Daily SEO Note — August 28, 2026: Google Splits Site Reputation Enforcement in the EEA

1. SEO for Content Writers

Google published Update to the Site Reputation Policy on Friday, August 28, 2026, and rewrote the matching spam policy documentation the same day. Beginning August 30, a manual action under this policy stops applying to people searching inside the European Economic Area. If you commission third-party, sponsored, or affiliate content, this is the one change today that should alter a brief.

Manual actions split along EEA lines starting August 30

Google states that following discussion with the European Commission it is "adjusting our enforcement approach within the European Economic Area (EEA) and clarifying the criteria we consider when applying the policy." The mechanism is a geographic split in what a manual action does, not a change to what the policy forbids.

For users outside the EEA, nothing moves: a manual action still directly affects search results for the portion of the site involved, and the rest of the site is untouched. For users inside the EEA, the impact of the manual action does not apply at all. Instead, the affected section "may be separated in our systems so that, over time, it ranks independently from the rest of the site." A page can therefore carry a manual action that only ever suppresses it outside the EEA.

Google also confirms there is no obligation to add a noindex tag to content under a non-EEA manual action, and that declining to do so is not treated as evasion, circumvention, or a repeated violation. The documentation now labels the section "Site reputation policy" rather than "site reputation abuse." Rollout status: announced August 28, effective August 30, 2026.

Existing EEA penalties get lifted, but independent ranking is not automatic

If part of your site was demoted under this policy in EEA results, Google says it "will lift all previous manual actions taken under this policy for pages appearing in search results for users in the EEA." Those pages stop being demoted for EEA searchers.

Read the next sentence carefully before promising anyone a recovery. Those pages "may be categorized as separate from the main domain and ranked on their own merits, but this isn't automatic." Separation is a possibility, not a guarantee, and ranking on their own merits means losing the host domain's borrowed authority. A coupons hub that only ranked because it sat on a national news domain may be lifted out of a penalty and still not recover its old positions.

Site owners continue to be notified in Search Console when a manual action is applied, reconsideration requests still work, and Google adds that eligible sites can bring disputes to mediation after a reconsideration request. Treat Search Console manual action notices as a live editorial input this week, not a quarterly check.

The clarified criteria read as an editorial checklist

The rewritten policy page leans almost entirely on signals an editor controls. Its worked examples turn on whether an author and responsible editor are named, whether commercial character is disclosed, whether the section is branded and navigable from the main site, whether content is curated rather than duplicated, and whether readers have a route to report a problem.

The example Google says it would likely act on is an unauthored affiliate article about a marketplace, with no named editor, no commercial disclaimer, no link from any thematic section, and text duplicated from the third-party seller. The examples it says it would likely leave alone are a coupons section built jointly with a partner but curated, disclosed, cross-referenced and reachable from the homepage, and a freelancer-written cooking section with consistent branding, stated editorial responsibility, and a named author.

The explicitly non-violating list also widened: wire service and press release sites, syndicated news between publications, user-generated content such as forums and comments, columns and opinion pieces, advertorial and native advertising whose purpose is reaching readers rather than manipulating rankings, appropriately handled affiliate links, and embedded third-party ad units.

Nothing else moved in the ranking systems today

The Search Status Dashboard showed no incidents and no ranking update in progress across August 20 to 27, 2026, and the documentation changelog logged no writer-facing entries between August 20 and August 28 other than the site reputation change. No core update, no spam update, no Discover or Top Stories change to report.

Apply to your next brief

• Name a human author and a responsible editor on every sponsored, affiliate, or partner-produced page. Unattributed commercial content is the single trait shared by Google's "likely to take action" example.
• Disclose commercial character on the page itself, not only in a site-wide policy, and give readers a working contact route for problems with offers or codes.
• Kill duplicated partner copy. If the text also lives on the marketplace or the white-label provider's site, it fails the clarified criteria regardless of where it sits.
• Link commercial sections from the homepage or a real thematic section, and cross-reference them from editorial content. Orphaned subfolders read as rented space.
• Match the house template. Presentation, UX, and quality that diverge from the rest of the publication are cited explicitly as an action signal.
• Stop treating a manual action as a single global event. Ask which market a demotion applies to before rewriting anything, and stop planning noindex as a compliance gesture for EEA traffic.
• If you publish into EEA markets, re-check pages previously demoted under this policy after August 30 and rank them on their standalone merit, not on the domain's authority.

2. SEO for Developers

Two unauthenticated remote code execution advisories in Next.js are the day's real engineering risk, and one of them lives in the image optimization endpoint that serves your indexed images. Cloudflare shipped an emergency WAF release for them on August 26, 2026, which is why they still belong in today's note even though the patches landed on August 25.

