scammers are now cloning dealer websites complete with fabricated reviews.
Why this matters for your dealership: Check your finance calculator today. If it still runs on the old prime rate, every monthly figure on your site is wrong and the first thing a buyer does on arrival is discover that. Second, read what your website chat tool records and whether it says so. Third, lead with the monthly instalment and the total cost on the vehicle page rather than hiding them inside a calculator, because affordability is what buyers are sorting on now.
Still unresolved
Four questions September did not answer
The spam update is still rolling and nobody knows its full shape yet. Meta has not published Meta One pricing for South Africa, so we cannot tell you what the link paywall will cost you here. Google’s goto redirect broke the rank trackers mid month, which means ranking reports covering late September are less reliable than they look. And nobody has produced solid evidence yet on whether an AI Overview citation actually sends buyers, as opposed to simply appearing.
Why this matters for your business: Treat your late September ranking report as indicative rather than accurate, and say so to anyone you report to. Judge the month on enquiries and sales instead, because those numbers were not affected by any of this.
What to do this month
- Confirm your WordPress site is on the patched version, then check uploads, themes and admin users for anything you did not put there.
- Plan your two Facebook link posts for October deliberately, and move everything else to an email list you own.
- Hand check your top ten enquiry driving queries for an AI Overview, then split your reporting by whether one appears.
- Dealers, update every finance calculator and advertised instalment to prime at 10.75 percent.
- Caveat your late September ranking report, and judge the month on enquiries instead.
Want a second pair of eyes on any of this? Get in touch.
Sources
- Our 21 September brief on the Facebook link post cap
- Our 23 September brief on the WordPress patch and first probes
- Our 26 September brief on the sites that missed the patch window
- Our 30 September brief on the AI Overview click through gap
- Social Media Today on Facebook link posts and Meta One
- The Hacker News on the WordPress core patch
- Tech Times on the webshells that hit 350,000 sites
- CrowdSec on the attacking IP addresses tracked in five days
- SecurityWeek on exploitation immediately after disclosure
- Search Engine Roundtable on the September spam update rollout
- Search Engine Roundtable’s September Google webmaster report
- Search Engine Journal on the global spam update rollout
- TopAuto on the repo rate decision and what car buyers now pay
- IOL on the interest rate hike and vehicle repayments
- National Law Review on chatbot privacy litigation risk