WordPress · Google · AI Content

Nobody Hacked You. Google Just Stopped Sending People.

Google ran a spam update from August 18 to August 21. It went hunting for blog posts a machine made in bulk. If that is how your posts get made, your rankings went with them, and nobody sent you a note.

I stand at the counter of my own closed shop at night beside a dead wall telephone while a Barred Rock hen watches from the counter top and the mug in front of me reads GOOD WORK BRINGS CALLS. Nobody hacked you. Google just stopped sending people.

Google spent three days in August throwing out blog posts, and the ones it threw out were the ones a machine made in bulk.

Nobody got an email. Nothing showed up in your dashboard. There is no red banner, no warning, no line item. The site loads fine. The pages are all still there.

The only thing that changed is that Google stopped sending people to them.

So if August was quiet and you cannot work out why, this is worth ten minutes. Not because you did something wrong. Because somebody may have done it for you, on a schedule, for $300 a month.

You did not get hacked. You got quiet. Those look identical from your desk.

Here is what actually happened, and how you check your own site in four minutes.

TL;DR (the short answer)

Google rolled out a spam update starting August 18, 2026 and finished it on August 21, two days and sixteen hours later. Google said only that it was a normal spam update running in all languages and locations. What practitioners found in the wreckage was not hacking and not link buying. It was mass produced content: pages generated in bulk, AI text poured in at volume, and thin affiliate pages built off somebody else's product feed. One site lost rankings for more than 200,000 queries. WordPress is not the target and Google never named it. WordPress is just where bulk publishing is cheapest, because a plugin will do it while you sleep. Sources: Google Search Central, 2026, and Glenn Gabe, GSQi, 2026.

3 Things to Remember

Google went after how the pages were made, not what platform they sat on.

Nobody tells you. No email, no dashboard notice. The phone just gets quieter.

The plugin that writes your posts on a schedule is the thing to go look at first.

Nobody Sent You a Letter. That Is the Part That Gets Me.

I crouch on a wet street at night outside a lit plumbing shop with a Barred Rock hen and the blue merle Australian Shepherd beside me. Nobody sent you a letter. That is the part that gets me.

There is no notification for this. That is not me being dramatic, that is how it works.

When Google demotes a site through a spam update, nothing lands in your inbox and nothing shows up on your screen. Google announced the update on its own account and that was the whole announcement. It did not name a single site and it never will.

So you find out the way Bob always finds out. A slow week. Then a slower one. Then you are sitting there in September wondering if it is the season.

I have watched owners chase that feeling into all the wrong places. New truck wrap. More Google Ads. Fire the guy answering the phone. Meanwhile the actual thing happened on a Tuesday in August and left no mark. Usually it was never the SEO in the first place.

The mistake: you assume a problem this big would come with a warning.

The fix: open Search Console, set the date range to August 10 through August 31, and look at the shape of the line.

The payoff: you find out in four minutes whether your quiet month has a date on it.

The Plugin That Writes Your Blog While You Sleep. That Is the One.

I walk out of a dark warehouse carrying a case with the blue merle Australian Shepherd at my knee. The plugin that writes your blog while you sleep. That is the one.

If your blog posts get made by a plugin on a schedule, start there, because that is the pattern that got hit hardest.

Reports after the update pointed straight at content generated in bulk to rank. Not one post. Hundreds, pushed out on a timer, built around keywords instead of around a customer.

The cases with real numbers behind them are worse than the headline. One site had 1.5 million pages indexed, about 85 percent of them machine built, and Google hit the whole domain, not just the machine built part. Another lost rankings for more than 200,000 queries outright. Gone, not moved to page two.

Here is the part that should land for you. You may have never seen these posts. Somebody sold you a content package. It runs. It fills the blog. You never read a word of it and neither did anybody else.

That is the sentence Google is now good at spotting.

Sources: Roger Montti, Search Engine Journal, August 25, 2026, and Glenn Gabe, GSQi, August 2026.

It Is Not That a Robot Wrote It. It Is That Nobody Read It.

AI did not get penalised. Bulk did.

This distinction matters because half the internet got it wrong in one week. Google has said for years that AI written content is fine. What it goes after is content made mainly to rank rather than to help somebody, whoever or whatever typed it.

