This week, two critical flaws in PHP, the programming language that quietly runs most of the web, put website owners, hosts and governments on high alert. The issue was nicknamed PHP2Shell, and it was serious enough for the UK National Cyber Security Centre to issue an alert and for some organisations to take their websites offline as a precaution.

If you run a WordPress or WooCommerce site, this affected you, whether or not you heard about it. Here is a plain-English guide to what happened, why it matters commercially, and what you should check now.

What actually happened

PHP2Shell is the name given to two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity. In simple terms, they could let an attacker run their own commands on a web server without logging in, using a single specially crafted request that lands before any of the website’s own code runs.

The timeline moved quickly:

• 17 October: Amazon’s threat intelligence team recorded an attempt to exploit the flaw, four days before it was made public.
• 20 October: details leaked online ahead of the planned disclosure date. PHP brought its fix forward and warned everyone to prepare.
• 21 October, 15:00 UK time: PHP released patched versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35). Cloudflare had already switched on firewall rules for its customers in the early hours.
• 21 to 22 October: security firms reported active exploitation attempts. The NCSC published its alert and priority actions for UK organisations.

The flaws were found and reported by researchers at Wiz, Calif and OpenAI’s Codex Security team. At the time of writing, no confirmed successful break-in had been reported, but attackers were clearly trying.

Why this matters if you are not a developer

PHP is used by around 69% of all websites whose server-side language is known, according to W3Techs. That includes every WordPress site, every WooCommerce shop and a long list of booking systems, CRMs and plugins that sit behind them.

For a business, a compromised website is not just an IT problem. It can mean:

• Malicious redirects or spam pages that Google flags, which can wipe out rankings and organic traffic for weeks.
• Stolen customer or patient data, with the regulatory and reputational fallout that follows.
• Broken checkouts and lost sales, particularly painful in the run-up to Black Friday.
• Paid campaigns sending budget to a site that is down or blocked by browsers.

The scale of the concern was clear from the response. In the Netherlands, several government services, including DigiD and MijnOverheid, were taken offline as a precaution. HR software provider BambooHR did the same across several countries.

The part most people miss: updating WordPress does not fix it

This is the key point for marketing teams. PHP2Shell sits in the server software underneath your website, not in WordPress, your theme or your plugins. Clicking “update” in your WordPress dashboard does nothing here.

The fix has to come from whoever manages your server: your hosting provider, your developer or your IT team. They need to update PHP, restart it properly and, ideally, put a web application firewall in front of the site. If you are on budget shared hosting, or on a server nobody has looked at in a while, that is exactly where the risk sits.

Sites running old, unsupported versions of PHP (8.1 and earlier) are in a weaker position again, because official updates for those versions have ended and fixes rely on backports from vendors.

What you should check now

Use this as a quick checklist with your host or developer:

1. Confirm PHP has been patched. Ask your host for written confirmation that your server is on a fixed version, or has the vendor backport applied.
2. Check your PHP version is supported. If you are on PHP 8.1 or older, plan an upgrade. It is overdue regardless of this incident.
3. Ask about a firewall. A web application firewall (WAF) through a provider such as Cloudflare blocked many attack attempts before the patch existed.
4. Know where your backups are. You want daily, off-site backups that you can restore quickly, not a single copy on the same server.
5. Watch for warning signs. Unexpected 500 errors, new admin users, odd pages in Google Search Console or sudden traffic drops are worth investigating straight away.
6. Follow the NCSC guidance. Its alert on PHP2Shell sets out priority actions, including taking systems offline if they cannot be fixed quickly.

How we handled it for our clients

For the sites we manage, our managed host WP Engine applied the PHP patch across its platform overnight on 21 October and added protective rules at the network edge through Cloudflare and Fastly while the rollout happened. We contacted clients the same day, explained what was happening in plain terms, and confirmed once the patch was in place.

Just as important was what was already in place before the news broke: daily backups, a private code repository and locally saved theme files. That is the difference between a stressful afternoon and a genuine crisis.

The bigger lesson: security is now part of performance

PHP2Shell is a reminder that your website’s security is tied directly to its commercial performance. Rankings, conversion rates and paid media returns all depend on a site that stays online and trusted. The businesses that came through this week calmly were the ones with managed hosting, a firewall, tested backups and a partner who knew who to call.

