Daily SEO Note — September 2, 2026: Google's AI Impression Data Goes Global

1. SEO for Content Writers

The one editorial change that matters today: Google finished the worldwide rollout of the Search Console generative AI performance report on August 31, 2026, so every property now has impression data for AI Overviews, AI Mode, and Discover's generative features. It reports impressions only — no clicks, no CTR, no position. Nothing is running in the ranking, spam, or Discover systems.

Every property now has AI impression data, and it stops at impressions

Google's help documentation states that as of August 31, 2026 the generative AI performance report is rolled out to all websites globally, closing a phased rollout that began with the June announcement. Rollout status: complete. This affects all content on every verified property, not a vertical or a content type.

Read the metric list before you build a report on it. The report covers impressions from AI Overviews and AI Mode on Search, with a separate view for generative features in Discover, broken out by page, country, device, and date. Search Labs experiments are excluded. Clicks, click-through rate, and average position are not in it. If your site receives few impressions in these features, you may see no data at all.

What to do differently in the next brief: pull the report for your top pages and record an impressions baseline before you rewrite anything, so the rewrite has a before-and-after. What to stop: stop writing "AI Overviews took our traffic" as an unmeasurable claim now that a measurement exists, and stop quoting CTR or position from this report to stakeholders — those columns do not exist, and inventing them from the standard Performance report mixes two different surfaces.

The opt-out switch beside it is a strategy decision, not a lever for a bad week

The Search generative AI control shipped alongside the report and lives in Search Console under Settings. It is property-level, and inclusion is the default. Choosing to exclude removes your site's links from AI Overviews, AI Mode, and Discover's generative features, and also stops your content being used to ground responses in them. Google states that sites which opt out receive no traffic or impressions from those features.

Two details change how an editorial team should treat this. First, it is slow and coarse: the change generally takes a few days to go live, with content excluded within one to two days after that, and some content lingering because of caching. Second, it is not a training control. Limiting model training is a separate mechanism, Google-Extended, which lives in robots.txt and is covered in the developer section below.

The editorial instruction: put this decision in your publishing strategy document with a named owner and a review date. It is not a switch to flip after one disappointing week, because the cost is total loss of visibility across three surfaces and the reversal is not instant.

Ranking, spam, and Discover systems: nothing is running

The Search Status Dashboard shows no incidents across crawling, indexing, ranking, and serving, checked through September 1, 2026 at 23:13 PDT. The Search Central blog published nothing on September 1 or 2. The documentation changelog's most recent entry is August 31, a refresh of the European Search Dataset Licensing Program page, which this series covered yesterday.

Practical consequence for anyone reading a rank tracker this morning: whatever movement you are looking at is not attributable to a confirmed update. Do not write that framing into a client note or a retro.

Unconfirmed: a verification gate in front of search results

Community reports collected by Search Engine Roundtable on September 1 describe Google testing a step that asks users to click a "Continue" button before reaching search results, without requiring sign-in. This is unconfirmed. Google has published no documentation and no dashboard entry, and it is kept out of the checklist below for that reason.

It is worth watching rather than acting on. If a verification step broadens, third-party rank-tracking and scraped SERP datasets get noisier, which is a reason to lean harder on first-party Search Console data — including the AI report that just became available to you.

Apply to your next brief

• Pull the generative AI performance report for your top pages and record an impressions baseline today, before any rewrite lands.
• Report AI visibility as impressions only. Do not quote clicks, CTR, or position from this report — it does not contain them.
• Add one line to every brief naming the single question the page answers outright, since grounding pulls answers, not whole pages.
• Treat the Search generative AI control as a documented strategy decision with a named owner, not a reaction to a bad week.
• Do not attribute this week's ranking movement to an update in any client note. No ranking, spam, or Discover system is running.
• Keep the "Continue" verification test out of client-facing writing until Google confirms it.

2. SEO for Developers

The change worth a same-day pull request is @astrojs/sitemap 3.7.4, which fixes a homepage entry that shipped without its trailing slash and therefore disagreed with your canonical. Beyond that, a TYPO3 access-control advisory entered GitHub's reviewed database, and the new Search Console AI control is a setting with no representation anywhere in your repository.

@astrojs/sitemap 3.7.4: your homepage entry lost its trailing slash

Version 3.7.4, released August 31, 2026 at 19:36 UTC via PR #17851. Non-breaking patch. The symptom if you ignore it: when trailingSlash is set to "never" or build.format is set to "file", the sitemap emitted the homepage with an empty path — https://example.com instead of https://example.com/. That is a sitemap URL that does not match the canonical your pages declare, which is exactly the kind of low-grade inconsistency that costs you nothing visible and quietly wastes crawl signal.

The setting to change is your dependency version, not your config. Upgrade, rebuild, and diff the first <loc> in the generated sitemap against the canonical URL your homepage actually serves.

