The update is done. It went pretty fast again...
[status.search.google.com ]

Day 7 of the utterly pointless Azure attacks for me. Although I do not want to use Cloudflare I am experimenting with it to see if I can stop all the plain error pages being generated by supposedly blocking the most prolific IPs which, for me, seemingly are not that many.

I do hope I'm doing this correctly, any advice?

Am I being dunb?

In Cloudflare where the heck is the supposed WAF?

Or is this not FREE?

There are limitations on the free version, but the Security/Web Application Firewall (WAF) is not always a paid option. See the Cloudflare discussions in the AdSense forum this month: [webmasterworld.com...]
;)

Aha, thanks. Yesterday it allowed me to create an IP block list however today that's disappeared. CF has so many complicated options it's ridiculous except for those who seriously need them.

So far the good news, the basic settings seem to have had a big impact according to Webalizer but sot so much insofar as Awstats is concerned.

I've added three much higher traffic sites today so tomorrow's stats will be interesting.

I seem to recall that last time I tried CF it caused an email problem therefore I need to be careful which other sites are added.

So far the good news, the basic settings seem to have had a big impact according to Webalizer but sot so much insofar as Awstats is concerned.

This is interesting since most commentators consider Awstats to be more accurate than Webalizer however, so far for these four sites, Awstats is showing pretty much the same metrics yet Webalizer is showing drastic reductions and this is also backed-up by CPanel's bandwidth usage but it never was a bandwidth concern for me, or so I thought!

This is using CF's standard settings with Client Side Security and Bot Fight Mode selected on their quick start guide intro page.

For me I found yesterday that WAF is a paid-for extra therefore will continue with this experiment for a few days as-is.

On Cloudflare's new dashboard, they merged WAF, Firewall Rules, and Rate Limiting into Security rules.

On Cloudflare's new dashboard, they merged WAF, Firewall Rules, and Rate Limiting into Security rules.

Thanks, there are so many options and stuff going on CF really needs to simplify everything for newbies ... it's far too much all in one go.

UPDATE: Awstats is reporting the drops, it was my poor eyesight that missed it, Webalizer is much clearer in this respect.

Initial reductions after 3 days appears to be in the 80-90% region which is huge. It's never been a bandwidth issue for me, solely a means of stopping all my 400 plain error pages distorting metrics. CF seems to mostly have stopped the Azure probes which are continuing on my non-CF sites.

I'm trying to wrap my head around the traffic stats CF generates since their numbers seem high to me ... This may be me as I find more "things" therefore I am now not sure whether realworld traffic is up, down or the same.

There’s an interesting follow-up on Google’s August 2026 spam update:

[searchenginejournal.com...]

Reports suggest scaled, automated AI/SEO content may have been particularly affected, although Google has not confirmed that AI content itself was targeted.

AI isn’t necessarily the problem; mass-produced, search-first content with little original value may be.

One caution: Google’s update ran August 18–21, 2026 and is now complete, so we should soon have better evidence from large AI-content sites showing exactly what patterns were hit. I think those reports will surface soon.

For those scaling AI publishing, human QA, original data/research, genuine usefulness and selective publishing look increasingly important.

So I’d be interested to hear from the survivors as well as those making inroads into increased traffic (just like the quoted Expedia ceo said recently about robust expansion around GEO, while SEO declined).

Cloudflare seems to be doing, more or less, the job I want it to do however I can't wrap my head around their statistics of Page Views, Uniques and Total Requests plus the navigation is so poor, as a non-frequent user, it takes me ages to find absolutely anything. CF's language and descriptions are very confusing.

Otherwise, for the moment, it's doing what I need however I wouldn't want to pay for this interface, 1/10 for that CF.

For CF regular users it's possibly fine but CF definitely does not know the KISS principle.

@Whitey,

the problem with the SPAM Update is that if your site has a big selection of same items from different manufacturers ( and has variants of it like lenght and color ) the algo will see this as SPAM.
So the previous and this SPAM Update removed all those niche resellers. They have been replaced by "solo" websites only giving 1 or a very small slection and showing very little expertise.

For me as a customer, this is very bad. IMO this SPAM Updates are pushing users closer to ads.

if your site has a big selection of same items from different manufacturers ( and has variants of it like lenght and color ) the algo will see this as SPAM.

I have to say this is an issue I have, so far, never experienced and I have a lot of very similar widgets BUT I do ensure that my title-bar, description, h1 and first words of my first paragraph ALL specify that widget. Likewise h2, h3 always specify that widget.

I do not leave it to chance for any search engine to guess or assume what that individual page is about.

Then again, all my pages are hand-made.

So the previous and this SPAM Update removed all those niche resellers. They have been replaced by "solo" websites only giving 1 or a very small slection and showing very little expertise.

In other words, what Google removed has left mostly spam and low quality sites. Google restricting access to niche sellers with a wide variety of variants and niche specific expertise, while displaying variants in ads, is a sure fire way for Google to increase ad clicks. For sellers using G ads, such a policy would also reduce their ROI and would undoubtedly increase items returned by customers.

What's not so unique about this spam update are people reporting a large increase in AI O's. This too has an impact on niche sellers as they often demonstrate their product expertise with supporting authoritative content. The impact also extends to manufacturers who produce the product variants people are buying and who ultimately hold the highest level of knowledge for the items they produce.

@Redbar,

when i say a big selection then i mean like 6-8 manufacturers with about 2500-3000 variants. I don´t know how to get each unique. (We do have aggregate pages with canonical-tag).
So a item-serie doens´t span to 200 pages with only slightly different title, h1, h2. But 1 unique summary-page. We do not use AI. All handwritten.
Disadvantage: the page will propably not show up for long tail keyword searches

the problem with the SPAM Update is that if your site has a big selection of same items from different manufacturers ( and has variants of it like lenght and color ) the algo will see this as SPAM.