If you are not sure how your own site is set up, now is a good time to find out, before the next one.

Google has rolled out two new controls that give ecommerce brands something they have never had before: the ability to tell the platform exactly which channels to prioritise when spending your budget. Called Channel Prioritisation and Budget Allocation, they launched globally on 14th October across Search, Shopping, Performance Max and Demand Gen campaigns. For brands running Search campaigns that include the Display Network, a February 2027 deadline applies, and taking no action risks your spend shifting in ways you did not choose.

What the Two New Controls Actually Do

Channel Prioritisation lets you label each channel within a campaign as high or low priority. Google’s AI funds high-priority channels first, working toward your Target CPA or ROAS, before allocating remaining budget to lower-priority placements. Budget Allocation then lets you set a percentage cap on how much daily budget can flow to a low-priority channel. Setting a channel to 0% prevents any spend on it entirely, without removing it from your campaign. For brands that have seen poor returns from Display within Search campaigns, or from Search Partners traffic, this level of control is genuinely new.

The February 2027 Deadline

From February 2027, Google will retire the existing Display Network spend controls within Search campaigns. Because the new system defaults every channel to high priority, advertisers who do nothing could see Display spend increase relative to Search without making a deliberate decision. Google’s recommendation is to set Display to low priority with a 50% budget allocation, which replicates the current Search-first behaviour. Do this now, not in January.

What to Do This Week

Audit every Search campaign that includes the Display Network. Once Channel Prioritisation is live in your account, apply the low-priority and 50% allocation settings to Display. If Search Partners has historically underperformed, use the 0% option to stop that traffic entirely. Account-level defaults can be set once and overridden at campaign level where needed. For Demand Gen campaigns, Google is limiting the rollout until November, so revisit those settings next month.

AI Agent Testing can connect AI to a site, giving it the ability to test AI machine readiness, including whether systems can extract and understand content and whether there are any technical obstacles.

Another function of AI testing is that it also has the ability to perform tasks on a site, such as making a purchase, filling out a form, etc. It can then report on any issues it faces in this regard; this is important as users may start using AI to complete tasks for them more regularly in the future, not just using it as a research tool.

How does it work?

Agentic testing works by connecting an AI Agent to your website using a Model Context Protocol (MCP). The best way to describe an MCP is that it’s like a USB for AI. It gives AI the ability to connect to different software, files or browsers. Chrome DevTools is a set of web development tools provided by Google Chrome. By connecting AI to Chrome DevTools MCP, the AI can then use these tools to analyse your website, report on its findings, and complete tasks such as purchasing, ordering, newsletter sign-up, etc.

What can you learn from AI Agent Testing

• Crawlability and discovery – Can the website’s content and pages be discovered by AI
• Machine readability – Can systems extract and understand the information, H1s, Titles, descriptions, and Schema
• AI Search content readiness – Editorial changes to improve chances of content being used in AI
• Technical and AI-agent obstacles – Technical problems stopping AI from completing tasks on the site
• Improved Conversion Journeys – Can AI interact with the site such as purchases, form fill-outs, etc.? Is everything working properly

How to set up AI Agent Browser Testing

• Install Node.js – Node.js lets you run javascript locally on your computer, which you will need to run the JavaScript program that powers the Dev Tool MCP.
• Install AI Agent – For some of the more popular AI agents such as ChatGPT and Claude, you can’t always connect an MCP to the web version of the app. In such cases, you will need to either download the desktop version or connect to them via your computer’s command centre, PowerShell. (If you are on Microsoft)
• Set up Chrome Dev Tools MCP – Connect Chrome Dev Tools to your chosen AI Agent. If using the desktop app there should be some built-in app connections or you may need to connect it manually using PowerShell commands.
• Prompt the AI – Once your AI Agent and MCP is fully connected, you need to make sure you prompt the AI correctly so it pulls through the sort of information you want, but don’t

Results

AI Agent Testing provides businesses with a way to understand how prepared their websites are for an increasingly AI-driven internet. By connecting an AI agent to Chrome DevTools MCP, businesses can assess how easily AI systems can extract and understand their content, identify technical issues and test whether AI agents can complete tasks such as navigating pages, filling out forms and making purchases.

