David Epding

AI Search / SEO / GEO + Automation + Data Analyst mit Web Dev & Marketing Background | 🐸+🐍🔥

[Brave @brave]

Did you know you can search specific sites through Brave Search? 🔎

There are over 12,000 shortcuts (or search bangs) you can put at the beginning of queries to search those sites directly.

For example, searching "!r best laptops" would show you a list of discussions about best laptops on Reddit.

Here are some other shortcuts you can use 👇

!a - Amazon
!ae - AliExpress
!ap - Associated Press
!bb - Best Buy
!cb - Crunchbase
!cws - Chrome Web Store
!e - eBay
!egs - Epic Games Store
!f - Flickr
!fb - Facebook
!gh - GitHub
!gog - GOG
!hb - Humble Bundle
!hn - Hacker News
!i - Brave Search Images
!ia - Internet Archive
!ig - Instagram
!li - LinkedIn
!m - Brave Search Maps
!n - Brave Search News
!nf - Netflix
!nyt - New York Times
!pin - Pinterest
!pv - Prime Video
!q - Quora
!sc - SoundCloud
!so - Stack Overflow
!spt - Spotify
!ste - Steam
!ta - TripAdvisor
!tc - TechCrunch
!v - Brave Search Videos
!w - Wikipedia
!wa - Wolfram Alpha
!wb - Wikibooks
!x/!tw - X / Twitter
!yt - YouTube

[Glenn Gabe @glenngabe]

Agent checkout approved. Eager to hear how this goes :) -> Shopify announced that browser-based AI agents can now complete purchases on Shopify merchant sites via WebMCP

"Shopify previously supported WebMCP for its storefronts and carts, allowing browser-based AI agents to comb through a Shopify retailer’s inventory, search for products, and add them to a cart. The addition of WebMCP support for checkout, including Shop Pay, means these agents can now read the checkout screen, update it, and submit the transaction with the buyer’s authorization, without relying on screenshots or scraping web pages, the company said."
https://t.co/dLPpHejpKY

[Chris Long @chris_nectiv]

SEO News: Google Lighthouse is adding a new audit for AI agents.

This includes using Google's new Agentic Resource Discovery specification.

[Lily Ray 😏 @lilyraynyc]

I just checked a dozen unrelated terms in Google Trends (US, past 12 months) and every single one showed the same #1 region: Wyoming

(The least populated state in the U.S.)

Drill down, and it's all coming from Cheyenne - a town of 67K.

Even if Google Trends normalizes by a region's total search volume, not by population... that wouldn't explain why Cheyenne, Wyoming leads in search demand for *every query* I checked.

Unless Google Trends data is inaccurate?

Cheyenne, Wyoming also happens to be a data center hub (link in comments). So perhaps the explanation might be that a lot of non-human traffic is coming from that location?

Which would line up with something I've been wondering about for the past year: how much of the unusual spikes in search volume we've been seeing in Google Trends (the "SEO" surge over the past year, for example) is actually coming from real humans.

Try it yourself: check any term in Google Trends in the US for the past 12 months. Curious whether you get Wyoming too.

[Glenn Gabe @glenngabe]

Looks like it dates back to June 2026 (dated late May 2026), before the August spam update and now September spam update. It's Google’s second system identified in 2026 designed to catch AI slop -> Google Has Deployed A New AI Spam Detector Called SAFE

"Google has published a research paper about detecting spam that mimics a human manual review that catches content that violates the “spirit” of policy violations and platform guidelines. The system is called Scaled Abuse Forensics Examiner (SAFE) and it is expressly designed to identify AI-generated content."

"The paper says SAFE identifies “spirit of policy” violations primarily with a few-shot-trained LLM. The goal of SAFE is to catch content that may not match an existing rule or known violation pattern but still violates the intent of the policy or platform guideline and can go undetected by traditional classifiers and fine-tuned violation-detection models."
https://t.co/XzDnoYYPvo via @martinibuster

[Google Search Central @googlesearchc]

Today we released the September 2026 spam update. We'll update our ranking release history page when the rollout is complete: https://t.co/gaZTPxc9tA

[Streamlit @streamlit]

🚀 See what's new in 1.64!

