In the movie Flatliners, a group of medical students experiment with dying for a short period of time to see what’s beyond, only to be revived quickly after. I couldn’t help but think of this movie while recently helping a company that was in a dire situation. The following case study represents the SEO version of Flatliners… and I’ll take you through the details in this post.
The case had me wondering if there is some type of algorithmic timeout that can occur without a message showing up in Google Search Console (GSC) in either the manual actions viewer or security issues report. In other words, can a site “spook” Google somehow and receive a timeout?
Or maybe there was an algorithm that updates monthly, and this site triggered some type of demotion for some reason, only to be cleared when the algorithm updated the following month? I’ll explain more about my thoughts soon.
It was a scary situation for the company, and I believe more site owners and SEOs need to know about it. It underscores the fact that you’re not in control – Google is. And if something goes wrong, and your rankings drop for some unknown reason, site owners can feel absolutely hopeless while their sites hemorrhage money.
The site owner I helped was nice enough to let me write up this blinded case study. His company experienced a crazy one-month drop back in late February. Let’s jump in.
I created a quick table of contents in case you are interested in jumping to a specific section. That said, I do recommend reading the entire post from start to finish (to get the full picture):
- The Drop – Sunday, Bloody Sunday
- The Discovery Phase.
- Sharing SSL Certificates and IPs.
- Quality Indexation.
- It’s ALIVE!
- What caused this? Security timeout, an algorithm updated monthly?
- Key learnings and 7 important questions for site owners.
Sunday, Bloody SEO Sunday
Wednesday, February 20th started out normally for me. I was cranking out work early in my office, then hit Twitter and my feeds to check the latest technology news, and then settled back into client work at 9AM.
Then at 9:20, I received an email from the CEO of company I’ve known since 2014 when medieval Panda roamed the web. The subject line read, “Google Drop”.
He asked if there was a recent algorithm update, since his site just saw a drop a few days prior. And it wasn’t a small drop… so he was extremely concerned that another major update could have rolled out.
The site’s Google organic traffic dropped 94% starting exactly at 6PM on Sunday evening (2/17). By the way, keep 6PM in mind… we’ll be coming back to that time soon.
Here is what the drop looked like. First, this is the daily trending:
And here is the drop at 6PM when checking hourly:
And here is the massive drop in average position:
It was also interesting to see crawling drop off a cliff once the rankings drop happened. It’s almost like something internally at Google demoted the site and then even slowed crawling of the site. Here are crawl stats from GSC:
And here is a screenshot based on analyzing the site’s log files in Screaming Frog Log Analyzer. Notice the big drop in Googlebot (verified) crawling the site:
In addition, the site’s xml sitemap wasn’t being crawled frequently anymore (much less than it previously was). So, with whatever happened, it seemed that Google had flagged the site, demoted the site, and wasn’t applying many resources to the site from a crawling perspective.
Needless to say, the CEO was freaking out a bit since a majority of the site’s traffic (and revenue) come from Google.
What happened? The Discovery Phase
I’ve seen a lot of big drops over the years, but this one just seemed strange… First, 94% is a massive decrease… one of the worst I have ever seen. Second, there wasn’t a major algorithm update that Sunday, which ruled out a broad core ranking update. Note, you can still experience a drop for a number of reasons beyond broad core updates, but massive algorithmic drops like this are often associated with core ranking updates.
Next, I quickly checked for manual actions and there were no manual actions showing in Google Search Console. There also weren’t security issues showing up in GSC, like malware, hacked urls, etc. So, the two major culprits beyond an algorithmic hit could also be ruled out. Or could they? More about that soon.
My next move was to ask about recent site changes. Actually, the CEO beat me to the punch via email and explained an interesting recent change. He explained that they were toying with the idea of reincluding a forum they used to have on the site. They activated the forum subdomain the Friday before the Sunday drop and reinstalled the forum software.
There was no content on the forum subdomain yet… just the fresh install of the software. They were simply configuring the forum when the drop occurred on Sunday, 2/17. Google did end up crawling and indexing a few pages from the forum setup, but again, there wasn’t any real content in the forum during that time.
