June 2026 SEO changes

#Introduction

June 2026 packed more consequential search news into four weeks than most quarters manage. Google finished a Core Update that ran nearly twelve days, added an AI performance report and an opt-out toggle to Search Console under regulatory pressure, published guidance that quietly told the AEO and GEO industry its favourite tactics do not matter, and shipped a Spam Update. In the background, Cloudflare confirmed that machines now make more requests to the web than people do, and a wave of unexplained deindexation kept SEO forums busy.

This is the WordPress build perspective on all of it. Not a recap of who tweeted what, but what each change means for teams shipping and maintaining WordPress sites, and which of these developments actually require action.

#The May 2026 Core Update was the real one

Google confirmed the May 2026 Core Update finished rolling out on 2 June 2026. The rollout took 11 days and 21 hours, from 21 May to 2 June, marginally shorter than the two weeks Google projected. The SEO community’s read was blunt: March was weak, May was significant. Gambling, YMYL categories like health and finance, and e-commerce sites recorded the largest losses.

The pattern is what matters for WordPress teams. Analysts described this update as resembling classic pre-AI-Overviews core updates: genuine expert content gained, generic and thin content lost. That is not a new instruction, but it is a useful confirmation. The sites that dropped were rarely broken on the technical side. They were WooCommerce catalogues with duplicate category descriptions, blog archives padded with AI-spun filler, and service pages that repeated the same three sentences across forty city variants.

Google’s own advice is to wait a full week after a rollout ends before analysing Search Console, which for this update means around 9 June. That waiting period is not bureaucratic caution. Ranking data stays volatile for days after Google marks a rollout complete, and reacting on day-two data usually means chasing noise. Note the dates in Search Console with an annotation, hold, then compare a stable week against a stable week.

The practical takeaway is old and correct: consolidate thin pages into fewer strong ones, kill duplicate category and tag archives, and make sure every page that ranks answers a question a real person asked. WordPress makes it trivial to publish a thousand pages. Core updates keep punishing sites that did.

#Search Console got an AI report, and Google was forced to build it

On 3 June 2026 Google added two things to Search Console: a dedicated performance report for generative AI surfaces (AI Overviews and AI Mode), and a toggle that lets site owners opt out of those surfaces without losing their classical organic rankings.

This was not a goodwill gesture. The UK Competition and Markets Authority required it under the Digital Markets, Competition and Consumers Act 2024, the first legally binding requirement of its kind anywhere. The CMA said publishers gain more control and a stronger negotiating position over how their content is used. The rollout started with a subset of UK site owners.

Read the fine print before you celebrate. The AI report shows impressions only, with no clicks and no CTR, broken down by page, country, device and date, and the data only reaches back to 18 May 2026. The opt-out toggle went live on 17 June, works at the whole-site level, and does not cover the Gemini app.

For WordPress teams the impressions-only limitation is the story. You can see that AI Overviews showed your page, but not whether anyone clicked through. That makes it a visibility signal, not a traffic signal, and it should be treated as such in reporting. Do not let a client read AI impressions as sessions.

The toggle deserves a hard warning. It is all-or-nothing per site, and there is no per-page control. For a commercial WordPress site that already earns qualified referrals from AI surfaces, flipping it off removes visibility you cannot selectively get back. The only clear case for opting out is a site whose content is being summarised so completely that AI answers cannibalise the click without ever sending it. That is a business calculation, not a default setting.

#Bots now make more than half the requests to the web

On 5 June 2026 Cloudflare confirmed that bots generated more than half of all HTTP requests to HTML pages for the first time in the history of the web. Automated traffic reached 57.3 percent of requests to HTML content, against 42.7 percent human. Cloudflare CEO Matthew Prince noted he had predicted this crossover for late 2027, then early 2027, but agentic traffic grew fast enough to break 50 percent well ahead of schedule.

The breakdown inside the bot traffic is the part WordPress operators should internalise. AI training bots account for 50.6 percent of automated requests. Search bots are only 10.7 percent. The machines reading your site are now mostly there to train models, not to index for a results page.

This has two concrete consequences for WordPress.

First, caching assumptions break. Page cache plugins are tuned for the human pattern: a hot set of popular URLs served repeatedly from cache. AI agents crawl sequentially and exhaustively, reaching deep into rarely visited pages that never sit in a warm cache. A WooCommerce store with 12,000 products can see origin load it never planned for because agents are pulling every product URL, not the top 200. If your host bills on origin requests or you run PHP-heavy templates without full-page caching, that bill is now a real line item.

Second, analytics gets less trustworthy. Traffic, session and engagement metrics without aggressive bot filtering drift further from reality every month. If your WordPress analytics still counts anything that requests a page, your numbers are increasingly fiction. Server-side filtering by verified bot user agents, or a analytics layer that filters automated traffic, is no longer optional hygiene.

#Google told the AEO and GEO industry to calm down

On 5 June 2026 Google published a new documentation page on using third-party SEO tools, services and advice, and updated its “Do you need an SEO?” guide with a section on evaluating recommendations. It named AEO and GEO explicitly for the first time as a service category.