What is content pruning?

Content pruning is a process used to remove content that no longer serves a purpose. This could be because it’s become outdated, is no longer relevant to a business’s offering, or simply isn’t of a quality that reflects business standards.

When content is removed from a site, redirects may need to be put in place to send users and search engines to a relevant, existing piece of content. This could be:

• A newer version of the content
• A relevant alternative resource
• A category page providing a range of related resources
• A relevant service or product page

If there’s no suitable replacement, the page may be removed without a redirect.

How to decide what content needs to be pruned?

Pruning isn’t just done on a whim; it’s a tactical decision made through content analysis. Often the result of a content audit, which collects data on content performance to give insight into what works and what doesn’t and can often help rationalise decisions to delete content.

Considering factors as mentioned above, it essentially boils down to relevance and quality; a simple read-through often indicates whether something needs to be removed or revived. A content audit, which looks at metrics like click-through rate, views, average engagement times, and revenue earned, can reveal what isn’t performing by metrics.

In this process, there’s usually a benchmark for good, needs work, and bad. It’s content that either needs work but isn’t worth the time and resources, or that is bad and will be best suited for pruning. If content has consistently lost traffic and fallen in ranking, then it likely demonstrates the need to delete or at least review it for elimination.

An equal opportunity for removal is when the content is not attracting the right audience, often not relevant to your business’s offering.

An added benefit of removing content is removing index bloat. That essentially takes up space as Google’s indexing crawlers scan content that is no longer relevant, instead of content which would potentially build authority, send trust signals and help with rankings.

How often should content be pruned?

There’s no set frequency for how often you should prune content. As long as content remains useful, relevant and informative to your audience, there’s no basis for removal. Once content no longer has a lasting purpose, that’s an indicator that you may need to remove it.

A good frequency to check content relevance and performance is roughly every six months. Tracking it every time you check it helps you spot an overall trend in its performance; those with declining metrics indicate a need for renewal or elimination. 

A good pattern to establish is to do monthly monitoring, checking for significant traffic fluctuations or ranking drops. Every six months, you can then review the wider content library, allowing you to identify pages that need merging, updating or removing. Annually, reassess whether content still aligns with business services, the audience and your wider marketing strategy.

Keep your content relevant

Content pruning is an important part of maintaining a healthy website, ensuring your content continues to serve a purpose for both your business and your audience. By regularly reviewing performance, relevance and quality, you can identify opportunities to update, consolidate or remove content that no longer adds value.

Ultimately, content pruning isn’t about reducing the number of pages on your website, but making sure the content you have is working as effectively as possible.

When organic growth stalls, creating new content is one of the ways to get things back on track. A new blog post, a new landing page, a new service page- but is it always the answer? A new page is not always the best way to improve SEO. Before you create another piece of content, look at existing content to see if it can be improved

Why not just publish more content?

A new page starts from zero. It has no links, no history, and no proof it deserves to rank. It also has to be crawled, indexed and understood, and then it competes with established pages that have years of authority behind them.

New content also runs the risk of hurting existing content; if it overlaps with something you’ve already published, it can compete with your own pages for the same queries, also known as keyword cannibalisation, leaving you worse off than before.

Where the faster wins usually are

Pages already on the edge of page one If a page ranks in positions 8 to 20, Google already understands the page and the topic. Sharpening the title, expanding thin sections, and adding internal links can move it far faster than a new page could.

Internal linking. Many sites have strong pages that barely pass authority to the pages that need it. Adding relevant internal links from high-traffic pages to important commercial ones is low effort and often overlooked.

Indexing and technical health. If valuable pages aren’t being indexed because the crawl budget is being wasted, more content only makes the problem worse.

When to create new content

Optimising existing pages isn’t always the answer. A new page makes sense when there’s a clear search intent that your site doesn’t address or maybe you’re launching a new service or location that fills a gap in the market.

What this means for your business

Good SEO isn’t about producing the most pages. It’s about getting the most from the ones you have, then adding new content where it fills a real gap. If your brand is constantly creating new pages you may be losing focus on your existing content.