Highlights:
📊 st.echarts_chart for Apache ECharts
⏳ Async/await support in app code
🔄 Live updates for st.text_input

1.63 + 1.64 demos: https://t.co/9O5jkMRt1G
Notes: https://t.co/jH03mOBFtS

[ABC News @ABC]

Google has been fined 403 million euros ($463 million) for breaching the European Union's strict privacy rules because it mishandled users' location data, the bloc's data privacy watchdog said Monday.

Read more: https://t.co/Az5PqDADjf

[Gagan Ghotra @gaganghotra_]

🆕 in AI Overviews answers Google is now testing showing anchor links which instead of taking to a webpage takes to AI Mode.

Another day - Another Tactic!
from Google to push users from usual search results to AI Mode #SEO

[David Konitzny @DavidKonitzny]

🔍 𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗯𝗲𝗰𝗼𝗺𝗲𝘀 𝗺𝗼𝗿𝗲 𝘃𝗮𝗹𝘂𝗮𝗯𝗹𝗲 𝘄𝗵𝗲𝗻 𝗼𝘁𝗵𝗲𝗿𝘀 𝗰𝗮𝗻 𝗯𝘂𝗶𝗹𝗱 𝗼𝗻 𝗶𝘁.

Over the past few weeks, we’ve been analyzing ChatGPT’s retrieval system to better understand what happens between a prompt and the sources that end up in an answer.

Metehan Yeşilyurt discovered a retrieval leak that gave us access to new information about this process.

We used the data to identify 𝘁𝗵𝗲 𝘀𝗲𝗮𝗿𝗰𝗵 𝗲𝗻𝗴𝗶���𝗲𝘀 𝗯𝗲𝗵𝗶𝗻𝗱 𝗖𝗵𝗮𝘁𝗚𝗣𝗧. 🔎

The data contains internal engines, external providers, and dozens of Labrador variants for areas including Reddit, news, finance, legal, medical, local search, images, and more.

We’re making the full list available for everyone to explore. 🌍

As the GEO Research Team at Peec AI, we want to make these systems easier to understand, share what we learn, and give others data they can test and build on.

There are still many unknowns in the data. Some engines don’t have a clear purpose yet. We’re also continuing to test which engines are triggered for different types of queries and how frequently they are used.

This is where more people looking at the data can help. 🧩

If you can identify one of the unknown engines, reproduce when a specific engine is triggered, or find something we missed, let us know.

𝗧𝗵𝗲 𝗳𝘂𝗹𝗹 𝗹𝗶𝘀𝘁 𝗶𝘀 𝗶𝗻 𝘁𝗵𝗲 𝗮𝗿𝘁𝗶𝗰𝗹𝗲 𝗯𝗲𝗹𝗼𝘄.

👉 𝗘𝘅𝗽𝗹𝗼𝗿𝗲 𝘁𝗵𝗲 𝗱𝗮𝘁𝗮 𝗮𝗻𝗱 𝘀𝗵𝗮𝗿𝗲 𝘄𝗵𝗮𝘁 𝘆𝗼𝘂 𝗳𝗶𝗻𝗱.

Tomek Rudzki · Metehan Yeşilyurt · Jan Ehrlinspiel · Malte Landwehr
GEO Research Team @ Peec AI

https://t.co/FW2nnSpWhM

[Glenn Gabe @glenngabe]

Every site owner running ads (especially a lot of ads) should run this TODAY :) -> Google debuts ‘ad detection tool,’ letting marketers better assess ad experiences in Chrome

"Google today announced new ad detection tools within its Chrome User Experience Report, or “CrUX,” geared towards helping paid-for media teams, both on the buy- and sell-side of the industry, better assess audiences’ ad-load experiences. “We’ve all encountered overwhelming ad experiences on the web,” reads a blog post, marking the launch, which expands on metrics already available within CrUX."

How it works:
"Fielding follow-up queries from Digiday, Google offered further insight into how CrUX assessment works under the hood, noting how Chrome identifies advertising using a combination of network-level filtering and analysis of script execution. For example, URLs matching its ad filter list can be classified as advertising, while Chrome can also identify resources or frames created by scripts it has already classified as ad-related. Chrome then samples the visible viewport once per second to calculate ad count and density. CPU and network consumption are instead accumulated over the user’s session, with CrUX ultimately reporting results at the 75th percentile."
https://t.co/0A0XaVflFz

[David Epding @EpdingDavid]

@Marie_Haynes @YoungbloodJoe Google - laser focussed on its own revenue, its shareholders - will have its own definition of a meaningful contribution and optimize for the least attribution to contributers possible.
So, in theory lovely, in practice likely meaningless.
But, at least there is a tiny chance...

