Why Did My Traffic Drop? A Search Console Walkthrough to Tell the Cause

A Google traffic drop usually traces to one of seven causes, and Google Search Console can tell most of them apart. Google’s own debugging guide names six: algorithmic updates, technical problems, security issues, spam violations, seasonality and site migrations. The seventh is not on Google’s list: people see your link in an AI answer and never click.

This is the second follow-up to our explainer on what a Google spam update is. It answers the question readers asked next: which thing happened to me? It walks through seven checks in order, using the Performance report, the Search Status Dashboard and four other Search Console reports, and ends with a decision table.

The short version: compare clicks and impressions separately before you touch anything. If both fell when a posted update began, look at algorithmic causes. If both fell with no update, check indexing and security. If impressions held and clicks fell, the traffic drop probably comes from how the results page presents you, often AI Overviews. Manual actions and security issues are the only causes Google reports to you directly.

What Google says causes a traffic drop

Google’s guide on debugging drops in Search traffic, last updated December 10, 2025, lists six main causes.

• Algorithmic updates: core updates and smaller ranking changes that can lower how your pages perform.
• Technical issues: errors that stop Google from crawling, indexing or serving your pages.
• Security issues: malware or phishing that makes Google warn users before they reach you.
• Spam violations: pages that break Google’s spam policies, found by automated systems or a human reviewer.
• Seasonality: changes in how many people search for your topics.
• Site migrations: URL changes that cause rankings to move while Google recrawls.

Click loss to AI Overviews and AI Mode is not on the list. The guide does describe that shape of traffic drop: when impressions stay the same and clicks fall, you "might not be generating the best page title and snippet." AI features that answer the question on the results page are another explanation. Step 7 covers how to tell them apart.

Step 1: Measure the traffic drop in the Performance report

Open the Performance report for Search results. Google’s guide recommends two views.

First, set the Date filter to Last 16 months. Seasonal dips stand out across a full year. If traffic fell every October, a traffic drop this October is less alarming.

Second, open the Compare tab and choose Compare last 3 months year over year. That strips out most seasonality and shows what changed.

Now look at clicks and impressions as separate lines.

• Clicks and impressions both fell. Fewer people saw your pages. That points to rankings, indexing, security or demand.
• Impressions held and clicks fell. People still saw your pages but clicked less. That points to how the results page looked.

Also try the Search type filter. According to Google’s AI features documentation, AI Overviews and AI Mode are counted inside the Web search type, not as a separate type.

Step 2: Read the shape of the traffic drop

The shape of the line says a lot before you open another report. Google’s debugging guide sketches the patterns. It pairs a large, sudden traffic drop with an algorithmic update or a site-wide security or spam issue. Seasonality shows as a repeating dip. A page-level problem, such as a misplaced noindex tag, produces a slower drop, because each page falls out only after Google recrawls it.

Then ask where the drop sits. Click the Pages tab and sort by the change in clicks.

If one section fell and the rest held, the cause lives in that section. If every section fell by a similar share, look for something site-wide: a core update, a server problem or a security warning.

Last, check whether the drop is yours alone. Google’s guide suggests using Google Trends "to understand whether the drop is a wider trend or if it’s just happening for your site." A traffic drop that everyone in your field sees is not a ranking problem.

Step 3: Line up the dates with the Search Status Dashboard

The Google Search Status Dashboard tracks four services: Crawling, Indexing, Ranking and Serving. Ranking is where core updates and spam updates are posted, each with a start time. Google posts again when a rollout finishes.

Compare the start of your traffic drop with that list. The ranking updates history shows these entries for 2026 so far.

A traffic drop that starts inside a rollout window is a candidate for that update. One that started two weeks before any update has another cause.

Do not judge mid-rollout. Google’s core updates guidance recommends "waiting at least a full week after a core update completes before analyzing your site in Search Console." It suggests comparing the week after with a week before the rollout began. The same patience makes sense for spam updates.

Check the Crawling, Indexing and Serving rows too. A wider Google problem on the day your traffic fell may show there.

Step 4: Rule out a manual action

This check takes one click. Open the Manual Actions report.

A manual action means a human reviewer at Google found pages that break its spam policies. Unlike an update, it comes with a notice, in the report and in the Search Console message center. The report shows a count at the top. If you have none, you see a green check mark, and whatever happened was not a human review.

If you have one, the report names the type. Google’s list includes user-generated spam, site abuse with third-party spam, unnatural links, thin content, cloaking and sneaky redirects, and site reputation policy violations. Fix every affected page, then choose Request Review and explain what you changed. Google says most reconsideration reviews "can take several days or weeks," and link-related ones can take longer.

A spam update is different. It is automated, it sends no message, and there is no review to request.