If your ChatGPT referral traffic seemed to fall sharply in the second week of October, you are not alone, and you probably did not lose those visitors. For about a week, ChatGPT stopped labelling the links it sends people to. Analytics tools could not tell where those visits came from, so they filed them as “direct” traffic instead.

OpenAI has now started fixing the problem. But the episode is a useful warning for anyone who reports on AI search performance: the data is more fragile than it looks, and a dip in a chart is not always a dip in demand.

What happened

In June, OpenAI began adding a small tracking tag (utm_source=chatgpt.com) to links inside ChatGPT answers. That tag is what lets Google Analytics 4, Matomo and similar tools recognise a visit as coming from ChatGPT. It has quickly become the main way marketers measure AI referral traffic.

Shortly after GPT-6 launched on 8 October, that tag disappeared from many links. Cedric Huesler at Adobe found that links were also being opened in a way that strips out the referrer, the other signal analytics tools use to identify where a visitor came from. With no tag and no referrer, the visit lands in the direct bucket.

The scale was significant. Across around 500 pages where ChatGPT normally drove at least 5% of visits, Huesler saw ChatGPT visits fall by about 31,000 a day between 9 and 13 October, while direct visits on the same pages rose by about 26,000 a day. Other trackers told the same story. LLM Pulse recorded around 46% fewer ChatGPT sessions, and Profound found that the share of ChatGPT answers containing a tagged link fell from about 98% to 66% in less than a week.

It was a bug, but the gap in your data is permanent

On 14 October, OpenAI told Huesler privately that this was a known bug, and a fix began rolling out the next day. Tagged ChatGPT clicks returned to near-normal levels within hours. OpenAI has not made a public statement, and some analysts were still seeing untagged links while the fix rolled out.

Two points matter for reporting:

• Visits recorded as direct between roughly 8 and 15 October will not be reclassified. No backfill has been announced, so October reports will understate ChatGPT and overstate direct traffic.
• The referrer is still missing on most ChatGPT clicks. The tracking tag is now effectively the only signal, so if it breaks again, the same thing will happen.

Why this matters beyond one bad week

AI search is becoming a meaningful source of high-intent visitors. Someone who clicks through from a ChatGPT recommendation has often already shortlisted you. That makes it tempting to treat the “AI assistant” line in GA4 as a reliable performance metric.

This episode shows its limits. AI platforms control how their links behave, they change them without notice, and they are under no obligation to help you measure them. A product update on their side can make your AI channel appear to collapse overnight, even when nothing has changed in how many people find you.

The bigger risk is a bad decision. A business that saw ChatGPT traffic halve in October might conclude that its AI visibility work had stopped paying off and cut budget, when the visitors were still arriving all along.

What to do now

• Annotate 8 to 15 October in GA4 and Matomo so nobody misreads the dip in future month-on-month or year-on-year comparisons.
• Report ChatGPT and direct traffic together for that week. If the combined total held steady, you lost measurement, not visitors.
• Check the pages ChatGPT normally sends people to. A rise in direct entrances to deep pages, such as a specific treatment or course page, is a strong sign of misattributed AI traffic, because people rarely type those URLs directly.
• Judge AI visibility on more than one number. Pair referral data with visibility tracking (how often you are mentioned and cited in AI answers), branded search trends and enquiry or conversion data.
• Do not add UTM tags to your own internal links. They overwrite the original source and make attribution worse.
•  

What is Tone of Voice (TOV)?

TOV is the type of vocabulary used to communicate a brand’s message, which is often attributed an adjective like professional, friendly, or empowering. It essentially encapsulates the communication style of a brand.

It’s particularly important as it influences how audiences perceive and engage with the brands they support. We see clear examples of the kind of emotional or subconscious responses that brands are able to evoke, just through the way they communicate.

A key example is Nike, with their “Just do it” slogan. It’s to the point, motivational, but also slightly blunt. It works to empower and enthuse, whilst treading the line between being slightly bossy and commanding. But it works. It prompts customers to feel empowered and capable, and it’s clever how Nike communicates such a strong message in just three words.