[Glenn Gabe @glenngabe]

OK, looks like Gemini 3.8 Flash is now providing links. When it first rolled out, there was a bug and there were barely any links being provided. @gaganghotra_ was the first to report that and I saw that as well (and shared some screenshots). Here is what the AI Mode response looks like now via 3.8 Flash. Much, much better. Thanks @rmstein. The first screenshot is this morning and the second is when it first rolled out. Big difference...

[Glenn Gabe @glenngabe]

Don't do it. For a number of reasons. And add that I fully believe we will see a Penguin-like event targeting "inauthentic mentions" this year. Google is well aware of what's going on, hence the section in their guide to AI search experiences mentioning "inauthentic mentions". :)

[Lily Ray 😏 @lilyraynyc]

Google Chrome: use incognito!
Google Search: identify yourself 👮🏼

[David Epding @EpdingDavid]

(3/3)
🔵AI chats such as ChatGPT, Perplexity, Claude all show /goto? links as sources
🔵rank trackers celebrate as Google left multiple loopholes to retrieve the target urls without the need to request the /goto? urls
🟰 Google Search is just broken from the inside out

[David Epding @EpdingDavid]

So, lets wrap it up: Google /goto URLs in Search (1/3)
🟠Google masks search result links with a /goto?url= parameter that 302 redirects to the target
🟠Google tries to hit AI chat competition and rank tracker
🟠Google does it so poorly that ...
https://t.co/495EZopr3K

[David Epding @EpdingDavid]

(2/3)
🟠Google tries to collect data of SERP misuse as every reload has a unique encryption (same url different encrypt)
🟠but Google starts indexing the urls theirselves
🟠Google updates robots.txt to block /goto? parameter which is somewhat useless against 302 redirected urls

[Roger Montti @martinibuster]

Rank Math paused its controversial Support Agent after users discovered it secretly generated site credentials. Says it will return. #wordpress #seo @sejournal

https://t.co/NLJcYG6Bd4

[Sybre Waaijer @SybreWaaijer]

Two days ago, Rank Math closed about a dozen security issues in 1.0.277. This plugin runs on over 4 million sites.

In that same update, group[.]one (who also owns WP Rocket) now gets administrative privileges to your site.

Last time, I classified something like this as a backdoor. This time, you may decide.

The file: vendor/groupone/wap-client/includes/class-app-password-manager.php.

What it does:
When a site administrator whose site is connected to a (free) rankmath[.]com account opens "Help & Support," the plugin immediately creates a WordPress Application Password for that user. It sends that password to group[.]one's servers. Their AI agent can then act on your behalf on your site.

The plugin never asks first. There is a "Terms & Conditions" box, but it does not stop the password from being created or sent. The transfer starts before the box even appears.

What they can do with it:
WordPress Application Passwords have no capability scopes; that password gives administrator powers. Their servers can install and activate plugins from WordPress[.]org, change settings, create admin users, and edit or delete content. They cannot immediately log into wp-admin in a browser, but they do not need to.

For example, they can install a snippets plugin and then inject PHP into its settings. That is remote code execution. "WPCode — Insert Headers and Footers" by Syed Balkhi exists to do just that. The password group[.]one holds can install it and write those settings.

Will they do this? Probably not. But their servers are now a hot target: they are collecting administrator passwords from a plugin on over 4 million sites. A hacker who gets that pile can hijack every site that already minted one.

The password shows up on your profile as "WAP – Rank Math Support Agent". Closing the "Help & Support" tab does not revoke it. This Application Password does not expire. You cannot turn the "Support Agent" off.

What you should do:
If you opened "Help & Support" while connected, revoke the Application Passwords immediately.

Go to "WP Admin -> Users -> Profile -> Application Passwords, and revoke anything starting with "WAP –".

Extra context:
I'm the founder of The SEO Framework plugin, a competing plugin to Rank Math, but without CVEs.