SEO & AI Weekly, Nov 2–8: GSC Click Spikes & AI Mode 4 Ads

From November 2 to 8, 2026, Google’s Search Status Dashboard listed no new core or spam updates, though ranking volatility heated up across third-party tracking tools and webmaster forums over the weekend of November 8–9. The most urgent task this week is verifying your Search Console numbers: between October 31 and November 2, a subset of websites recorded vertical desktop click spikes of 2x to 6.5x concentrated on pages 2 to 6 (positions 12 to 54), while impressions, average positions, and GA4 organic sessions stayed flat.

Platform monetization and app security also tightened across the board. Google AI Mode was spotted showing up to four ads in a single response, launched live follow-up query ads and home services booking in the US, and moved desktop AI Overviews for brand queries out of the main left column into the right-hand Knowledge Panel slot. OpenAI’s consumer product lead claimed ChatGPT has reached 1.2 billion weekly active users and roughly one-fifth of Google’s search volume, while OpenAI notified advertisers that Target CPA and Target CPC replace manual bid caps for new campaigns starting November 9 and began testing a business analytics hub. Following October’s app checkout hijacks, Shopify added app security status checks in the merchant admin on November 5 and mandated IP allowlists for all public apps calling the Admin API by November 20.

On the research side, an Ahrefs study of 75,000 brands showed that branded web mentions correlate with AI Overview citations (0.664) roughly three times as strongly as backlink volume (0.218), while a small-sample Peec AI experiment found a 359% rise in daily AI retrievals after rewriting YouTube video descriptions and adding manual timestamps. Two community studies on r/TechSEO measured 18 days of Cloudflare-verified AI crawler requests across site file types and tracked how five SERP APIs adapted to Google’s google.com/goto redirect wrappers.

Key points

Each point is labeled by urgency: Act now means affected sites should take action this week, Watch means there is a deadline or the situation is still changing, and For reference covers research and documentation updates.

• Act now: Several sites saw vertical desktop click spikes in Search Console between October 31 and November 2 on URLs ranking in positions 12 to 54, with no matching rise in GA4 sessions or leads. Check your mobile trendline and annotate affected dates before setting your pre-core-update baseline.
• Act now: On November 5, Shopify added app security details under “Settings > Apps” and required IP allowlists for public apps using bulk operations by November 12 and for all public apps calling the Admin API by November 20, after which non-compliant apps are delisted from the App Store and flagged in merchant admins.
• Act now: Local SEOs reported on November 6 that Google automatically added “Book Online” or “Schedule” buttons to some Google Business Profiles without booking partners, with some links returning a Google 500 error page. Search your brand on Google Search and Maps and test your booking button.
• Watch: OpenAI notified advertisers that starting November 9, new conversion and click campaigns use Target CPA and Target CPC instead of Max Bid and Max CPC; both manual caps retire completely on January 1, 2027.
• Watch: OpenAI was spotted on November 6 testing a Search Console-style “Claim your business in ChatGPT” portal (chatgpt.com/business-hub), giving verified merchants first-party data on brand mentions and outbound website clicks.
• Watch: Google AI Mode can display up to four ads per response and rolled out live follow-up query ads in the US; on desktop brand queries, Google moved AI Overviews to the right-hand column, returning the #1 left-column spot to the brand’s own website.
• For reference: Across 75,000 brands studied by Ahrefs, branded web mentions showed the strongest correlation with AI Overview citations (0.664), and 26% of brands with DR > 40 received zero mentions. In a Peec AI test on 15 YouTube videos, adding detailed descriptions and manual timestamps coincided with a 359% rise in daily AI retrievals.
• For reference: Across 18 days of logs from 14 Cloudflare-verified crawlers, llms.txt was requested by only 1 crawler, whereas regular HTML pages (14/14), RSS/Atom feeds (10/14), and <head>-linked Markdown copies (7/14) saw rapid pickup. Four of five tested SERP APIs reduced unresolved google.com/goto links to 0%–1.9% by November 7, at the cost of much higher latency on deep pages.

Search Console logs desktop click spikes on pages 2 to 6 while GA4 stays flat

Between November 2 and 3, Joy Hawkins, Glenn Gabe, Barry Schwartz, Marie Haynes, and Nikki Pilkington reported that a subset of Search Console properties logged vertical spikes in clicks between October 31 and November 2 (Search Engine Roundtable). Daily clicks on affected sites jumped 2x to 6.5x—and up to 10x on October 31 across several UK client sites—while impressions and average ranking positions remained flat.