The message was direct. Third-party tools have no access to Google’s internal ranking data and cannot guarantee results. Any firm claiming a close relationship with Google or a “Google-approved” status is misrepresenting itself. That is aimed squarely at the fast-growing market of agencies and tools selling authorised optimisation for AI Overviews.

The guidance also reinforced Google’s 15 May generative AI optimisation document, which listed tactics it considers unnecessary for Search: llms.txt files, special schema for AI, and content chunking.

Here we part company with a blanket reading. Google saying llms.txt does not help Google’s crawler is true and unsurprising: Googlebot does not read llms.txt. But Search is not the only retrieval system on the web anymore, as the Cloudflare numbers just established. llms.txt, Markdown siblings and content negotiation are aimed at AI retrieval agents, not at Googlebot, and Google has no incentive to endorse mechanisms that route around its own products. We keep those signals in place on our own stack for exactly that reason. The correct conclusion is narrower than “GEO is snake oil”: do not buy a llms.txt file as a ranking lever, because it is not one, and treat anyone selling Google-approved AI optimisation as a red flag. The underlying discipline of writing citable, well-sourced content is not folklore.

#The quiet deindexation nobody will explain

Through June, SEO forums filled with reports of silent deindexation. It started when former Google engineer Pedro Dias asked on 30 April whether others were seeing a higher rate of random URL deindexation since early April. The response was large. Practitioners across many countries described the same pattern: pages indexed for years vanishing without a manual action, without crawl errors, quietly landing in “Crawled - currently not indexed.”

John Mueller addressed it on Bluesky with a shrug: some sites grow, some drop, nothing unusual. The industry was not satisfied. Glenn Gabe documented a case study of a site that lost almost its entire index. Search Engine Journal covered it at length, noting that some reports confuse ranking loss with deindexation, but some are genuine, unexplained removals. Google confirmed no change to its indexing mechanisms.

For WordPress specifically, “Crawled - currently not indexed” has a familiar set of causes worth ruling out before blaming an algorithm. Thin or near-duplicate content is the classic trigger, and WordPress generates it by default through tag archives, paginated comment pages, attachment pages and author archives. Before assuming you were caught in a mysterious sweep, check that your XML sitemap only lists canonical, index-worthy URLs, that Yoast or Rank Math is not leaking low-value archives into the index, and that your internal linking actually reaches the pages you care about. Google can be opaque and still be reacting to a genuine quality signal. Rule out the boring explanations first.

#Back button hijacking is now a policy violation

On 15 June 2026 Google’s back button hijacking policy took effect. Google announced it on 13 April and gave site owners two months to comply.

Back button hijacking manipulates browser history so that clicking Back does not return the user to where they came from, but instead pushes them to other pages on the site or to ads. After 15 June, sites using the technique can face both manual spam actions and algorithmic demotions. Google was explicit that responsibility sits with the site owner even when the manipulation comes from third-party library code or ad networks.

This is a direct WordPress concern. The technique rarely comes from a theme a developer wrote. It arrives through ad-arbitrage plugins, aggressive retention widgets, and monetisation scripts that publishers install without reading what they do. If you run display ads on a WordPress site through a third-party network, the manipulation can be injected downstream of your own code, and Google will still hold your domain accountable. Audit what your ad and popup plugins do to browser history. “It was the plugin” is not a defence Google accepts.

#The June 2026 Spam Update

Between 24 and 26 June, Google rolled out the June 2026 Spam Update, the second official anti-spam update of the year. It ran for 2 days and 1 hour, from 24 June at 09:00 PT to 26 June at 10:00 PT. Google described it in standard terms: a normal spam update covering all languages and locations.

No new violation categories were announced. This was SpamBrain enforcing existing rules more effectively. Barry Schwartz confirmed it did not target link spam or the Site Reputation Abuse policy. WebmasterWorld observers judged it stronger than March, with commentary pointing at mass-produced, scaled localisation and comparison sites.

The context matters. Nine days earlier the back button hijacking policy took effect, and three weeks before that Google extended its spam policies to AI Overviews and AI Mode. Google confirmed no direct link between these events, but the direction is consistent. Scaled, templated, low-differentiation content is under sustained pressure, and WordPress is the platform most capable of producing it at volume. If you run programmatic WordPress pages, city-times-service grids, or auto-generated comparison content, this update is a warning shot. Differentiation per page is now the price of survival, and it cannot be faked with a spun paragraph.

#What actually needs doing

Most of June’s news is context, not a to-do list. Three items warrant action for WordPress teams.

• Audit ad and monetisation plugins for browser-history manipulation before the back button policy catches your domain for someone else’s code.
• Fix bot filtering in analytics, because more than half of your traffic is now automated and your reports are drifting from reality.
• Consolidate thin and templated content, because both the Core Update and the Spam Update kept rewarding differentiation and punishing volume.

The rest is worth watching and not worth panicking over. Read Search Console a week after any rollout, treat AI impressions as visibility rather than traffic, and ignore anyone selling a Google-approved shortcut to AI Overviews. Google just told you in writing that no such thing exists.