Studio
Scrapbook

August 2026

July has been a mix of the planned and the unplanned. A serious WordPress vulnerability landed on a Friday afternoon and had the Dev team moving fast. The rest of the month ran more to schedule. A new site went live for The Inner Temple, six months of work with West Country Water and Environment came together in their Regional Plan Document, and we sat down with Dixon Jones to talk entity maps. Add a hike up Pen y Fan and a trip to Denver for Ian and Dan, it’s been a full month. Here’s what we’ve been up to.

Will went to the Dotdigital Summit

Will headed to London for the Dotdigital Summit at Old Billingsgate, joining 800 or so marketers for a day of talks on behavioural science, AI, automation and leadership. The thread running through most of it: AI is handling more of the repetitive work, which leaves people free to do the parts that actually need a human.

Bringing WCWE's Regional Plan Document to life

For the past six months, Fanatic has been working with West Country Water and Environment (WCWE) to bring its Regional Plan Document (RPD) to life. This long-term strategic document sets out how water supply and demand will be balanced across the South West. It brings together the needs of multiple sectors, while forecasting future demand and proposing sustainable solutions to improve drought resilience and protect the environment.

Following the development of the WCWE brand, we worked closely with the team to create a future-proof design system for reports, maps and data visualisations. Designed to improve clarity, consistency and accessibility, the system makes complex information easier to navigate and understand. Built to scale, it works just as effectively for comprehensive documents spanning hundreds of pages, such as the RPD, as it does for shorter, public-facing publications.

Responding to a WordPress core vulnerability

Some unplanned work for the Dev team this month. On Friday 17 July, security researchers at Searchlight Cyber published details of a vulnerability in WordPress core, nicknamed wp2shell. It’s what’s known as a pre-authentication remote code execution flaw, which is about as serious as web vulnerabilities get. “Remote code execution” means an attacker can run their own code on the server, and “pre-authentication” means they don’t need to log in first. There are no other conditions either: no particular plugin, no unusual configuration, just a stock WordPress install and a single anonymous request. That’s enough to take over a site.

Versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 are affected. Anything on 6.8.5 or below isn’t.
Searchlight held back the technical details of how the exploit works to give site owners time to patch, which was a fair signal that everyone needed to move quickly.

The permanent fix is a core update, to 7.0.2 or to 6.9.5 for anyone on the 6.9 branch. Alongside that, our first move was to roll out a mitigation across the sites we look after, closing off the route the exploit depends on so nothing was left exposed while updates were worked through. Fortunately we were also assisted by Cloudflare and our WordPress Security Plugin of choice, who both pushed their own mitigations as soon as the vulnerability was disclosed which covered a large part of our website estate right out of the gates.

Keeping an eye on disclosures like this, and being able to act on them across a whole estate of sites in a matter of hours, is a large part of what our ongoing maintenance and hosting work covers. It’s easy to look at this and think that WordPress is somehow less secure or more vulnerable than other Content Management Systems, but that’s not the case. As WordPress is the most popular CMS in the world it gets the most attention by both malicious actors and security researchers, and staying on top of your sites updates and security means you get the full benefit of all that testing.

Inner Temple Go Live

We recently launched a new website for The Inner Temple, one of the four Inns of Court established in c. 1388. The website integrates with their CRM to display tickets and manage user access, for such a large institution there’s a lot of data that needs to be integrated.

This is now the third site we’ve launched as part of our work with The Inner Temple, and working with the same brand guidelines across three different projects has been a nice challenge in keeping things consistent but still interesting.

What we're keeping an eye on: Google and the DMA

Two things happened in Brussels this month. Neither changes anything for anyone this quarter, but both are worth following.

On 16 July the European Commission spelled out how Google has to meet obligations it’s already signed up to under the Digital Markets Act. Android needs to open up, so rival AI assistants can be summoned by voice and act inside apps the way Gemini already does. And Google has to start sharing anonymised search data (rankings, queries, clicks, views) with competing search engines at a fair price (Ars Technica has a good rundown of Google’s objections). The bit worth circling: AI chatbots that do search count as eligible recipients. Data sharing kicks in from January 2027, the Android side from July.

That’s the interesting one. A big reason nobody competes with Google is that nobody else has click data at that scale. If Perplexity and ChatGPT can buy their way in, the quality gap starts to narrow.

Then on 23 July, separately, the Commission fined Google €890 million over self-preferencing in Search and for making it awkward for Play developers to point people at cheaper checkouts. Google has 60 days to sort both out, and reckons that means pulling some Search features for European users. If you’ve got EU-facing sites, keep half an eye on that one. Results pages over there could look noticeably different come autumn.

None of it lands on UK sites directly. The CMA does its own thing here and hasn’t gone anywhere near as far. We’ll keep watching both.

Entity maps: a conversation with Dixon Jones

This month we sat down with Dixon Jones to talk about EntityMap, the open standard he’s been working on with his co-founder Fred Laurent. Dixon co-founded InLinks and Waikay, spent a decade as marketing director at Majestic, and wrote Entity SEO: Moving from Strings to Things back in 2021, so he’s been thinking about entities rather than keywords for longer than most of the industry has had a word for it.

The problem it tackles is one most of us have worked around without naming. Schema markup states facts page by page, but it doesn’t describe how the things a business talks about connect to each other across a whole site. Internal linking did some of that job in traditional search. There’s no equivalent when a language model is assembling an answer. An entity map publishes those connections directly, along with the evidence behind them, rather than leaving a model to infer both.

Dixon’s case rests on three things: fewer hallucinations, better attribution, and a fuller picture of a brand in AI answers. The finding that interested us most from their early testing wasn’t a bigger volume of mentions, but a shift further down the funnel, with brands surfacing for longer-tail, decision-stage questions.

We’ve started adding entity maps to sites we look after and will share what we learn once there’s a clearer picture.

You can read the article here.

Google starts taking bid targets literally

From 17 August, Google is changing how Smart Bidding treats campaigns that are limited by budget on a target-based strategy, meaning Target CPA and Target ROAS.

Right now those campaigns often quietly overdeliver. Set a £20 target CPA and the campaign might come in at £12, or aim for a 500% ROAS and see 700%. Nobody has ever complained about that. From the 17th, Google will steer those campaigns towards the target you actually typed in rather than the better one its algorithm found, so anything that has been overperforming will drift back towards its stated target unless the target is updated.

Our head of paid media, Rob’s read is that it cuts both ways. There’s more certainty about what a campaign will deliver, and scaling budget becomes more predictable, which has been a long-standing frustration. The trade-off is that the free efficiency you got from a deliberately loose target largely disappears. It’s a real behavioural change, and one we’ll all need to get used to.

Practically, it means working through affected accounts before the deadline and checking that every target still reflects the business goal rather than a number set months ago and left alone. Google’s Bid Target Adjustment Tool has been live in accounts since 6 July, flagging campaigns likely to be affected and suggesting revised targets, though it won’t change anything on its own. Large target changes reset the learning phase, so anything we do adjust is better moved gradually.