Step 5: Check for hacked content and security warnings

Open the Security Issues report. It covers three groups: hacked content, malware and unwanted software, and social engineering such as phishing. Google defines hacked content as "any content placed on your site without your permission because of security vulnerabilities."

A security issue causes a traffic drop even when rankings hold. Google may show a label in results or a browser warning page before visitors arrive. According to Google’s help page on the "This site may be hacked" message, that label appears when Google believes a hacker "might have changed some of the existing pages on the site or added new spam pages."

Two quick checks help even when the report is clear.

• Search your own domain. Try site:yourdomain.org with words like “casino,” “pharmacy” or “loan.” Pages you did not write are a warning sign.
• Look at the Pages tab again. Impressions on URLs you do not recognize, often in odd folders or with random names, suggest injected pages.

Unpatched plugins are a common way in, such as the WordPress file upload flaws under attack in September or the Drupal Webform release with 20 advisories. Once the site is clean, request a review from the Security Issues report. Google says most of these reviews also take several days or weeks.

Step 6: Check indexing and crawling for technical problems

Two reports cover technical problems.

The Page indexing report shows an Indexed versus Not indexed chart. A jump in Not indexed pages at the start of your traffic drop is a strong signal. The report gives a reason for each group. Watch for these:

• Server error (5xx): your server failed when Google asked for the page.
• URL blocked by robots.txt: a robots.txt change is keeping Google out.
• URL marked ‘noindex’: a template, plugin or staging setting told Google to drop the page.
• Redirect error and Not found (404): often the mark of a migration that missed some URLs.

A stray noindex tag is a common cause after a redesign or a CMS update.

Next, open Settings, then Crawl stats. The Crawl Stats report shows host status for robots.txt fetching, DNS resolution and server connectivity. On robots.txt, Google says that if the request returns neither a valid file nor a 404, "Google will slow or stop crawling your site."

Use the URL Inspection tool on a few pages that lost traffic to confirm what Google sees. After a fix, click Validate fix in the Page indexing report. Google says validation "typically takes up to about two weeks." Our technical SEO foundations guide covers the preventive side.

Step 7: Test for AI Overviews and AI Mode click loss

This is the traffic drop pattern from Step 1: impressions hold, clicks fall, and nothing in Steps 3 to 6 explains it.

Start with how Google counts these features. According to Google’s help page on impressions, position and clicks, "An AI Overview occupies a single position in search results, and all links in the AI Overview are assigned that same position." Clicking a link in an AI Overview or in AI Mode counts as a click. So a page cited in an AI Overview can hold a good average position and a steady impression count while its clicks fall.

Then open the generative AI performance report. It shows impressions in AI Overviews and AI Mode by page, country, device and date. As of August 31, 2026, Google says it has reached all websites. It does not show clicks. We looked at that gap in our piece on the generative AI performance report.

Put the two reports side by side. This is our method, not one Google publishes:

1. List the pages that lost the most clicks in the Performance report.
2. Check whether the same pages carry many impressions in the generative AI performance report.
3. Check whether their click-through rate fell while average position held.

If all three line up, AI features are the likely cause. Outside research supports the size of the effect. Pew Research Center found users clicked a traditional result in 8% of visits when an AI summary appeared, against 15% when one did not. That study used March 2025 data from 900 US adults.

What to do when AI features are the cause

On pages with little AI exposure, Google’s own suggestion still applies: test better titles and snippets. Where clicks went to AI answers, a title rewrite is unlikely to bring them back. Deleting those pages is a common reaction, and we covered why content pruning is the wrong response to AI Overviews. Small sites should also check whether the traffic drop is real or noise. Our look at publisher traffic at small scale shows how one page slipping can look like a collapse.

Telling a spam update from a core update

Both are automated, both are posted on the dashboard, and neither sends a message. The timing tells you which update. The pattern tells you what kind of problem.

A spam update traffic drop tends to hit the pages that break a policy, such as a sponsored section, bulk-made pages or a hacked folder. The rest of the site can hold steady. Google’s spam updates documentation says sites that break its policies "may rank lower in results or not appear in results at all." Recovery may come "over a period of months" once the systems learn the site complies.

A core update drop is often spread across the site, and it does not mean you broke a rule. Google’s core update guidance says a page moving from position 2 to 4 needs no drastic action. A move from 4 to 29 calls for a deeper look at whether the content is helpful and reliable. Improvement can take "several months," and sometimes the next core update.

If the drop matches a spam update window, go back to Step 5 and to the policies in our spam update explainer. Hacked pages and user-generated spam are the two you can break without meaning to.

The traffic drop decision table

Use this after Step 1, once you know whether impressions fell along with clicks.

More than one row can apply. A site hacked through an old plugin during a spam update window can show both. Start at the top: the manual action and security checks are fastest and have the clearest fixes.

Frequently Asked Questions