On November 3, Marie Haynes inspected row-level Search Console API data across affected properties and published a detailed breakdown. Several anomalies appeared together:

1. Concentrated on desktop pages 2 to 6: Human searchers rarely click past page one, yet these spikes hit non-brand queries where the site ranked between positions 12 and 54 (pages 2 through 6), almost exclusively on desktop.
2. One impression, one click: Dozens of long-tail queries logged 1 impression and 1 click (100% CTR), with affected deep-ranking pages showing 45% to 100% CTR. On one multi-location service business averaging 18,000 impressions and 50 clicks per day, roughly 275 anomalous clicks on November 2 nudged total impressions up by just 1.5% while sending the click chart up 6.5x to 327 clicks.
3. Synthetic query clusters and single-country spikes: Queries appeared in clusters of near-synonymous phrasings; on one property, the entire spike came from Canada while US clicks did not move.
4. API versus web UI mismatch: Nikki Pilkington noted that Search Engine Land detected the spike through the Search Console API on three of its own sites, but in the native Search Console web interface on only one of them.

Because GA4 organic search sessions, phone calls, and form enquiries stayed flat over the same dates, analysts agree the clicks came from automated bots, AI agents researching products and services, or rank trackers resolving redirect URLs that slipped past Google’s filters. Google has not commented on the anomaly.

Separately, on November 4, Google Search Console rolled out multi-select device filters in the Performance report, allowing users to check Desktop, Mobile, and Tablet simultaneously (following multi-select country filters a month ago). You can verify and isolate the early-November click spike in four steps: compare Search Console clicks against GA4 organic sessions and actual orders for October 31 to November 2; filter the Search Console report to “Device: Mobile” to view the unaffected trendline; check the Countries and Pages tabs to see if the anomaly is isolated to one country or a few URLs; and filter the Pages table by “Position > 10” sorted by clicks to list affected URLs and annotate those dates in client reports.

Google AI Mode shows up to four ads and moves brand AI Overviews to the right column

Following Alphabet’s late-October Q3 earnings call—where executives noted that AI Mode currently monetizes at a lower rate than traditional search—Google moved quickly this week on AI Mode ad load, local booking, and desktop brand layouts.

First, AI Mode can display up to four ads per response, and follow-up query ads are live in the US. On November 4, Search Engine Roundtable reported a screenshot from Sachin Patel showing four consecutive Google Ads at the bottom of a single AI Mode answer, up from the usual one or two (and occasional three). On Friday afternoon, November 6, Barry Schwartz confirmed in live testing that Google’s “Multiturn ads” are now active in the US: Sponsored ad units appeared not only below the initial response, but also dynamically below the second, third, and fourth follow-up queries in the same conversation.

Second, AI Mode integrated direct home services booking in the US. Google VP of Product for Search Robby Stein announced on X on November 4 (Search Engine Roundtable) that US searchers describing a household repair or service need in AI Mode now see local pricing comparisons, reviews, and direct booking buttons inside the response through partners Angi Home, Thumbtack, Housecall, and GetJobber, with ServiceTitan coming soon.

Third, desktop AI Overviews for brand queries moved to the right-hand column. Spotted by David McSweeney on October 31 and Chris Long on November 2 (Search Engine Roundtable), searches for brand names such as Apple, Coke, and Zillow on desktop now display the AI Overview in the right-hand rail—where the Knowledge Panel normally sits—rather than at the top or middle of the main left column. This layout returns the #1 main-column position to the brand’s official website while keeping the AI-generated summary and entity details on the right. In smaller UI tests, Brodie Clark spotted Google moving the AI Overview source count chip to the bottom of the summary, and Gagan Ghotra saw AI Overviews embedded directly inside entertainment Knowledge Panels.

Moving brand AI Overviews to the right rail is a welcome change for brand owners, as it reduces click interception above the #1 organic result on navigational searches. Check your brand name in an incognito US desktop browser to confirm whether your homepage is back at the top of the left column and review the accuracy of the right-rail AI summary.

