{"slug":"seo-forensic-incident-response","title":"SEO Forensic Incident Response — Traffic Drop Diagnosis and Recovery","tags":["seo","incident-response","traffic-drops","algorithm-updates","forensics"],"agent_summary":"Systematic traffic drop diagnosis: cross-referencing drop dates with Google update calendar, distinguishing algorithmic from manual actions, Panda/Penguin/HCU fingerprinting, and structured recovery playbooks.","trigger_phrases":["traffic drop","rankings dropped","SEO incident","algorithm hit","traffic decline","site penalized","rankings crashed","Google update hit","SEO forensics","traffic loss investigation"],"runnable":true,"markdown":"\n## Phase 1: Incident Characterization\n\nBefore diagnosing cause, characterize the incident precisely.\n\n### Timeline Extraction\n\nFrom Google Search Console:\n1. GSC → Performance → Date range: 90 days → Click \"Compare\" → previous period\n2. Identify exact date traffic started declining (not the date you noticed it)\n3. Check impressions separately from clicks — did both drop, or clicks only?\n\n**Impressions drop + clicks drop** = rankings dropped (organic visibility loss)\n**Impressions stable + clicks drop** = CTR problem (SERP feature change, title/meta issue, snippet competition)\n**Clicks drop on specific pages only** = page-level issue\n**Clicks drop site-wide** = domain-level issue\n\n### Cross-Reference with Google Update Calendar\n\nCompare the exact drop date to the Google update calendar:\n- Search Google's official Search Status Dashboard: `https://status.search.google.com/`\n- Check third-party tracking: Semrush Sensor, MozCast, Algoroo\n- Key update types: Core Update, Spam Update, Helpful Content Update, Link Spam Update, Product Reviews Update\n\n**If drop date aligns with a named update** → algorithmic cause\n**If drop date does NOT align with any update** → technical cause, manual action, or competitor growth\n\n## Phase 2: Update Type Fingerprinting\n\n### Panda Fingerprint (Content Quality)\n- Site-wide traffic drop\n- Low-quality pages (thin, duplicate, keyword-stuffed) exist on domain\n- Recovery: 2 core updates minimum (6-12 months)\n- Diagnosis: run `panda-quality-score-audit`\n\n### Helpful Content System Fingerprint (HCU)\n- Site-wide traffic drop to information-heavy content\n- Content exists primarily to rank, not to help\n- Drop coincides with HCU update date\n- Recovery: full content audit + Who/How/Why framework applied\n- Diagnosis: run `eeat-audit --phase hcu`\n\n### Penguin Fingerprint (Link Spam)\n- Drop in link-dependent rankings\n- Sudden spike in low-quality link acquisition preceded drop\n- Recovery: disavow + clean link profile\n- Diagnosis: run `dataforseo-backlinks` audit\n\n### Core Update Fingerprint (Authority/Relevance)\n- Rankings redistributed (some pages up, some down)\n- Competitors with stronger E-E-A-T gained at your expense\n- No clear pattern by page type\n- Recovery: E-E-A-T improvement, topical authority strengthening\n\n## Phase 3: Manual Action Check\n\nGSC → Security and Manual Actions → Manual Actions. If a manual action is present:\n- Document the exact action type\n- Do NOT attempt to recover algorithmically — manual actions require a reconsideration request\n- Fix the specific violation cited, submit reconsideration\n\n## Phase 4: Technical Cause Ruling Out\n\nIf drop does NOT align with any update AND no manual action:\n\nChecklist:\n- [ ] Was there a site migration or domain change near the drop date?\n- [ ] Were there robots.txt changes near the drop date?\n- [ ] Were there canonical changes?\n- [ ] Did server hosting change?\n- [ ] Did site go down for any period? (Check uptime monitoring logs)\n- [ ] Did competitor gain significant links to outpace you? (check `dataforseo-backlinks` for competitor)\n\n## Phase 5: Recovery Playbook\n\n| Cause | Recovery Steps | Timeline |\n|-------|---------------|----------|\n| Panda / HCU | Content audit → consolidate thin pages → rewrite weak content → noindex lowest-quality section | 2-3 core updates (6-18 months) |\n| Core Update (authority) | E-E-A-T improvements → topical authority expansion → link building | 1-2 core updates (3-9 months) |\n| Penguin / link spam | Identify bad links → disavow file → clean acquisition → reconsider | 1-2 spam updates (3-6 months) |\n| Technical (robots, migration) | Fix root cause → re-crawl via GSC → monitor recovery | Weeks to months |\n| CTR / snippet loss | Rewrite titles and meta → add schema → test featured snippet capture | 2-6 weeks |\n\n## Phase 6: Post-Recovery Monitoring\n\nAfter implementing recovery steps:\n- GSC → Performance → monitor weekly (not daily — too granular)\n- Compare to pre-incident baseline, not just to low point\n- Do NOT make additional changes during the next core update period (changes take effect at updates, cannot evaluate mid-update)\n\n## Cross-References\n\n- `panda-quality-score-audit` — Panda fingerprinting and remediation\n- `eeat-audit` — E-E-A-T and HCU scoring\n- `google-update-proofing` — proactive update resilience (run before incidents)\n- `dataforseo-onpage` — technical SEO audit during phase 4\n- `dataforseo-backlinks` — link profile audit for Penguin diagnosis\n\n#seo-sop #seo #incident-response #traffic-drops #algorithm-updates #forensics\n","html":"<h2>Phase 1: Incident Characterization</h2>\n<p>Before diagnosing cause, characterize the incident precisely.