The clearest proof is a publisher who kept ranking through all of this. They publish AI assisted articles and they said plainly that a human eyeballs every article before it goes out. Same tool. Different process. Different outcome.

One more thing from the same reporting, and it is the honest bit. The sites that survived tended to be the ones that were run by hand first and switched to automation later. The ones that went up fully automated on day one had nothing banked with Google at all.

The mistake: you think the question is whether you used AI.

The fix: ask instead whether a person read the page before it went live and would stand behind it.

The payoff: you get to keep using the tool that saves you time and stop using the one that publishes for you.

Your Product Roundups. Nobody Wrote Those Either.

Affiliate pages and endless product roundups are on the same list as the bulk posts, and they are on it for the same reason.

One of the cleanest cases was a site built entirely on Amazon affiliate links. Categories and product pages generated straight off Amazon's own data, with links out and not much else. Some categories did not even have product images. It lost rankings for more than 14,000 queries.

Google has a name for that shape and has had it for years. Thin affiliation. Pages that pass somebody else's product along without adding a thing.

For you this probably is not a whole affiliate site. It is the eleven posts titled best pressure washer for 2026 that somebody added to your blog to catch traffic, sitting there next to your service pages, dragging on the same domain. It is also part of the bill nobody adds up.

If the page would be identical whether or not you had ever done the job, it is not doing you any good.

Source: Glenn Gabe, GSQi, August 2026.

Nothing broke. Nothing came down. The phone just stopped doing the one thing you bought it for.

If You Got Hacked, You Have Been Publishing Spam for Weeks.

A hacked WordPress site publishes spam pages you never wrote, and Google reads every one of them.

I am not going to rebuild that argument here because I have already written it twice. Injected pharmacy and dating pages sitting on your domain, the trust drop, and the quiet month that follows are all in what a hack actually does to your Google standing and in the post about the phone going quiet after a hack.

What I will say is how it connects to this. A hack and a content plugin end up in exactly the same place: pages on your domain, made in bulk, that no human wrote and no human read.

One you paid for. One you did not. Google does not sort them by intent.

If you have not checked, search site:yourdomain.com and read the page count. If it is wildly more than the number of pages you think you have, that is your afternoon.

The Guest Post Package Is a Different Bill Coming.

I sit at a workbench with my chin on my fist looking at stacked banded cash and an open case, beside a mug reading SMALL BUSINESS SEO. It is still a bad deal. The money mostly buys you nothing.

Bought backlinks and cheap guest posts are a real problem and they are not what happened in August. I am saying that because it is true, not because it helps me.

Glenn Gabe, who worked the actual drops, was direct about it: link spam updates are separate, and the August 2026 update was not targeting link spam. So if you dropped in August and your last twelve months were guest post packages, this particular update is probably not your answer.

It is still a bad deal. Google runs separate systems that discount bought links. The money mostly buys you nothing. But I am not going to hang it on this update to make a tidier post.

If somebody tells you your August drop was backlinks, ask them which update they mean and what date it ran.

1,387 of them. I read every one on the way across, which is the whole point of this post.

I Moved 1,387 Posts and I Still Write Every One.

I did not read about this from the outside. I moved 1,387 of my own posts off WordPress and I sat with every one of them.

25 years, 10k+ sites built, 281 of them JSX AI interactive. I use AI every single day and I am not going to pretend otherwise on a page I wrote with it open. What I do not do is let it press publish.

Every post on this site went out because I read it and decided it was worth your time. That is not a moral position. It is the only thing that separates my blog from the ones that got buried in August.

Here is how that move went, rankings and all.

Two questions

Who Wrote Your Last 50 Posts?

Answer two things about your own blog. You get back which of Google's named spam policies your pattern lines up with, worst first. Nothing is scanned and nothing is sent.

1. How do your blog posts get made?

2. Roughly how many go out a month?

Pick one from each row and the read shows up here.

Find Out if Your Own Post Reads Like It Came Off a Line.

The fastest way to know where you stand is to take one of your own posts and have a machine grade it. It takes about thirty seconds. Here is the prompt I would run.

Grade your own

Try it · Find out if your post reads like it came off a line

I run a [TYPE OF BUSINESS] in [YOUR CITY]. Here is one blog post from my
website:

[PASTE ONE BLOG POST]

Do four things.