Similarly, Lidl champions its “More to Value” messaging, which is again simple but a really strong communicator. It’s direct, and separating emotion from fact works. It reinforces Lidl’s position as a straightforward, affordable option, helping to build trust with customers. After all, there is often nothing more frustrating than a brand being all talk, with no real follow-through on its promises.

So, Does TOV Really Matter in Marketing?

Yes, TOV absolutely matters when it comes to marketing strategies. A disjointed TOV sends audiences mixed signals; it doesn’t capture the thoughts, position or values of a brand, which makes connecting with and investing in them much harder to do.

A study by NN Group found that the tone of voice used by a brand can influence how trustworthy and desirable it appears to users. In the study, trustworthiness accounted for 52% of the variation in users’ brand desirability ratings. This is a clear indicator of the relationship between how a brand communicates and how audiences perceive it. It also reinforces the importance of TOV as part of a marketer’s communication strategy.

Picking the right tone of voice for a brand’s messaging, goals, values, and identity is just as crucial as keeping a consistent TOV.

How does TOV help convert audience members into customers?

As we’ve touched upon, TOV is an incredibly effective tool for building trust. As trust is built, audiences feel safer and see a brand as more reliable, increasing the likelihood of them converting into customers.

Communication is the bridge between a brand and its audience. Being able to convey a message in a way that resonates with or engages them encourages engagement overall.

What often sets brands apart from others is their way of conveying style and voice. It’s an opportunity to be unique and stand out. TOV is often part of creating a recognisable brand identity, and a recognisable personality helps your brand differentiate itself from others, giving customers another reason to choose you.

How should a business develop its TOV?

The basis for developing a TOV is understanding who your brand is, what kind of message you want to communicate, and who it is that will receive the message (the audience). Knowing who you’re speaking to will help you tailor the tone to cater to them.

Defining your brand personality is also an essential step in creating a tone of voice. Identify a few adjectives that reflect how you want your business to come across, such as knowledgeable, relatable or factual.

Then apply it consistently. Make sure your tone is recognisable across different channels, even when adapting your messaging to suit the platform. Inconsistency is where customers can start to feel like they don’t recognise or understand the difference across platforms.

Ultimately, TOV is more than just the words a brand uses. It’s about how those words make your audience feel and the impression they leave behind. Getting it right can help build trust, strengthen brand recognition and give customers a reason to choose you over the competition. When it comes to conversions, how you communicate your message can be just as important as the message itself.

Google’s latest September spam update is coming to an end after running for 14 days. The update started on 24th September and finished on the 8th October and has been the longest spam update in 2026.  

Google’s spam updates are used to target sites that violate Google’s search spam policies and with the emergence of AI content it is no surprise that this was the longest spam update to date, with 35% of new webpages now using AI content in some form. 

Google Search Spam Policies

Google’s search spam policies are designed to protect the quality of its search results and user experiences. The search spam policies can lead to ranking losses or outright bans if terms are violated. Some major spam abuses include:

Content abuse – Creating large amounts of unoriginal, low quality content

Site reputation abuse – Hosting third party low quality spammy content on a reputable sights

Backlink abuse – Buying or selling links to try and manipulate rankings and increase the authority of your site

Keyword stuffing – Artificially inflating the use of certain keywords on a page unnaturally to try and rank for them on Google search engines.

What to do if your rankings drop?

A site in violation of Google’s search policies may face penalties and ranking drops. Google’s search spam update documentation lays out clear guidelines on how a site may lose rankings and what controls site owners have to recover their rankings. 

“Sites that see a change after a spam update should review our spam policies to ensure they are complying with those. Sites that violate our policies may rank lower in results or not appear in results at all. Making changes may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies.

In the case of a link spam update (an update that specifically deals with link spam), making changes might not generate an improvement. This is because when our systems remove the effects spammy links may have, any ranking benefit the links may have previously generated for your site is lost. Any potential ranking benefits generated by those links cannot be regained.”

With Google’s September spam update now complete, site owners should closely monitor their organic traffic and keyword rankings over the coming weeks to identify any significant changes.

If your website has experienced a drop in visibility, it’s important not to rush into making changes. Instead, review your content quality, backlink profile and overall SEO strategy to identify any potential violations of Google’s spam policies.