But, Google clearly knew about the forum (since it was starting to be crawled and a few pages were indexed). Also, by the time the CEO reached out to me on Wednesday, they had already turned the forum subdomain off. Regardless, I already started thinking about the forum’s history…
Beyond the forum change, there were no major changes implemented on the site recently. Therefore, we had what seemed to be an interesting cause and effect relationship. Again, there was a Friday forum reinstall and then a Sunday drop. History-wise, the forum used to be on that forum subdomain (forum.domain.com) and then was moved to a subdirectory on the www subdomain during medieval Panda days. The forum was shut down due to inactivity and some lower-quality content years ago.
Sharing SSL Certificates and IPs – Cloudflare Anomalies
Disclaimer: There are many, many sites using Cloudflare that haven’t been negatively impacted by sharing SSL certificates or IPs, but I had to bring this up based on what we found. I’m not saying this was the case, but it sure looked fishy.
The site uses Cloudflare and was sharing an IP and SSL certificate with about 15 other sites. The subdomain had to be configured on Cloudflare when it was set up that Friday, 2/17. When checking some of those other sites that were sharing an IP and SSL certificate, you could see some risky/shady things going on. There are other case studies that brought up the potential negative impact of sharing IPs via Cloudflare, so this was an interesting find.
Note, Google has always said that sharing IPs is fine and should not cause any crazy impact on a site (even when asked about Cloudflare directly). But, there are cases of sites dropping that were sharing IPs when risky/dangerous sites were part of the mix.
Of course, the drop absolutely could have been the forum situation alone, or a combination of the forum situation and sharing IPs with shady/risky sites, or even something else. It’s impossible to know, but I wanted to bring this up since the CEO spent a lot of time digging into the Cloudflare situation.
After identifying some of the other sites that were sharing the same IP, the company set up a private SSL certificate and was able to get a different IP after the drop. Again, we don’t know if the Cloudflare situation was the issue, but after checking the risky sites sharing the same IP, I think it was a good idea to implement those changes. The changes were completed on February 24.
The Waiting Game and Digging In Further
At this point, traffic was still down about 94%. The site was flatlining… The only thing we could do was wait to see if the forum and Cloudflare changes acted like a defibrillator and could spark a heartbeat for the site.
Beyond those changes, I wanted to dig in further to see if there were other issues impacting the site. So I fired up DeepCrawl, Screaming Frog, and then dug into Google Search Console. Remember, the site was humming along for years doing well, so it would be very odd to simply drop 94% one day without a recent change. Again, there wasn’t a major core ranking update going on… so it would be odd to drop that much without a manual action or a known security issue. And Google Search Console was all clear from that standpoint.
When writing about major core updates, I’ve often mentioned “quality indexation”. Since Google has explained it takes every page into account when evaluating quality, it’s important to make sure only your best content is indexed (while handling any low-quality or thin content appropriately).
For example, you could boost low-quality content, nuke it via 404s or 410s, or noindex the content if it needs to remain on the site for some reason. I’ve covered this decision matrix many times in my posts about major algorithm updates.
When checking the pages that were indexed, over half of those pages were not submitted in xml sitemaps. That raised a red flag, so I dug in more and focused on those pages. I ended up finding thousands of urls that were lower-quality or thin that were currently indexed. So, we had a situation where approximately 40-45% of the pages indexed were problematic from a quality standpoint.
Now, this is typically something that would manifest itself during a major core update and not randomly on a Sunday night. :) Therefore, I recommended they address the situation, but I wasn’t sure if that would really be causing the issue. They moved quickly to nuke many of those lower-quality pages and most were removed in early March.
Beyond that, there were some issues I picked up here and there, but nothing that should have caused a 94% drop in traffic from Google.
It’s ALIVE! One Month Later… To The Minute
Time went on and nothing changed. Every few days the CEO would email me with an update that typically said, “No changes, still waiting”. The March 2019 core update rolled out on 3/12 and nothing changed with the site. It was still down 94%.