OpenAI claims 20% of Google’s search volume, updates ad bidding, and tests a business hub

Between November 3 and 6, OpenAI made news across usage disclosures, self-serve ad bidding, and first-party webmaster analytics.

First, checking the math behind OpenAI’s “20% of Google” claim. In an interview with Alex Kantrowitz on Big Technology, ChatGPT Consumer Product Lead Adam Fry said ChatGPT has grown from 1 billion to 1.2 billion weekly active users over the past two months (~100 million added per month), with 250 million weekly voice users, and claimed that “ChatGPT’s volume of search-like queries is now roughly one-fifth the volume of queries of Google” (Search Engine Roundtable). Asked what counts as a search, Fry replied: “Every time you ask a question and go search the web, that’s a search,” citing lookups for people, places, finance, and health that require current facts. This 20% figure is an unverified self-reported estimate with no disclosed Google baseline, and it counts every prompt that triggers background web retrieval as a search—so it should not be equated with a 20% share of commercial search queries.

Second, ChatGPT Ads replaces manual bid caps with cost targets. Following its October 30 advertiser email introducing a wider desktop ad card, open beta multi-image ads, and international Shopify integration (Search Engine Roundtable), OpenAI emailed advertisers on November 5 (Search Engine Roundtable, OpenAI Help Center) to announce bidding changes taking effect Monday, November 9:

• Target CPA replaces Max Bid: New conversion campaigns in Ads Manager use Target cost per action (Target CPA), dynamically adjusting bids around your target average cost per conversion.
• Target CPC replaces Max CPC: New click campaigns use Target cost per click (Target CPC). Instead of capping individual auction bids, the system bids above or below your target in each auction to maximize clicks near your target average CPC.
• Retirement date: Existing campaigns on Max Bid or Max CPC continue running temporarily, but both manual options retire on January 1, 2027, when remaining campaigns transition automatically. OpenAI advises advertisers to verify Pixel or Conversions API signals and Event Quality Score (EQS) warnings before setting targets.

Third, OpenAI’s “Search Console for ChatGPT” surfaces. On November 6, e-commerce analyst Juozas Kaziukėnas shared screenshots on LinkedIn (Search Engine Roundtable) of an upcoming “Claim your business in ChatGPT” portal at chatgpt.com/business-hub. The tool lets verified businesses (for example, via a connected Shopify store) track daily brand mentions in organic ChatGPT answers and outbound clicks to their website, update product and business information, and configure a Business Agent, though it does not expose user prompts, demographics, or competitor rankings. Because neither Google Search Console nor Bing Webmaster Tools currently breaks out AI click counts in its AI reports, this is the first official portal providing first-party click data from an answer engine.

Shopify adds admin app security checks and requires IP allowlists for public apps

In our October 25 issue, we covered how attackers compromised developer tools or long-lived tokens across three third-party Shopify apps to inject phishing scripts into storefront checkouts, after which Shopify promised tighter token rules and IP restrictions. On November 5, Shopify shipped both the merchant-facing inspection tools and the developer enforcement deadlines.

In the merchant admin, Shopify launched app access and security information reviews under Settings > Apps. The apps list now shows each connected app’s latest activity and flags security issues requiring attention. Inside each app’s details page, access, permissions, and activity are grouped together with labels highlighting sensitive data permissions, alongside indicators showing whether the app has implemented two required protections: expiring access tokens and enforced IP restrictions.

On the developer side, Shopify announced that an IP allowlist is now required for every public app calling the Admin API (serverless or dynamic-IP apps can allowlist by network via ASN support, and custom apps installed outside an organization also require IP allowlists). With an allowlist enabled, a leaked token cannot be used from outside the developer’s approved servers. Enforcement rolls out across four dates:

Enforcement Date	IP Allowlist (Public Apps)	Expiring Offline Access Tokens
November 12, 2026 (11:59 PM ET)	Bulk queries and mutations blocked for public apps without an IP allowlist	—
November 20, 2026 (11:59 PM ET)	Delisted from the App Store (no new installs) and flagged in merchant Settings > Apps	—
January 1, 2027	—	Delisted from the App Store (no new installs) and flagged in merchant Settings > Apps
January 15, 2027	Warning banner shown to merchants in admin	Warning banner shown to merchants in admin
April 1, 2027	Admin API requests fail for existing installs	Admin API requests fail for existing installs

Separately, Shopify’s deprecated Global Catalog REST API stopped serving traffic on November 2, 2026. All requests to discover.shopifyapps.com/global/... now fail, and apps must use the Universal Commerce Protocol (UCP) endpoints on Global Catalog MCP (catalog.shopify.com/api/ucp/mcp).