Ultimately, this update serves as another reminder that Google continues to prioritise high quality, original content that provides genuine value to users. Websites that focus on sustainable SEO practices and put user experience first will be better positioned to maintain their search visibility in the long term.

AI has permeated every stage of the marketing process, undeniably. Whether that’s teams ideating, polishing email correspondence, or utilising it to quickly mock up visuals. Raising questions about the actual impact it could have on B2B marketing strategies. And most importantly, the business minds making the decisions based on a process that is now deeply entrenched with AI-influenced processes.

Does AI change the acquisition process for B2B buyers?

AI can absolutely change the acquisition process for stakeholders, individuals within a business, along with the vendors and sellers. In fact, AI now comes in as a fourth party to the three key figures within a business’s buying arc.

 AI now automates processes like researching, collating a prospect list and even has the ability to compare proposals. Its purpose is to then become a tool for businesses to vet and ultimately decide what business deals are practical and well-fitting.

Forrester’s 2026 Buyer Insight report discovered that roughly 94% of buyers rely on AI at some stage of the buying process to assist with decision-making. That’s an astounding figure that absolutely reinforces the notion that AI is remapping B2B marketing processes.

Search Journeys shift, impacting discovery and interaction

The zero-click trend, with AI engines, research tools, and generative engine optimisation, all highlight the shifts around search journeys. AI deeply influences the basic processes of inquiring, exploring and analysing.

Where previously buyers would type in keywords, click through to a number of sources and inform decisions based on directly collected information, now AI changes how much of that exploration can happen, with individuals simply clicking enter.

Brand, trust and reputation

So if buyers aren’t directly engaging with content on prospects’ websites, it begs the question of how they build trust, interpret reputations and truly understand branding.

This is where traditional trust signals still stand strong. These can include:

• Reviews
• Testimonials
• Recommendations
• Credentials and accolades (qualifications and awards)
• Verifiable individual profiles
• Clarity of offering: from a buyer or prospect perspective, this is about the transparency around offerings, costs, as well as identifying what and why those decisions are made
• Consistent authoritative content: which, in terms of AI, may mean that the same business names come up across varied searches

What shouldn’t change for B2B marketing

AI is most definitely changing the ways buyers are researching and making decisions, but it doesn’t necessarily change the fundamental reasons behind making a decision. Businesses still need to understand their audiences, communicate their values, and build reputations that instil confidence in buyers choosing them.

This means B2B marketers still need to account for both sides of the equation, recognising the role AI plays in influencing the buyer’s journey, while continuing to prioritise the things that make a business worth choosing. This is often credibility, expertise, clarity and an understanding of their target markets.

AI may increasingly influence which businesses enter a buyer’s consideration, but it is still the strength of the business, its reputation and the value it can demonstrate that ultimately helps turn consideration into a decision.

AI search systems do not look at your images the way a human browsing your website does. They scan them, extract what they can identify, and then use that information to decide whether your page is a credible source for the answer they are assembling. A photo that looks great to a person can be functionally invisible to a machine if it cannot detect what the image shows or confirm that the page text backs it up.

This is not a niche technical concern. With AI Overviews now reaching 2.5 billion monthly users, the question of what AI systems can see on your website has real commercial consequences. And images are increasingly the entry point, not an afterthought.

The change worth understanding

Google holds a patent filed in 2023 and published in April 2026 describing a mechanism where the cited source for an AI-generated answer is chosen by image match first, with surrounding text then pulled in to build the answer. In other words: the picture on your page may be what gets your page selected, and the text is used to fill out the response.

This is a patent application, not confirmed live behaviour. Google files thousands of patents and many never ship exactly as described. But as a directional signal it matters, because it is consistent with what practitioners are observing across AI search environments: visual content is playing a larger role in how AI systems identify and retrieve relevant sources, not just how humans navigate pages.

The scale of visual search reinforces why this direction makes sense. Google Lens processes around 20 billion visual searches a month. Pinterest handles 1.5 billion visual searches a month, converting at 62% better than text searches because a camera finds what words struggle to describe. When that volume of search intent is arriving through images, the systems that respond to it need to be able to read images reliably – and they are increasingly being designed to do exactly that.

