This is the news from Friday 6 November. Read the latest news
Daily news
WooCommerce 11.2.2 security fix, WordPress /random/ and more
Today in 30 seconds
- WooCommerce 11.2.2 is a security release, so update your store today
- WordPress 7.2 adds a /random/ URL to every site by default
- Cloudflare shows personal AI agent traffic and lets you block each one
- Netlify will let companies take over accounts on their email domain
- Facebook has 6 million AI “Answers” pages indexed in Google
- Google AI Mode now books plumbers and cleaners in the US
- Google drops site reputation penalties in Europe
- VLC’s teapot error shows how Google treats 4xx codes
- ChatGPT Images 2.6 makes GIFs and exports SVG files
- Meta buys Conductor, and its cloud data is deleted from 20 November
- Apple lets apps offer a deal when you cancel a subscription
Good morning. Today is a big one for store owners and WordPress fans. WooCommerce has a security release, and WordPress 7.2 is about to roll the dice on your content. Literally.
WooCommerce 11.2.2 is a security release, so update your store today
WooCommerce 11.2.2 came out on 4 November. Woo calls it “a security release with multiple security updates” and asks stores to update as soon as possible. The fixes cover Store API cart quantities, REST API key logins, local pickup tax and the product CSV importer.
Store API checkout now stops if the order fails to save, instead of moving on to payment. Two Jetpack-related wc-admin endpoints now need a logged-in admin in a browser. REST API keys, WP-CLI and application passwords get a 403 error there.
Why it matters Every WooCommerce store should take this update. If a tool or script calls those Jetpack endpoints with an API key, test it after you update.
Take a backup first, then update. It takes two minutes and saves a bad day.
WordPress 7.2 adds a /random/ URL to every site by default
WordPress 7.2 will add a /random/ address that sends visitors to a random published post. It is on by default. It works for archives too, like /random/category/news/ or /random/author/name/. Pages and attachments are left out.
You can change the base word on the Permalinks screen. Developers can turn the whole feature off with the wp_enable_random_content_redirect filter. Custom post types join in by default when they are public and have an archive.
Why it matters Every WordPress site gets new public URLs. The query uses ORDER BY RAND(), which can be slow on big sites. Check that your cache and SEO plugin handle these redirects well.
I like the fun of it. But I would rather have a switch in Settings than a filter.
Cloudflare shows personal AI agent traffic and lets you block each one
Cloudflare now shows visits from personal AI agents, the ones that browse for a human. Security Analytics has a new “Personal Assistants” category with request counts for each agent. The old “Configure AI bot policies” setting is now “AI Crawler and Agent access policies”.
You can now set a rule for each supported agent. The choices are “Allow”, “Block on pages with ads” and “Block”. Your search and training rules stay the same. Cloudflare has not listed the supported agents or plans yet.
Why it matters Sites that live on ads can block agents only on ad pages. That keeps the rest of the site open to people who use AI helpers.
New to Cloudflare? Start with my Cloudflare 101 guide.
Netlify will let companies take over accounts on their email domain
Netlify updated its terms and privacy statement, starting on 4 December. A company that proves it owns your email domain can see your account and its public sites. It sees the plan, site names, URLs and last deploy dates. It cannot see your name, payment details or private sites.
If that company has a Netlify subscription agreement, your account may move into theirs. Netlify will warn you first. If you don’t change your email in time, the company controls the account and its content.
Why it matters Freelancers often host client or personal sites under a work email. Check the email on your Netlify login before 4 December. To opt out of visibility, email [email protected].
Facebook has 6 million AI “Answers” pages indexed in Google
Meta publishes AI-written summary pages under facebook.com/fb-answers/, built from public Facebook posts. Glenn Gabe says the folder started filling in July and now has over 6 million indexed URLs. He says it ranks in blue links, AI Overviews and AI Mode.
Gabe calls it “Scaled content abuse”, the same name Google’s spam policy uses. Barry Schwartz has heard rumours that Instagram is doing something similar, but nothing is confirmed.
Why it matters Small sites get hit for mass AI pages. If a giant gets away with it, that tells you a lot. Watch whether Google acts.
Google AI Mode now books plumbers and cleaners in the US
Google AI Mode can now show direct booking and quote links for home services in the US. It works through partners. Jobber users with a paid plan and a linked Business Profile get a “Book Online” button. Housecall Pro will auto-enrol its pros soon. Angi quotes go through the pro’s Angi profile.