Shopify merchants should audit “Settings > Apps” around November 20: check every installed app that holds sensitive permissions (orders, customers, themes, or checkout) to confirm it uses expiring tokens and IP restrictions, and replace or uninstall any app that remains flagged ahead of Black Friday.

Four GEO and crawler studies: brand mentions, YouTube descriptions, verified bot logs, and goto links

Four empirical studies published between November 3 and 7 shed light on what actually drives AI citations and how AI and SERP crawlers behave in the wild.

First, Ahrefs’ 75,000-brand study shows branded web mentions correlate with AI Overview citations 3x more than backlinks. On November 6, Aimee Jurenka wrote on Search Engine Land about Ahrefs’ analysis of 75,000 brands (focusing on domains with DR > 40 and measuring Spearman rank correlation with Google AI Overview mentions):

• Branded web mentions: 0.664 (strongest signal, including unlinked plain-text mentions)
• Branded anchor text: 0.527
• Branded search volume: 0.392
• Domain Rating (DR): 0.326
• Referring domains: 0.295
• Number of backlinks: 0.218

Brands in the top quartile for web mentions averaged 169 AI Overview mentions, dropping sharply to 14 in the second quartile, while roughly 26% of tested brands with DR > 40 received zero AI Overview mentions. The article also noted Ahrefs’ tracking of URL overlap between AI Overviews and traditional search: the share of URLs cited in AI Overviews that also rank in Google’s organic top 10 dropped from 76% in July 2025 to 38% in March 2026. Domain authority now acts primarily as an entry ticket into the candidate pool; winning the citation depends on passage-level extractable facts (specifications, comparison tables, concrete numbers) corroborated by third-party reviews and mentions.

Second, Peec AI’s YouTube test links detailed descriptions and timestamps to a 359% rise in AI retrievals. Ahrefs’ November 2026 rankings of the 50 Most-Cited Websites in Google AI Overviews and 50 Most-Cited Websites in Google AI Mode show youtube.com in first place in AI Overviews with 24.5% of top-50 citations, while google.com leads AI Mode with 23.4%.

On November 6, Search Engine Land covered an experiment by Peec AI GEO researcher David Konitzky across roughly 60 YouTube videos. On October 19, the team rewrote detailed descriptions and added manual timestamps on 15 videos, leaving about 45 unchanged as a control group, and compared daily AI retrievals across the two weeks before (October 6–21) and after (October 22–November 4). Updated videos saw a 359% increase in daily AI retrievals (versus 17% for unchanged control videos and 25% for YouTube overall in the dataset), including a 293% jump in Google AI Overviews (vs. 27% baseline) and 129% in Google AI Mode (vs. 11% baseline).

This is a small-sample (15 videos), two-week observational test that cannot fully isolate natural view fluctuations, so treat it as a low-cost hypothesis rather than strict proof. Still, because retrieval models rely heavily on text descriptions and chapter timestamps rather than parsing full video streams for every query, filling out YouTube’s 5,000-character description box with structured summaries and manual timestamps is an easy win for product videos.

Third, 18 days of verified AI crawler logs show llms.txt largely ignored while HTML and feeds lead. On November 6, a developer published an 18-day server log study on r/TechSEO and ai-visibility.greta.sh. Rather than trusting self-reported User-Agent strings—which are heavily spoofed by scanners—the study filtered strictly for 14 crawlers verified via Cloudflare IP lists, reverse DNS, and request signatures:

• Regular HTML pages: 14 / 14 (100% coverage)
• RSS / Atom feeds: 10 / 14
• robots.txt: 8 / 14
• Markdown page copies linked in <head> (<link rel="alternate" type="text/markdown">): 7 / 14 (fetched within a day of deployment by Amazonbot, ExaUser, OAI-SearchBot, GPTBot, and ClaudeBot, though fetching does not prove higher citation rates)
• XML Sitemap: 5 / 14 (ClaudeBot fetched 122 times in 18 days, vs. Googlebot 19 times and GPTBot 10 times)
• llms.txt, llms-full.txt, and ai-catalog.json: 1 / 14 each (zero verified search or AI crawlers requested llms.txt during the first 17 days)

Although based on a single site over 18 days, the log data aligns with last issue’s 96,418-URL SISTRIX study: skip manual llms.txt maintenance until your server-rendered HTML, feeds, and accurate Sitemap lastmod dates are in order.

