An alert appeared on Facebook business pages last week carrying a single number. Two. That is how many posts containing a link some pages may now publish in a month before Meta asks them to pay. Plenty of South African businesses run their entire website traffic plan through a Facebook page, so this one deserves ten minutes rather than a shrug.
Social media
Facebook now caps some business pages at two link posts a month
Meta launched its Meta One for Business subscription packages last week, and it has since widened a test that used to affect almost nobody. A range of Facebook page managers all shared the same alert, telling them their account is limited to two link posts per month unless they subscribe. Meta first ran this restriction on a small group of pages back in December 2025. A paid tier it now wants to sell has pushed the limit out to many more. Publisher pages stay exempt, so news keeps flowing into the app.
Before you reach for your card, look at Meta’s own numbers. In its Widely Viewed Content report for the first quarter of 2026, 98.7 percent of post views in the United States went to content with no link out of Facebook. The share carrying an outbound link has fallen from 9.8 percent in 2022 to 1.3 percent now. Facebook has been squeezing link reach for four years. The subscription simply puts a price on something that had almost stopped working.
Why this matters for your business: If your Facebook plan rests on posting links to your website, it has been failing slowly for years and you may not have noticed. Open your page insights and compare the reach on your last ten link posts against your last ten without a link. If the gap is wide, a subscription is not the answer. Put the link in your bio, your pinned post and your first comment, publish the actual substance natively so people stay and read it, and spend what you save on the email list and the WhatsApp number you own outright.
SEO and search
Google is beating the rank trackers, so your reports may be wrong
Since roughly 13 September, Google appears to have become far better at blocking the tools that scrape its search results. Derek Perkins of Nozzle told Search Engine Roundtable that most of his attempts to collect data from Google Search were blocked, an 80 percent drop in what he could gather. Sistrix posted a status note on 16 September confirming its own collection is running at a reduced rate. Glenn Gabe then compared three major tools against a site he knew had crashed and recovered. Ahrefs caught the recovery, Semrush caught it late, and Sistrix missed it entirely.
Why this matters for your business: The ranking report you receive this month may be describing a version of Google that does not exist. That is no reason to distrust whoever sends it, because nobody outside Google can see around this. It is a reason to lean on the numbers nobody has to scrape. Search Console, your analytics and the enquiries reaching your inbox all come from your own property. If a report shows a dramatic swing over the next few weeks, confirm it in Search Console before anybody rebuilds anything.
One smaller note while you are in there. Search Console crawl stats are missing 15 September across every property, so the gap is in Google’s reporting rather than a sign it stopped crawling you. The data has always come back before.
Your website and WordPress
A blog comment could have run code on your WordPress site
Last week we noted WordPress 7.1.1 arriving and described it as a maintenance release. The full detail has now been published and it is more serious than it first looked. On 18 September Patchstack disclosed the headline issue as CVE-2026-93485, an unauthenticated stored cross-site scripting flaw carrying a severity score of 7.1 out of 10. The release fixed 11 security issues and 17 bugs in total.
The way in is what makes this one worth your Monday. The attacker needs no account and no password. The payload goes into an ordinary comment, through the ordinary comment form, submitted by an anonymous visitor. It slides past WordPress’s comment sanitiser because nothing in it looks like the markup that filter exists to strip, and it only turns dangerous once the comment gets displayed. One thing slows it down. A first time commenter is held for moderation, so the payload waits in the queue. Anyone you have approved once before sails straight through.
Why this matters for your business: If your site accepts comments, do this update today rather than at the end of the week. Log in, open Dashboard and then Updates, and confirm you are running 7.1.1. If your hosting applies core updates automatically you are probably fine, but check instead of assuming. If somebody moderates comments for you, tell them a comment that looks completely unremarkable can still be the attack.
Automotive marketing
Dealers are getting legal demand letters about their website chat
This one is genuine automotive news, not a lesson borrowed from another sector. Speaking on Inside Automotive, Andy Graff of ComplyAuto described demand notices going out to businesses under the California Invasion of Privacy Act, over the way conversations between a shopper and a dealership website get captured and potentially shared with third parties. Because a California resident can shop on any dealer site in the country, Graff made the point that the problem is not confined to California dealers.
His wider warning was about vendor access. Dealerships routinely hand customer information to marketing companies, website providers and systems vendors without much ceremony. Graff argued that a dealer first needs a data processing agreement setting out how the vendor handles that data, and a vendor risk assessment checking how it protects what it receives. If the vendor is breached, the dealer still gets asked what due diligence it did.
Why this matters for your dealership: Swap California for POPIA and the picture here is the same. Your chat widget, your call tracking and your lead forms are all recording conversations, and most of that data leaves your building the moment it is captured. Make a list this week of every supplier who touches your customer data, and next to each one write down what they receive, where it is stored, and whether you hold a signed agreement covering it. Then check that your website actually tells visitors their chat is being recorded, because the consent you never asked for is the part that costs money later.
What to do this week
- Compare the reach on your last ten Facebook link posts against your last ten without a link, then stop optimising for the losing format
- Confirm your WordPress site is running 7.1.1, and do it first if you accept comments
- Treat any dramatic ranking report this month as unconfirmed until Search Console agrees with it
- List every supplier holding your customer data and find the signed agreement covering each one
If you want a hand with any of this, get in touch and we will take a look.
Sources
- Facebook Pages get charged for link posts, Social Media Today
- Widely Viewed Content Report, Meta Transparency Center
- Google May Be More Successful In Blocking Scrapers and Tracking Tools, Search Engine Roundtable
- Google Search Console Crawl Stats Missing A Day Of Data, Search Engine Roundtable
- WordPress 7.1.1 Maintenance and Security Release, Patchstack
- Why dealership compliance cannot be a one-time check-the-box exercise, CBT News