Patch Next.js now: two critical unauthenticated RCEs, one in the image optimizer

GHSA-2xp9-vwfh-vxw4 is an unauthenticated RCE in the Image Optimization API, scored CVSS 9.5, published August 25, 2026. The flaw is in libheif, reached through the sharp image processing dependency, and it triggers when the optimizer handles and converts an AVIF file. Affected: Next.js >= 10.0.0 and < 15.5.24, and everything below 16.3.3. Vercel's interim measure was to disable AVIF optimization until the fix propagated.

GHSA-p293-qw3h-jr36 is CVE-2026-75604, an unauthenticated RCE on Windows-hosted servers, scored CVSS 9.0. It is a path traversal (CWE-22) affecting Pages and App Router applications without Cache Component when the server runs on a Windows filesystem. Affected: >= 13.4 and < 15.5.24, and >= 16.0 and < 16.3.3. The advisory lists no workaround.

Breaking if ignored: an unauthenticated attacker executes code on your origin by requesting a crafted AVIF through /_next/image, or by path traversal on Windows hosts. Both are fixed in 15.5.24 and 16.3.3. Verify the resolved version rather than the declared range, because a transitive pin can hold you below the patch.

# Patched releases: 16.3.3 (16.x) and 15.5.24 (15.x), 2026-08-25
npm install [email protected]      # or: npm install [email protected]

# Confirm nothing transitively pins you below the patch
npm ls next sharp

# Windows hosts are the CVE-2026-75604 blast radius - check where you actually run
node -p "process.platform"

Upgrading is the fix. Dropping AVIF from the optimizer's output formats only narrows exposure while a deploy is in flight, and it is not a substitute for the patch.

/** @type {import('next').NextConfig} */
module.exports = {
  images: {
    // Stopgap only, until 16.3.3 / 15.5.24 is actually deployed.
    // Removing 'image/avif' keeps the optimizer off the libheif path.
    formats: ['image/webp'],
  },
}

Google now enumerates the favicon formats it actually reads

The favicon documentation was updated on August 28, 2026 to list supported formats explicitly instead of pointing at an external reference that drifted over time. Google Search supports BMP, GIF, ICO, PNG, JPEG, PPM and TIFF. The file must be square, at least 8x8px, and larger than 48x48px is recommended.

Non-breaking, but it settles a real ambiguity: SVG is not on that list. A build that emits only an SVG icon has no favicon Google can use, and the symptom is a generic globe next to your result while the icon renders correctly in every browser. Supported rel values are icon, shortcut icon, apple-touch-icon and apple-touch-icon-precomposed.

<!-- Google Search reads: BMP, GIF, ICO, PNG, JPEG, PPM, TIFF -->
<link rel="icon" href="/favicon.ico" sizes="48x48">
<link rel="icon" type="image/png" sizes="192x192" href="/icon-192.png">

<!-- Keep SVG for browsers, but never as the only icon: -->
<!-- Google Search does not list it as a supported format. -->
<link rel="icon" type="image/svg+xml" href="/icon.svg">

Astro 7.2.9 fixes a 5xx on a crawlable URL

[email protected] shipped August 27, 2026 with a fix for "a crash when requesting /index.html against a dynamic page route like [slug].astro." That is a crawlable URL shape returning a server error rather than a 404 or a 200, which is exactly the status-code hygiene problem that burns crawl budget and produces soft-404 and 5xx rows in Search Console.

The same release fixes an SSR manifest "containing stale entryModules references to prerender-only chunks that no longer exist," another source of intermittent 5xx on rendered routes. Non-breaking upgrade within 7.2.x. The preceding [email protected] on August 26, 2026 raised the minimum supported Sharp version to 0.35.4; the release notes do not give a reason, so treat any link to the Next.js libheif chain as unconfirmed.

Quiet surfaces, checked and empty

Schema.org is still on release 30.0 from March 19, 2026. The Google common crawlers documentation has not changed since July 14, 2026, and the AI features page is unchanged since December 10, 2025, so no AI crawler or AI Overviews eligibility policy moved in the window. The Cloudflare changelog carried no bot, cache rule, or robots.txt entries beyond the WAF emergency release, and Vercel's changelog carried no SEO-affecting entries.

Ship today

1. Upgrade Next.js to 16.3.3 or 15.5.24 and redeploy. Confirm with npm ls next that no transitive dependency holds the old version.
2. Audit every Windows-hosted Next.js deployment first. CVE-2026-75604 has no workaround and the advisory rates it CVSS 9.0.
3. Check whether /_next/image is reachable from the public internet and whether images.formats includes image/avif. Remove AVIF only as a stopgap while the upgrade deploys.
4. Add a raster favicon. If your build emits only an SVG icon, ship a 48x48 or larger ICO or PNG and keep the SVG alongside it.
5. Bump Astro to 7.2.9 if you serve dynamic routes, then request /index.html against one of them and confirm you get a 404 rather than a 500.
6. Open Search Console and read the manual actions report. From August 30 a site reputation action carries a different meaning depending on the market it applies to.