Fourth, re-testing google.com/goto across five SERP APIs shows URL resolution restored at the cost of deep-page latency. Following Google’s rollout of google.com/goto redirect wrappers on search result links, researcher Hasan Kalkan posted Part 2 (November 3) and Part 3 (November 7) on r/TechSEO, testing the same 50 desktop queries (25 US + 25 Germany) across five SERP API providers:

SERP API Provider	Oct 31 Unresolved goto %	Nov 3 Unresolved %	Nov 7 Unresolved Count & %	Nov 7 Latency & Notes
SerpApi	85.1%	1.1%	0 / 445 (0%)	First to restore clean direct URLs across the test set
Serper	42.6%	0%	0 / 444 (0%)	Noted on Nov 6 that site: operator queries only resolve the top 3 links
DataForSEO (Standard)	63.3%	60.6%	0 / 453 (0%)	Reached 0% on Nov 6, but deep-page latency rose sharply; priority/live queues still return goto
Oxylabs	71.8%	6.5%	8 / 426 (1.9%)	All 8 remaining unresolved links were on a single US SERP
Bright Data	74.1%	87.4%	376 / 433 (86.8%)	Still returned raw goto links on most results, though 97.5% exposed the display domain

As DataForSEO’s status update and the Part 3 timings explain, Google rate-limits rapid goto resolution past the first 5 to 6 links on a page. Unwrapping deeper pages in DataForSEO’s standard queue pushed median turnaround to 75 seconds at depth 10, 178 seconds at depth 20, and 960 seconds (16 minutes) at depth 100. Teams running custom rank scripts on real-time queues or deep pagination should check whether their responses still contain raw google.com/goto URLs.

Facebook indexes 6 million AI answer pages, plus Google indexing and policy updates

On November 5, Saul Westbrook, Glenn Gabe, and Barry Schwartz highlighted a massive directory of AI-generated pages on Facebook (Search Engine Roundtable). Starting around June–July 2026, Meta began populating facebook.com/fb-answers/ with AI-generated topic summaries synthesized from public Facebook posts and pages. By early November, Google had indexed over 6 million /fb-answers/ URLs, ranking them across traditional 10 blue links, AI Overviews, AI Mode, and Gemini for millions of queries. Glenn Gabe called it a textbook example of “scaled content abuse,” and Barry Schwartz noted that the pages will likely not stay indexed long now that they have drawn public scrutiny. Independent sites should not copy this tactic: Google’s four spam updates in 2026 have consistently targeted mass-generated pages that stitch together existing content without original value.

Other Google documentation and spokesperson updates this week include:

• Gary Illyes implies click and query data are not coming to GSC’s AI report anytime soon. On November 2, responding on LinkedIn to an unattributed quote from a Search Central Live event claiming clicks and queries would be added to the Search Console AI report, Gary Illyes wrote: “I don’t think we’ve phrased it like this. The team is super interested in giving more data, data that makes sense, but we don’t have anything to announce yet.” John Mueller added on Bluesky that reading this as a permanent refusal was a stretch, but Google has no timeline or announcement.
• “Crawled - currently not indexed” documentation updated; “only homepage indexed” points to site quality. On November 3, Google updated the Page Indexing report help page for “Crawled - currently not indexed,” stating that Google does not index all pages on the web, the status is common, and it does not necessarily indicate an issue requiring action unless it affects important URLs. The same day, John Mueller replied on Bluesky to a case where a previously hacked and cleaned site had only its homepage left in the index, noting that when a formerly indexed site drops to only its homepage, it usually points to a broader site-wide quality issue unrelated to the hack.
• Important URLs returning 4xx get temporary protection from deindexing. On November 5, after SEOs noticed the VLC media player homepage had lost its favicon and snippet in Google Search while returning an HTTP 418 I'm a teapot status code, Gary Illyes explained on LinkedIn that Google treats 418 like most other 4xx errors (“not found”), but because VLC is one of the most important pages on the web, Search temporarily protected the URL from dropping out of the index right away—keeping only the link and the last good title until it returned 200 OK. Ordinary ecommerce inner pages should not count on the same grace period.
• Site Reputation Abuse manual actions no longer apply in the EEA. On November 4, Glenn Gabe shared Search Console emails sent by Google (Search Engine Roundtable) notifying affected publishers that previous manual actions under the Site Reputation Abuse policy no longer impact search results shown to users in the European Economic Area (EEA), a change that took effect on August 30, 2026.
• Resoneo compiles a list of 120 Google Twiddlers. On November 4, Search Engine Roundtable featured a categorized list of 120 Google “Twiddlers” (post-retrieval re-ranking functions that boost, demote, or filter results) compiled by Olivier de Segonzac at Resoneo across seven categories including quality/authority, AI/rankers, spam/safety, freshness, SERP layout, images/Lens, and video/YouTube.
• Weekend ranking volatility heats up again. Following a brief calm after the October 27 fluctuations, ranking volatility rose sharply across third-party tracking tools and webmaster forums on November 8–9 (Search Engine Roundtable).