It's on you. You forgot to inject EAT and first person experience with those product variant specifications. You also forgot about information gain and unique experiences that you have to add. And you forgot to create TickTock and YouTube video with yourself dancing and reading those product specs.

Now do all that and stop being a spammer, start providing value!

It would have been too good to be true. The spam update ends and we finally get some peace and quiet, but nope. All the signs of another update are there: massive volatility, tanking rankings, and ad performance hitting zero once again. Basically, everything we usually experience during an update. Google probably figured they hadn't pushed enough spam sites to the top yet.

By the way @Whitey: honestly, I didn't see spam sites disappearing at all. Quite the opposite, actually. As soon as the spam update wrapped up, sites churning out mass AI content completely dominated one of my niches. I keep wondering what all these "SEO experts" are actually looking at, because I can never replicate or confirm their findings.

@christianz, I don´t know if you have read my comment. We do not have all this variants as pages itself. We have a aggregate pages ( please get info what this is, if you don´t know it) with lots of infos, pictures, videos and instructions.

Once again for you: with aggregate pages you loose long tail searches.

We do not have all this variants as pages itself. We have a aggregate pages

My point stands. Many small pages or larger aggregate pages - they are all useful, helpful and exactly what searchers are looking for. Except super dumb LLM pea-brain ranking algo assumes that everything that is not a TickTock video is spam.

Observation from last core updates and our pages, we hit finaly back to number #1 from all competitors that we have. This meens, we didnt do anything wrong, only a bit small and better improvments that we did on pages few months back. Before that we have 3th position on google for 10+ years with highest rank of keywords. Blocking also specialy digitalocean, china, taiwan etc.. And also some other countryes that we track each day over server log.

Early signs of what we know already?

[seroundtable.com...]

Traffic on my news site has completely tanked over the last 48 hours. Google had an indexing bug that hit news publishers hard. Right now, Discover is completely dead for us, and Google News is pure chaos. (As a side note: my personal Discover feed looks hilarious right now, it's nothing but AI spam). The strange part: Our rankings actually improved in the SERPs. But this situation just proves that traditional organic search is basically dead for news sites now. We are getting maybe 100 clicks a day, despite holding #1 spots and Google's AI Overviews (AIO) pretty much exclusively citing us for niche-specific queries. The CTR is just nonexistent.

On the other hand, our shop is holding up okay. Sales have been slightly weaker over the last three days, but it’s still bringing in decent revenue, even though visitor numbers are slightly down there as well.

@Whitey Google just wants to scrape our content to feed their AI, they couldn't care less about the publishers. Is anyone actually surprised at this point? I'd bet that in a few weeks, the standard organic links below the AI Overview will disappear entirely, and we’ll only be left with the AI box.

Traffic seems to be about average for my sites but with it being our last holiday weekend until Xmas I expect lower numbers.

A couple of Cloudflare updates and further observations.

1. My sites not at CF are seeing even higher attacks. This is now two weeks of constant hammering. All non-CF sites have seen in-excess of 100K failed PVs this month so far, it's ridiculous.

2. CF seems to have been more effective on my .co.uk sites.

3. Whilst several .com sites have seen substantial falls, a couple of them saw a bounce up again for a couple of days but have now gone down again.

4. The biggest issue I have had is with domain-specific email. I have followed CF's instructions yet can't get it to work. It's probably something simple however I can't move any site that uses its own email server at the moment ... Any ideas?

I still cannot make head nor tail of the CF stat charts etc ... They're writing a completely different language to my comprehension ... This probably goes for the email too.

Lastly, I am going to experiment with a Plesk server again to ascertain whether this is a CPanel issue. I was on Plesk for many years and never had anything like the grief CPanel has given me the last two years ... Thoughts?

I have followed CF's instructions yet can't get it to work. It's probably something simple however I can't move any site that uses its own email server at the moment ... Any ideas?

I still cannot make head nor tail of the CF stat charts etc ...

Perhaps such questions/concerns would be better addressed in Cloudflare's community forum? [cloudflare.community...]

@RubicCubed

I have tried to understand CF, it seems to be a completely different language to mine. I was hoping that someone here has practical experience they could impart?

Trying to make sense of most things these days seemingly generates gobbledygook, distraction by confusion :-)

Living in a time when we experienced human and bot traffic invert, where bots now greatly outnumber human visitors, has been maddening. Unfortunately it's getting much worse with AI agent traffic rising 45% in a single quarter (DataDome [datadome.co...] ). This same company also recently reported DDR5 RAM scalpers are hitting a RAM seller's site so hard that 91% of the traffic are bots.

Just like GA4, programmers who have built these tools and user interfaces failed to account for the simplicity that newly onboarded end users need to confidently use their tools without being burdened with a ridiculous learning curve. I doubt this will change much as they add new confusing layers onto the existing foundation of confusion their tools are built on. I'm not a CF user, but I do hope you get everything sorted out to benefit from blocking as many unwanted bots as possible.

@RedBar - interesting that you’re seeing the same sustained hammering we’ve been seeing. We’ve just enabled Cloudflare Bot Fight Mode and the early signs are that it has reduced the bad traffic/CPU load quite noticeably, although some still gets through.

Your point about the non-CF sites getting hit harder is probably the most telling part. I’d be interested to see whether that gap remains after another week or so.

New month, new thread here: [webmasterworld.com...]

[edited by: not2easy at 11:24 am (utc) on Sep 1, 2026]
[edit reason] New month, new thread [/edit]