But then something amazing happened. Remember when I said to remember February 17 at 6PM? Well, literally one month later, to the minute, the site started surging. At 6PM on March 17, the site came back to life. It was fascinating to watch.
The CEO sent me an email showing the surge in real-time analytics and was hopeful the trend would continue. And continue it did… The site roared back to life and has been doing well ever since. Here is the trending so you can get a feel for how this played out.
Here is how the hourly trending looked. The site surged right at 6PM:
Here is trending from GSC (clicks and impressions):
Here is the surge in average position:
Again, this was not just a recovery. It was a recovery after exactly one month. And not just one month… it was one month to the minute.
An Algorithm Updated Monthly, A Security Timeout, or Something Else?
This could have been some type of security timeout, but after thinking about it more, it very well could be an algorithm that’s updated monthly (which could also be related to security). Something spooked Google, an algorithm flagged the site, and rankings dropped. Then maybe when the algorithm was updated a month later, the site came roaring back. I can’t say for sure if that’s what happened, but it makes the most sense to me.
Was Google spooked by the forum change? Was it the Cloudflare situation with risky/dangerous “neighbors”? Was it the high percentage of low-quality content that was indexed that finally tipped the scale? Was it a combination of these things?..
It’s hard to say, but I think something with the forum triggered some type of security issue. If that’s the case, it’s just strange that Google wouldn’t report that security issue in GSC… Instead, the site owner was left wondering if his business was burning down to the ground. That’s a good segue to key learnings from this case study.
Key Learnings: The Danger of putting all of your eggs in the Google basket
It’s easy to keep rolling along when things are going well and believe it will always continue. But the reality is that Google pushes changes all the time, some minor, and some major. There are thousands of algorithms at play that could go haywire, there are manual actions, security issues, and more.
Even after years of doing well, it only takes one minute for the train to go off the rails. And it did on February 17 at 6PM for this company. I’ve created a list of bullets that every site owner should go through based on this case study. I would start thinking about these things now, before something goes wrong. Over the years, I’ve spoken with many site owners that have gotten smoked by Google for one thing or another. And I believe all of them would tell you to start thinking about these things immediately.
7 Important Questions For Site Owners Based On This Case Study:
- How much of your traffic, and revenue, relies on Google?
- How can you diversify your traffic so there’s less risk if your rankings suddenly drop and Google traffic dries up?
- If revenue tanks for 30 days, 3 months, 6 months, or longer, how long can your company stay afloat? How can you mitigate that risk?
- Do you have people in place that can effectively handle a catastrophic SEO situation? Are they internal, external, and do you know they will help when the situation goes sideways? Form a plan today with a team that you trust.
- Do you have a system in place for testing and rolling out changes on your site? Will you be able to isolate changes to better understand the cause and effect relationship between those changes and a drop in rankings?
- Do you understand that Google is not perfect, and strange things can happen from a rankings standpoint? You are dealing with algorithms, and those algorithms are not perfect. Collateral damage could occur, and are you ready to deal with that?
- Do you understand that there’s no guarantee that any human Googler will help you if your site drops heavily? You might receive some feedback, or you might just hear crickets chirp. Google doesn’t have to respond to any business owner that’s dropped heavily due to an algorithm update, manual action, security issue, anomaly, etc.
Summary – Be Prepared For SEO Turbulence
Based on what happened in the case above, I do believe the drop was probably based on some type of security issue that spooked Google (when the forum was added back to the site). And that issue caused some algorithm to flag the site, which resulted in a one-month drop (to the minute). Luckily, the “timeout” expired, the algorithm was updated (probably monthly), and rankings and traffic roared back.
My hope is that this case study sparks some questions for you internally at your company. You should think about a worst-case scenario now, before it happens. Have a plan in place for a catastrophic drop, because as this case demonstrated, it sure can happen. I recommend going through the bullets above with your team and forming a plan of attack. I hope you never have to use that plan, but if you do, you can be ready.