</p>\n<h3>Timeline Extraction</h3>\n<p>From Google Search Console:</p>\n<ol>\n<li>GSC → Performance → Date range: 90 days → Click \"Compare\" → previous period</li>\n<li>Identify exact date traffic started declining (not the date you noticed it)</li>\n<li>Check impressions separately from clicks — did both drop, or clicks only?</li>\n</ol>\n<p><strong>Impressions drop + clicks drop</strong> = rankings dropped (organic visibility loss)\n<strong>Impressions stable + clicks drop</strong> = CTR problem (SERP feature change, title/meta issue, snippet competition)\n<strong>Clicks drop on specific pages only</strong> = page-level issue\n<strong>Clicks drop site-wide</strong> = domain-level issue</p>\n<h3>Cross-Reference with Google Update Calendar</h3>\n<p>Compare the exact drop date to the Google update calendar:</p>\n<ul>\n<li>Search Google's official Search Status Dashboard: <code>https://status.search.google.com/</code></li>\n<li>Check third-party tracking: Semrush Sensor, MozCast, Algoroo</li>\n<li>Key update types: Core Update, Spam Update, Helpful Content Update, Link Spam Update, Product Reviews Update</li>\n</ul>\n<p><strong>If drop date aligns with a named update</strong> → algorithmic cause\n<strong>If drop date does NOT align with any update</strong> → technical cause, manual action, or competitor growth</p>\n<h2>Phase 2: Update Type Fingerprinting</h2>\n<h3>Panda Fingerprint (Content Quality)</h3>\n<ul>\n<li>Site-wide traffic drop</li>\n<li>Low-quality pages (thin, duplicate, keyword-stuffed) exist on domain</li>\n<li>Recovery: 2 core updates minimum (6-12 months)</li>\n<li>Diagnosis: run <code>panda-quality-score-audit</code></li>\n</ul>\n<h3>Helpful Content System Fingerprint (HCU)</h3>\n<ul>\n<li>Site-wide traffic drop to information-heavy content</li>\n<li>Content exists primarily to rank, not to help</li>\n<li>Drop coincides with HCU update date</li>\n<li>Recovery: full content audit + Who/How/Why framework applied</li>\n<li>Diagnosis: run <code>eeat-audit --phase hcu</code></li>\n</ul>\n<h3>Penguin Fingerprint (Link Spam)</h3>\n<ul>\n<li>Drop in link-dependent rankings</li>\n<li>Sudden spike in low-quality link acquisition preceded drop</li>\n<li>Recovery: disavow + clean link profile</li>\n<li>Diagnosis: run <code>dataforseo-backlinks</code> audit</li>\n</ul>\n<h3>Core Update Fingerprint (Authority/Relevance)</h3>\n<ul>\n<li>Rankings redistributed (some pages up, some down)</li>\n<li>Competitors with stronger E-E-A-T gained at your expense</li>\n<li>No clear pattern by page type</li>\n<li>Recovery: E-E-A-T improvement, topical authority strengthening</li>\n</ul>\n<h2>Phase 3: Manual Action Check</h2>\n<p>GSC → Security and Manual Actions → Manual Actions. If a manual action is present:</p>\n<ul>\n<li>Document the exact action type</li>\n<li>Do NOT attempt to recover algorithmically — manual actions require a reconsideration request</li>\n<li>Fix the specific violation cited, submit reconsideration</li>\n</ul>\n<h2>Phase 4: Technical Cause Ruling Out</h2>\n<p>If drop does NOT align with any update AND no manual action:</p>\n<p>Checklist:</p>\n<ul>\n<li>[ ] Was there a site migration or domain change near the drop date?</li>\n<li>[ ] Were there robots.txt changes near the drop date?</li>\n<li>[ ] Were there canonical changes?</li>\n<li>[ ] Did server hosting change?</li>\n<li>[ ] Did site go down for any period? (Check uptime monitoring logs)</li>\n<li>[ ] Did competitor gain significant links to outpace you? (check <code>dataforseo-backlinks</code> for competitor)</li>\n</ul>\n<h2>Phase 5: Recovery Playbook</h2>\n<p>| Cause | Recovery Steps | Timeline |\n|-------|---------------|----------|\n| Panda / HCU | Content audit → consolidate thin pages → rewrite weak content → noindex lowest-quality section | 2-3 core updates (6-18 months) |\n| Core Update (authority) | E-E-A-T improvements → topical authority expansion → link building | 1-2 core updates (3-9 months) |\n| Penguin / link spam | Identify bad links → disavow file → clean acquisition → reconsider | 1-2 spam updates (3-6 months) |\n| Technical (robots, migration) | Fix root cause → re-crawl via GSC → monitor recovery | Weeks to months |\n| CTR / snippet loss | Rewrite titles and meta → add schema → test featured snippet capture | 2-6 weeks |</p>\n<h2>Phase 6: Post-Recovery Monitoring</h2>\n<p>After implementing recovery steps:</p>\n<ul>\n<li>GSC → Performance → monitor weekly (not daily — too granular)</li>\n<li>Compare to pre-incident baseline, not just to low point</li>\n<li>Do NOT make additional changes during the next core update period (changes take effect at updates, cannot evaluate mid-update)</li>\n</ul>\n<h2>Cross-References</h2>\n<ul>\n<li><code>panda-quality-score-audit</code> — Panda fingerprinting and remediation</li>\n<li><code>eeat-audit</code> — E-E-A-T and HCU scoring</li>\n<li><code>google-update-proofing</code> — proactive update resilience (run before incidents)</li>\n<li><code>dataforseo-onpage</code> — technical SEO audit during phase 4</li>\n<li><code>dataforseo-backlinks</code> — link profile audit for Penguin diagnosis</li>\n</ul>\n<p>#seo-sop #seo #incident-response #traffic-drops #algorithm-updates #forensics</p>\n"}