What AI sees when it looks at your images

There are two distinct questions to ask about any image on your website. The first is whether the AI can correctly identify what is in the photograph. The second is whether you put the right things in the photograph to begin with.

These sound similar but they are different problems. The first is about legibility – whether the machine can read the image accurately. The second is about intent – whether the image actually communicates the story you want associated with your brand or service. A striking lifestyle image that reads beautifully to a human might tell a machine a very different story if the composition is ambiguous, if the background objects do not match your brand, or if the image contains text that cannot be read at the resolution it is being served.

A practical example: a dental clinic that uses a stock image of a general healthcare setting tells an AI system something much less specific than a clinic that uses its own photography showing its actual treatment rooms, equipment and team. The AI is reading both, but the signal from the first is weaker and shared with every other site using the same image. Stock images are a known problem for AI citation specifically because they appear on thousands of sites – the uniqueness of your image is part of what makes it citable.

The specific things that affect machine readability

There are several factors that determine how well an AI system can read and use your images. Most of these are straightforward to address:

• Image uniqueness. Your own photography, showing your actual products, premises, people or work, performs better than stock images in AI citation environments. If AI systems use image matching as a selection signal, uniqueness is part of what makes your image the one that gets selected rather than a generic version of the same thing.
• Text legibility within images. If your images contain text – packaging, signage, labels, credentials – machine vision systems read it. If that text is blurry, small, or obscured by glare, the system misses it. The same applies to before-and-after images common in aesthetics and dental contexts: the treatment result needs to be visually clear enough for the machine to register what it shows.
• What else is in the frame. AI systems do not just see the main subject. They see everything in the frame. What surrounds your product or service in a photograph forms part of the context signal the machine reads. A treatment room image with equipment visible in the background that does not match the service being described is sending a mixed message. This is worth considering when reviewing or commissioning photography.
• The text immediately around the image. The patent mechanism describes the surrounding text as what gets pulled into the AI answer after the image match. If your most relevant, specific information is buried three paragraphs below an image rather than in a caption or direct label alongside it, the machine may use weaker text to build its answer. Putting the key fact directly next to the image is a simple change with a direct effect.
• Alt text. Alt text for AI search is not just an accessibility or keyword exercise. It is a claim the machine can extract and use. Writing it as a clear description of what the image shows and what it means commercially is more useful than a keyword string, and more useful than a generic description that could apply to any image.

Which types of site this affects most

The multimodal AI search direction is most immediately relevant to businesses where the visual representation of a product or service is central to the buying decision. Aesthetics, dental, healthcare, hospitality, workspace, food and education all fall into this category. For these businesses, the photograph is not decoration supporting a text-based page – it is a primary source of information that shapes what a prospective customer believes about quality, credibility and relevance.

E-commerce is the clearest case: if an AI system can use image matching to identify a product and pull in the surrounding text to build an answer, the businesses with clear, unique, well-labelled product photography on pages with specific supporting copy have a structural advantage over those relying on shared manufacturer images and thin descriptions.

But the principle is broadly applicable. Any business that cares about being recognised and recommended by AI systems should consider whether their images are helping or hindering that goal. The question is not whether your images look good to your customers – it is whether they give AI systems the right signals to identify, retrieve and cite your pages.

What to do with this information

The most impactful single change for most businesses is replacing generic stock images with original photography. Not because stock images look bad, but because uniqueness matters in AI citation and stock images are inherently shared across thousands of sites. Your own photography of your actual work, space or team is the version only you have.

Beyond that, the practical checklist is short. Caption your images with specific, factually accurate descriptions rather than mood-led copy. Place the key information the image illustrates in the text directly alongside it, not separated by paragraphs of other content. Write alt text as a clear description of what the image shows, not as a keyword list. Check that any text visible within your images – credentials, labels, treatment names – is clear enough to be read at the sizes you are serving.

None of this requires expensive tooling or a complete photography overhaul in one go. The highest-value starting point is auditing your most important pages – typically treatment or service pages, product pages, and homepage – to check whether the images on those pages are unique, legible and contextually accurate. That review will surface the specific gaps worth addressing before worrying about anything more advanced.