What changed in AEO this month: September 2026.

Two of this month's AI search updates can quietly delete you from AI answers, and neither one sent you an email.

On September 15, Cloudflare changed how it treats crawlers that do more than one job, so a site that blocks AI training can now block Googlebot too (Cloudflare, 2026). On August 31, Google put an "Exclude" switch for AI Overviews and AI Mode into every Search Console account (Google, 2026). One is a trap, one is a lever, and both live in dashboards most marketing teams never open.

The rest of the month: AI Overviews got bigger, ChatGPT became a real ad channel, a new audit showed the engines barely agree on sources, and Google started a spam update. Here is what happened, why it matters, and the fix, ranked by how much damage it can do.

What changed. Cloudflare now sorts AI crawlers into three jobs: Search, Agent and Training. New domains onboarding from September 15 block Training and Agent crawlers by default on pages that show ads, with Search still allowed (Cloudflare, 2026). The bigger change applies to everyone: crawlers that combine search with training are now "allowed/blocked according to all of their behaviors." Cloudflare names Googlebot, Applebot and BingBot.

So what. If you switched on "block AI training" to feel principled, you may have blocked the crawler that feeds Google's results, AI Overviews and AI Mode at once. ChatGPT-User, the bot that fetches a page when someone asks ChatGPT to read it, is classed as Agent, so new domains with ads now turn it away by default.

The fix. Open Cloudflare's Security settings and read your Training setting. If you block it, check whether you took the opt-out Cloudflare offered before the change; if not, allowing Training is how you keep Googlebot in. Then watch Search Console crawl stats for a drop after September 15. Background in why AI crawlers can't read your website.

What changed. As of August 31, Search Console's Generative AI performance report reached every site worldwide (Google, 2026). It shows how often links to your site appeared in AI Overviews and AI Mode, by page, country, device and date.

So what. It is the first first-party AI visibility number any engine has given you, and it is thin on purpose: impressions only, no clicks, no queries. It covers Google and nothing else, so it cannot tell you what ChatGPT, Perplexity or Claude said about you, or who they cited instead.

The fix. Screenshot a dated baseline now, so the next big page change has a "before". For the engines Google cannot see, you need per-engine measurement, which is what WhyIQ AI Radar does: it runs your buyer questions through ChatGPT, Perplexity, Claude, Gemini and Google AI Mode every week and records who actually got cited.

What changed. Yes. Search Console now has Settings > Search generative AI with three options: Include (the default), Exclude, and Inherit from parent (Google, 2026). Exclude removes your content from AI Overviews, AI Mode and generative features in Discover.

So what. Google says the control "isn't used as a ranking or inclusion signal affecting other parts of Search", so your blue links survive. It does not govern training either; that is still Google-Extended. The quiet risk is "Inherit from parent": a subdomain can follow a parent property someone else manages.

The fix. Check the setting on every property, subdomains included. For almost every business the answer is Include.

Excluding yourself from AI Overviews does not stop the AI answer from appearing. It just guarantees somebody else is quoted in it.

What changed. On August 19, Google brought generative UI into AI Overviews, globally in English: calculators and other tools built on the fly inside the result (Search Engine Journal, 2026). On August 28, Google confirmed it was testing overviews that expand without a "Show more" click: "For some queries, AI Overviews may dynamically expand for topics where our systems determine it's most useful for people" (Search Engine Roundtable, 2026).

So what. More answer above the fold pushes organic links down. If your page exists to be a calculator or checklist, Google can now build one in the result.

The fix. Aim to be the source cited inside the overview. Google says these features are "rooted in our core Search ranking and quality systems," so indexing comes first, then a direct answer in your first paragraph. For tool pages, add what a generated widget cannot: your own data and edge cases.

What changed. ChatGPT became a serious ad platform. OpenAI reported a $1 billion annualized ad run rate on August 31 and passed 60 countries on September 23 (OpenAI, 2026). Ads show only on the Free and Go plans, and OpenAI says they "do not influence the responses." OpenAI has also been testing moving the Sources button into a "More actions" menu since mid-August (Search Engine Roundtable, 2026).

So what. On free accounts your citation now shares the screen with a paid slot, and the source list may be a click further away. Being named in the answer beats being a footnote. A quieter finding matters more: in Instant mode, nine ChatGPT answers out of ten never open a page, working from an index where your page is often little more than a title and roughly 200 characters (RESONEO, 2026).

The fix. Keep OAI-SearchBot allowed in robots.txt and at your CDN. Make your title and opening sentences say what you are, who it is for, and one concrete fact.

What changed. On September 16, researchers auditing AI shopping advice found that for the same query, the ChatGPT and Gemini interfaces shared only 5.4% of cited domains, and in 76.7% of comparisons they shared none (Uberti-Bona Marin et al., 2026). Recommended products "often change across repeated requests." Even the APIs disagree with their own apps.

So what. "We checked ChatGPT and we're in there" is an anecdote. Winning one engine says little about the next, and one run says little about the next run.

The fix. Ask the same buyer questions, on every engine, repeatedly, and judge the trend. No tracker sees exactly what a consumer sees, ours included, which is why WhyIQ AI Radar asks the same questions on all five engines the same way every week and reports movement rather than one reading. More in why ChatGPT gives a different answer every time.

Google started the September 2026 spam update on September 24, rolling out over up to two weeks (Google, 2026). Google said nothing about AI Overviews, but its AI features run on the same ranking systems, so do not read AI visibility swings until it finishes in early October.

What did not change: Google still says Search ignores llms.txt, and that structured data "isn't required for generative AI search." Perplexity and Claude shipped product news but nothing we could verify about how they choose sources. Perplexity did retire its older Sonar API tiers on September 27, so expect a wobble in some trackers' Perplexity lines.

1. Cloudflare: read your Training setting.
2. Search Console > Settings > Search generative AI: confirm Include on every property.
3. Generative AI report: screenshot today's baseline.
4. robots.txt and CDN: allow OAI-SearchBot, PerplexityBot, Claude-SearchBot and Googlebot.
5. Top five pages: does the title plus first 200 characters say what you are, for whom, with one fact?
6. Spam update: freeze conclusions until it finishes.

A free WhyIQ scan checks the page-level half, crawler access and answer placement among the signals on our science page. It predicts citation readiness. Whether engines actually cite you, week after week, is Radar's job.