Mowers Online

Blended conversion under one per cent against a healthy prior year; product views out of all proportion to sessions.

The head term dropped from the top five to page three within a week of the first fixes shipping.

The owner's phone showed a broken layout that no other device, browser or test could reproduce.

About 45% of August sessions were a headless-Chrome farm: one page per visit, worldwide, direct, zero orders. Subtract it and UK visitors were converting at close to double the blended figure. The analytics tag had also been dead for two weeks in the middle of the month.

The rank slide began before anything shipped. The daily Search Console series showed a recrawl surge, a pullback and a consolidation back to the pre-fix band: a settling. A third-party audit had read 'AI crawlers allowed' as blocked and a synthetic vitals run as a failure.

The breakage was cache poisoning: the optimiser's bundle filenames were not content-keyed and carried a one-year max-age, so a bad build from one afternoon stayed pinned in downstream caches long after the origin was purged.

A managed challenge for non-UK traffic at the edge: non-UK sessions 954 → 151 the next day. When a residue kept coming, a forty-minute origin-side probe counted 1,596 hits carrying an edge ray against 28 without — a residential-proxy botnet running real Chrome and passing the challenge. Escalated to a block; the farm went to zero rows, the remainder verified crawlers and a social-platform prefetcher.

Cache policy rewritten: purge the optimiser and the edge together, every time; a 24-hour edge TTL in place of the year.

Then the tail: a hidden-iframe referrer flood from an affiliate publisher cut with an edge transform rule; product schema and a trust badge shipped as two small plugins; a crawl-delay lifted and a stray sitemap removed.