Other industry news

• Microsoft Clarity launches Agentic Analytics and Ask Clarity (November 4): Microsoft announced (Search Engine Roundtable) an Agent Activity dashboard in Clarity that shows which AI agents visit a site and what actions they take (searches, form submissions, logins, bookings, and checkout), alongside Simulation Assessments that test whether agents can complete commerce and travel journeys. Microsoft said AI agents observed across its network nearly doubled in three weeks to almost 2 million. Clarity also added plain-language querying via Ask Clarity and expanded Brand Agents to local businesses.
• Perplexity launches 24/7 background agents with Teammates (November 6): Perplexity released a web research preview of Teammates for $200/month Max subscribers, running persistent role-based agents inside isolated sandboxes.
• Google Business Profiles automatically get booking links, with some 500 errors (November 6): Brandon Schmidt, Joy Hawkins, and Syed Amir reported on Friday, November 6 (Search Engine Roundtable) that Google began showing “Book Online” or “Schedule” buttons on local Business Profiles that do not use Reserve with Google partners (sometimes triggered by a website Contact page link), with some maps/reserve links returning a Google 500 error page.
• CJEU Advocate General issues opinion on Gemini news summaries (November 3): In Like Company v. Google Ireland (Case C-250/25), the first generative AI copyright referral before the Court of Justice of the European Union, Advocate General Maciej Szpunar delivered his Opinion on November 3 (Kluwer Copyright Blog analysis). While advising the Court to find the model-training questions inadmissible, he opined that when an AI chatbot retrieves and reuses press publications in real time to generate answers, reproducing protected expression beyond mere facts can infringe press publishers’ related rights under Article 15 of the EU DSM Directive. Advocate General opinions are non-binding recommendations ahead of the Court’s final judgment.
• Google defaults Search and Gemini to off for K-12 student accounts (November 3): Google announced that Google Search, Gemini, Gemini Notebook, and Gemini in Classroom will default to off for managed K-12 student accounts until administrators turn them on. Administrators can enable Search without enabling the standalone Gemini app, but enabling Search includes AI Overviews and AI Mode with no separate toggle to disable them. Google is also piloting step-by-step Guided Learning in Search with select US schools this month.
• Reddit stock drops over 33% after CEO confirms Google search traffic decline (November 2): Following last week’s Q3 earnings report, Reddit CEO Steve Huffman confirmed to CNBC that search-referral traffic from Google declined meaningfully this quarter due to the shift toward AI Overviews and AI Mode, and Reddit shares fell 33% to 36% over the week (Search Engine Roundtable).

Linus’s notes

The first thing to address this week is measurement noise. Between late October and early November, Search Console logged desktop click spikes across pages 2 to 6, Gary Illyes signaled that AI reports will not break out click data, and Google’s google.com/goto redirects pushed deep SERP API crawls past 15 minutes. Like October’s missing ChatGPT UTMs and poisoned rank-tracker SERPs, these shifts look like traffic movement at first glance but actually come from the measurement layer. Because the Search Console API exposed more anomalous rows than the web UI, automated weekly reports pulling raw API totals can easily mistake headless scraper pagination for organic growth, and then use that polluted baseline when evaluating subsequent ranking shifts. When reviewing early November numbers, I separate desktop from mobile first, cross-check against mobile GSC trends and GA4 organic sessions, and use November 3 to 8 as the clean pre-Black-Friday baseline.