# @astrojs/sitemap 3.7.4 - homepage URL fix (PR #17851, 2026-08-31)
npm install @astrojs/[email protected] [email protected]

npm run build

# Confirm the homepage entry carries its trailing slash:
grep -m1 '<loc>' dist/sitemap-0.xml
# expect: <loc>https://example.com/</loc>
# bug:    <loc>https://example.com</loc>

Either of the two settings below was enough to trigger it, so check your config before assuming you were unaffected.

import { defineConfig } from 'astro/config'
import sitemap from '@astrojs/sitemap'

export default defineConfig({
  site: 'https://example.com',

  // Either of these triggered the pre-3.7.4 homepage bug:
  trailingSlash: 'never',    // trigger #1
  build: { format: 'file' }, // trigger #2

  integrations: [sitemap()],
})

astro 7.2.10: markdown images in content collections rendered an empty srcset

astro 7.2.10 shipped in the same August 31, 2026 release train. Non-breaking. The symptom: images inside markdown in content collections rendered an empty srcset attribute, so the browser is handed no responsive candidates and falls back to the single source. On image-heavy article templates that weakens your LCP candidate selection and gives Google Images less to work with.

The same release also corrects prerender conflict warnings so they name the route that first rendered a duplicate pathname rather than an arbitrary one — a real time-saver if you have been chasing a duplicate-route warning that pointed at the wrong file. Both fixes come with the upgrade above; there is no separate setting. After rebuilding, grep your rendered output for srcset="" to confirm the fix reached your templates.

Google-Extended and the Search Console AI control are two separate decisions

This is the item most likely to be got wrong this week, because the two levers sound like the same thing and are not. The Search generative AI control is a Search Console property setting that governs whether you appear in and ground AI Overviews, AI Mode, and Discover's generative features. Google-Extended is a robots.txt user agent that governs whether crawled content may be used to train future Gemini models. Google's documentation is explicit that the Search Console control does not affect training.

Neither is inferable from the other, and neither is visible in a code review of the site. Opting out in Search Console while leaving Google-Extended allowed, or the reverse, are both coherent positions — but only if someone chose them. Write both down.

# Training control. This is the only lever here that limits Gemini training.
# It does NOT remove you from AI Overviews or AI Mode - that is the
# Search generative AI control in Search Console > Settings.
User-agent: Google-Extended
Disallow: /

# Search access. Blocking this removes you from Google Search entirely.
User-agent: Googlebot
Allow: /

Page-level preview controls are a third, independent layer. Google's AI features and your website page, last updated December 10, 2025, still names nosnippet, data-nosnippet, max-snippet, and noindex as the mechanisms that limit what these features can show from a given page. They are unchanged today and they stack with, rather than replace, the two decisions above.

TYPO3 CVE-2026-19418 entered GitHub's reviewed database, so Dependabot fires now

GHSA-68jx-f42c-7599 carries CVE-2026-19418, rated High at CVSS v4 7.3. The CVE itself was published August 17, 2026, but the reviewed GitHub advisory surfaced on September 1 — and that is the event that matters operationally, because it is when Dependabot alerts land in repositories. Non-breaking patch, but treat it as urgent.

Affected ranges are typo3/cms-backend from 13.0.0 up to 13.4.34, and typo3/cms-core from 14.0.0 up to 14.3.6. The symptom if ignored: since TYPO3 13 began serving the backend and Install Tool from the site's main entry script instead of a dedicated directory, the referrer validation added by TYPO3-CORE-SA-2020-006 stopped holding. Requests from any script on one of the instance's own domains, including a frontend page, are accepted by backend routes. Any cross-site scripting flaw anywhere on the site becomes a path to invoking Install Tool endpoints with an authenticated editor's session.

# CVE-2026-19418 / GHSA-68jx-f42c-7599 - High, CVSS v4 7.3
# Affected: typo3/cms-backend >=13.0.0 <13.4.34
#           typo3/cms-core    >=14.0.0 <14.3.6

# 13.x line:
composer require typo3/cms-backend:^13.4.34 --update-with-dependencies

# 14.x line:
composer require typo3/cms-core:^14.3.6 --update-with-dependencies

composer audit

Quiet surfaces, checked and empty

Checked and unchanged in the window: Chrome release notes and the Chrome developer blog, the web.dev blog, Lighthouse and web-vitals releases, and Schema.org, which still sits at version 30.0 from March 19, 2026. Bing's Webmaster blog has published nothing since February 10, 2026, and IndexNow is unchanged.

On the hosting side, the Vercel changelog for September 1 covers AI Gateway models and AWS PrivateLink only — nothing touching redirects, rewrites, middleware, ISR, Cache-Control, or image optimization. The Cloudflare changelog for September 1 is AI Gateway invoicing and D1 free-tier query limits; its Content Signals enforcement on the crawl endpoint was August 31 and ran in yesterday's note. Next.js has published only 16.4.0-canary.14 since the 16.3.4 and 15.5.25 AVIF fix on August 31, and a canary is not a rollout.

Ship today

1. Upgrade @astrojs/sitemap to 3.7.4 and astro to 7.2.10, rebuild, and diff the first <loc> in your sitemap against the canonical URL your homepage serves.
2. If you run TYPO3, patch to 13.4.34 or 14.3.6 and run composer audit. An existing XSS anywhere on the domain turns this into backend access.
3. Grep the rebuilt output for empty srcset attributes on content-collection pages to confirm the Astro image fix reached your templates.
4. Record your Google-Extended decision and your Search generative AI control decision separately, each with an owner, since neither is visible in the repository.
5. Add the generative AI performance report to whatever pulls your weekly Search Console numbers, and label the column impressions — there is no CTR in it.