1. Score it 0 to 100 on how much it reads like it was made in bulk to catch
   a search, rather than written for a real customer. 100 means it reads
   like a person who does this work wrote it.
2. List the top 5 things dragging that score down, worst first, in plain
   words. One sentence each.
3. Tell me whether anything in it is specific to my business. Name the
   exact sentences. If nothing is, say so plainly.
4. Give me the one change that would move the score the most.

Rules: write at a 5th grade reading level. Short sentences. No hype. If you
are not sure about something, say you are not sure. Do not rewrite the post.

Fill the [brackets] in the chat box before you send.

You get: a straight score on one of your own posts and a ranked list of what is wrong with it, in about 30 seconds.

Where None of This Is Your Problem.

Most small business sites were not touched by this. I am not going to scare you into thinking otherwise.

Google did not go after WordPress. It never named it, and I have not seen one credible number saying WordPress sites dropped at a higher rate than anything else. WordPress is in this story because bulk publishing is cheap there, not because Google has a grudge.

The sites in the case studies were enormous. 1.5 million pages. 250,000 pages. A full Amazon affiliate operation. If you have got forty pages and you wrote them, that is a different universe from the one that got hit.

Some people even said their AI assisted content did better after the update. That is anecdotal and so is most of what anybody knows right now. Nobody outside Google has the full picture, including me.

And if you are hit, it is not permanent. Sites do recover from spam updates. It takes real cleanup and then months of Google watching you behave. Slow, but it is a door, not a wall.

There Is Nothing on This Page a Robot Published.

Your problem is not that you used a tool. It is that somewhere along the way, publishing stopped being a decision.

I am not telling you your site is finished. I am telling you Google spent three days in August sorting pages by how they were made, nobody sent you a note about it, and the only signal you got was a phone that rang less.

That is the part I would fix. Not the posts. The setup where a plugin decides what goes on your website and you find out from a bar chart six weeks later.

If you want to see your own site with no plugin deciding anything, take a test drive. I will put your site on my code and you look at it before you spend a dime.

Take a Test Drive →

You get a real look at your own market. No obligation, and nothing to cancel.

Want the whole playbook first? Plan your attack. Balls Out Marketing.

FAQ

Did Google's August 2026 spam update target WordPress sites?

No. Google never named WordPress and no credible data shows WordPress sites dropped at a higher rate than sites on anything else. The update went after how pages were made, mainly bulk generated content and thin affiliate pages. WordPress shows up in the story because plugins make bulk publishing cheap and automatic.

When did the August 2026 spam update run?

It started on August 18, 2026 and Google confirmed it finished on August 21, two days and sixteen hours later. If your traffic fell off a cliff inside that window, that is your date.

Will Google tell me if I was hit by a spam update?

No. There is no email and nothing appears in Search Console for an algorithmic demotion. You find it by comparing your traffic before and after August 18 in Search Console, or by noticing the phone got quiet.

Does Google penalise AI written content?

No, not for being AI written. Google goes after content made mainly to rank rather than to help a person. A publisher that has a human check every AI assisted article before it goes out came through the update fine, according to reporting in Search Engine Journal in August 2026. The volume and the lack of a human are the problem, not the tool.

My SEO company publishes 30 blog posts a month for me. Is that a risk?

It depends on who reads them. Thirty posts a month that nobody at your business has read, built around keyword lists rather than jobs you actually do, is the exact pattern that got hit. Ask your provider who writes them, who reads them before they go live, and to show you three.

Can a hacked WordPress site get flagged as spam by Google?

Yes. A hacked site publishes spam pages on your domain that you never wrote, Google indexes them, and your trust and rankings drop. Search site:yourdomain.com and if the page count is far higher than you expect, get somebody who does this for a living.

Were bought backlinks and guest posts part of the August 2026 update?

No. Link spam is handled by separate updates, and the August 2026 spam update was not targeting link spam, according to Glenn Gabe at GSQi who worked the drops. Bought links are still a bad buy, but they are not the explanation for an August drop.

How long does it take to recover from a spam update?

Months, and only after you actually clean it up. Google needs to see a clean site over an extended period, and recoveries in the field have run to five months or more. Publishing more content on top of the problem does not work.