ServiceTitan is “coming soon”. Businesses that use none of these tools have no way to get direct bookings from AI Mode yet.
Why it matters For local trades, the booking button may move from your website into Google’s answer. It is US only for now, but these features usually spread.
Google drops site reputation penalties in Europe
Google is emailing sites with the subject “New Site Reputation Policy Change”. It says old site reputation manual actions “will no longer impact search results shown to users within the EEA”. The change took effect on 30 August, but the emails only arrived now.
Site reputation abuse is often called parasite SEO. A publisher rents part of its site to someone else’s low-value content. Google has not said why the rule now differs in Europe.
Why it matters Publishers hit by this penalty may see European traffic come back. Everywhere else, the rule still applies.
VLC’s teapot error shows how Google treats 4xx codes
VLC’s site started returning HTTP 418, the joke “I’m a teapot” code. Google’s Gary Illyes says Google treats 4xx codes mostly as “not found”. For important pages, Search “temporarily protected the URL” so it didn’t drop out right away.
But the favicon and snippet disappeared. Only the link and the last good title stayed. The site returns 200 again, so Illyes expects the favicon back.
Why it matters A bot shield or CDN rule that sends the wrong code can strip your search snippet fast. My guide to checking headers with curl shows you what Google sees.
ChatGPT Images 2.6 makes GIFs and exports SVG files
OpenAI launched ChatGPT Images 2.6 on 4 November. It turns a prompt or photo into an animated GIF, with speed control and frame-by-frame edits. You can save reference images of yourself, pets or characters to use again. It also adds image markup and SVG export.
It is rolling out to ChatGPT and Codex users on web, desktop and mobile. Two API models are coming. gpt-image-2.6-flare makes images “in as little as six seconds”, and gpt-image-2.6-sunburst focuses on quality.
Why it matters SVG export is the useful bit for websites. Icons and simple graphics stay sharp at any size and stay small.
Meta buys Conductor, and its cloud data is deleted from 20 November
Conductor, a Mac app for running several AI coding agents at once, is joining Meta. New sign-ups stopped on 4 November. Conductor Cloud goes read-only on 13 November, and paying users get refunds.
On 20 November the cloud shuts down and user data deletion starts. The local app stops getting updates in early 2027.
Why it matters If you use Conductor, run “Transfer to local” on each workspace now. You can also export from Settings, Account, Export data. Don’t leave it to the last day.
Apple lets apps offer a deal when you cancel a subscription
Apple added subscription retention messages to the App Store. When someone starts to cancel, the app can show a message with text, images or a special offer. Developers set these up in App Store Connect for auto-renewing subscriptions.
They choose who sees the message and how long to wait between messages. A separate Retention Messaging API picks a message for each subscriber. Developers must ask Apple for access to it.
Why it matters If you sell app subscriptions, this is a free way to keep customers. Keep the offer honest and easy to skip, or it will annoy people.
Quick hits
- Search Console now lets you pick several device filters at once in the Performance report. Search Engine Roundtable
- Google AI Mode checkout reaches Canada, with select Shopify merchants at launch. Search Engine Journal
- GitHub Copilot now works inside Xcode’s coding assistant in the Xcode 27.3 beta. GitHub
- Netlify published a JSON schema for
netlify.toml, so editors can autocomplete and check it. Netlify - Cloudflare AI Gateway adds model aliases, so you can swap models without redeploying. Cloudflare
- Go 1.27 makes
encoding/json/v2stable, with unmarshalling up to 10 times faster. Go Blog - Safari Technology Preview 256 fixes
document.fonts.readyhanging when a font fails to load. WebKit - Cognition SWE-2 Flash is a faster coding model, free in Devin until 30 November. Unite.AI
- Logic Pro 13 adds a searchable sound browser and splits drums into kick, snare and hi-hat. MacRumors
- Apple’s touchscreen MacBook Pro, M6 iMac and new iPad mini go on sale today. MacRumors
You're all caught up
That's today's web, tech and SEO news. The next edition lands tomorrow morning, around 3 am Melbourne time.That was the news from Friday 6 November. A newer edition is waiting for you.
Read the latest news → ← Thursday's news Every edition
Get the news by email
One short email every morning. Free, and you can unsubscribe any time.
That’s you caught up. Need a hand with the WooCommerce update or that new /random/ URL? My site updates team can test and update your store safely. See you tomorrow.
Opens in a new tab
Comments
No comments yet. Questions, fixes and better ways are all welcome.