From today the same website can break the same Google rule and get two completely different outcomes, depending only on where the person searching happens to be sitting. Google has switched off part of its own spam enforcement for everyone searching inside Europe, and it did so because a regulator told it to.
That is the biggest search story of the weekend. Four more follow, and one of them deserves ten minutes of your morning before anything else.
SEO and search
Google stops applying its site reputation penalty to anyone searching in Europe
Google’s site reputation abuse policy targets what the industry calls parasite SEO. A trusted website rents out a subfolder, a third party fills it with coupon pages or sponsored reviews, and the whole thing ranks on the host domain’s strength rather than its own merit. Google has issued manual actions against this since 2024.
From today those manual actions stop having any effect for people searching inside the European Economic Area. Sites still receive the manual action in Search Console, but the demotion no longer applies to European searchers while it carries on applying everywhere else. The European Commission opened a Digital Markets Act investigation after publishers complained the policy was demoting news media hosting third-party commercial content.
Why this matters for your business: if you sell into Europe and host partner content, your exposure there just dropped. Nothing else changed. Your South African, British and American traffic all remain fully exposed, so this is not permission to start renting out subfolders. What it tells you is that Google’s spam rules bend under regulatory pressure, and that different countries now get meaningfully different results from the same index.
PDFs are dropping out of Google and nobody has explained why
Savanna Gray flagged it first and Lily Ray amplified it. Top performing PDF files are going from thousands of impressions and hundreds of clicks to flat zero in Search Console, with the drops starting around 12 and 18 August. Some sites report their PDFs leaving the index altogether. Google has not commented, and while the timing overlaps with the August spam update, the earliest drops came before it started.
Why this matters for your business: work out how much of your organic traffic lands on a PDF. Price lists, spec sheets, brochures and application forms are the usual culprits. Open Search Console, filter your pages by URLs containing .pdf, and compare the last fortnight against the one before it. If those numbers have collapsed, the fix is the one that was always the better answer anyway. Put the content on a real HTML page and keep the PDF as a download. A page you control ranks better, converts better, and can actually be measured.
Social and AI search
Google is testing a sign-in prompt inside AI Mode answers
Google is showing some searchers a sign-in panel inside the AI Mode response itself, with a large Google logo and a prompt to sign in and save your work. It has also been testing a homepage for signed-out users that drops the familiar Search button entirely.
Why this matters for your business: a signed-in searcher is a personalised searcher. The more people Google gets to log in, the harder results lean on their own history and location, and the wider the gap grows between what you see when you check your rankings and what a real customer sees. Judge your performance on Search Console clicks, not on your own browser.
Your website and your ads
A critical Elementor Pro flaw let strangers upload code to WordPress sites
This is the one to act on. CVE-2026-32475 affects every version of Elementor Pro up to and including 4.2.1, and scores 9.0 out of 10 on severity. An attacker needs no account and no password. They need only a published Elementor form with a file upload field.
Validation and file processing run in two separate loops that treat empty entries differently, so an attacker submitting two file parts for a single upload field slips past the extension blocklist and writes a PHP file into a public folder. Elementor patched it in version 4.2.2 on 19 August. No exploitation had been observed at disclosure, which counts for less now the mechanism is public.
Why this matters for your business: open your WordPress admin, go to Plugins, and look at your Elementor Pro version. Anything below 4.2.2 needs updating today rather than this week. If you run a contact form with a file upload field and cannot update immediately, remove the upload field until you can. If somebody else maintains your website, forward them this section and ask for confirmation in writing.
Booking buttons are coming to Search and Performance Max ads
Google is extending Reserve with Google booking buttons beyond Local Services Ads and Maps. If you run Search or Performance Max campaigns and have already published an appointment link, that link can now power a Book button on your ads. Google tracks the booking without extra tagging, and it appears automatically for eligible merchants.
Why this matters for your business: anything that removes a step between the ad and the appointment is worth having, and this costs you no development work. Check whether your scheduling platform is a Reserve with Google partner, then check your appointment link is published and correct. This rolls out on its own, and you would rather it sent people to a working calendar than a stale one.
Automotive
A read-across, not news: what booking buttons mean for test drives and service bays
Nothing new landed in dealer marketing this weekend. Three dedicated searches across inventory feeds, dealer websites and South African classifieds turned up nothing, so this is a read-across rather than automotive news.
A dealership runs two booking flows that map straight onto the Reserve with Google change. A test drive request and a service appointment. Both usually sit behind a form, and both leak people at every click.
Why this matters for your dealership: if your service department already runs on a scheduling platform, find out whether it is a Reserve with Google partner. A Book button on a service search ad puts your calendar directly into the result, which is a shorter path than any landing page you could build. Test drives are harder, because most dealer groups handle them through a CRM rather than a calendar, but ask your provider where they stand. Then apply the PDF warning to your brochures. Dealer websites carry more spec sheets and finance documents as PDFs than almost any other business, so check Search Console before assuming those pages still earn you traffic.
What to do this week
- Check your Elementor Pro version. Anything below 4.2.2 gets updated today.
- Filter Search Console by URLs containing .pdf and compare the last two weeks against the two before.
- Confirm whether your booking platform is a Reserve with Google partner.
- If you sell into Europe, note that site reputation penalties no longer bite there.
- Stop judging your rankings from your own browser. Use Search Console clicks instead.
If you would rather somebody ran these checks across your website for you, that is the sort of thing we do. Get in touch.
Sources
- Google Won’t Enforce Its Site Reputation Policy In The European Economic Area, Search Engine Roundtable
- Google won’t respect manual actions for site reputation abuse in the EEA, Search Engine Land
- Google Search Showing Fewer PDF Files, Search Engine Roundtable
- Google Search Indexing Issues August 28th, Search Engine Roundtable
- Google AI Mode Asking Users To Sign In, Search Engine Roundtable
- Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin, Patchstack
- Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code, The Hacker News
- Google Book Buttons Expand To Search & Performance Max On Google Ads, Search Engine Roundtable