Second, monetization and webmaster tooling for AI search are settling into a clear pattern. Google expanded AI Mode to up to four ads per response, began testing follow-up query ads, and added direct home-services booking; OpenAI updated its ad bidding models and tested the Claim your business in ChatGPT portal. Both platforms are moving in the same direction: packing more paid placements and direct actions into the answer interface while giving merchants a portal to claim domains and view aggregate mentions and clicks, without exposing query-level organic click logs. As buyers see more paid slots during multi-turn follow-up questions, organic click space shrinks further. Still, OpenAI’s upcoming business portal and Microsoft Clarity’s Agent Activity panel finally give merchants first-party visibility, so it is worth tracking the rollout and reconciling external AI impressions and agent visits against actual store orders.

Third, this week’s GEO and crawler studies bring optimization priorities back to fundamentals. Across Ahrefs’ 75,000-brand dataset, branded web mentions (0.664) and branded anchor text (0.527) correlated with AI Overview mentions far more strongly than backlink count (0.218), and 26% of DR > 40 brands received zero mentions. Pair that with Peec AI’s YouTube description experiment and 18 days of verified crawler logs showing llms.txt largely ignored while HTML pages and feeds carried the load, and the takeaway matches what I wrote in recent weeks: independent stores do not need to spend engineering hours on llms.txt or chase raw link volume. The work that pays off is server-rendering clear product specs, pricing, and comparison tables in standard HTML, writing thorough YouTube video descriptions with manual chapter timestamps, and earning real brand mentions in third-party reviews and industry coverage.

Finally, Shopify is tightening its app supply chain after October’s three checkout hijacks. Adding the app permissions and security review panel in the admin and requiring IP allowlists for public apps by November 20 (plus expiring offline tokens next year) raises the baseline across the ecosystem. With Black Friday right ahead, merchants should use this window to audit Settings > Apps themselves: uninstall unused apps now, and follow up on any app still flagged without an IP allowlist after November 20 to reduce storefront script and Admin API exposure during peak checkout.

What this means for you

1. Check Google Search Console for October 31 to November 2 for a vertical spike in desktop clicks. If your property was hit, compare against GA4 organic sessions and actual orders, switch the GSC filter to Mobile to view the clean trendline, and annotate those three days in reports; export November 3–8 data as your clean pre-Black-Friday baseline.
2. On Shopify, open “Settings > Apps” and review every installed app’s sensitive permissions and whether it has enabled expiring access tokens and enforced IP restrictions. If an app remains flagged after November 20, contact the developer or replace it, and uninstall unused apps before Black Friday.
3. Watch for OpenAI’s upcoming “Claim your business in ChatGPT” portal (chatgpt.com/business-hub) to verify your store or domain and track first-party brand mentions and website clicks; if you use Microsoft Clarity, check the new Agent Activity dashboard to see which AI agents visit your product and checkout pages.
4. If you run ChatGPT Ads, check your Pixel or Conversions API event signals and Event Quality Score (EQS) in Ads Manager before transitioning campaigns from Max Bid / Max CPC to Target CPA / Target CPC ahead of the January 1, 2027 retirement deadline.
5. Search your brand name in an incognito desktop browser to confirm whether Google has moved your brand’s AI Overview to the right-hand column and restored your homepage to #1 on the left, and check the accuracy of the right-rail summary.
6. If you maintain a Google Business Profile for physical locations, click your “Book Online” or “Schedule” button on Google Search and Maps to make sure Google has not auto-injected a broken maps/reserve link returning a 500 error.
7. Stop spending engineering time on llms.txt and prioritize three higher-return tasks: server-rendering clear product specs, pricing, and comparison tables in standard HTML; keeping XML Sitemap lastmod dates and RSS/Atom feeds accurate; and adding detailed text summaries and manual timestamps to core YouTube product videos.
8. If you use a SERP API for rank tracking, verify whether your queue still returns unresolved google.com/goto links; as weekend ranking volatility heats up, cross-check impressions and sessions before making template or URL structure changes.