Anomaly Detection: spot unusual days in Search Console data

Anomaly Detection checks every day in your Search Console data against the same weekday in the weeks around it and flags the days that fall well outside the usual range. It works on clicks, impressions, CTR or average position, uses a median-based score so one wild day does not distort the baseline, and grades each anomaly from Low to Critical. A second chart watches for slow drifts that no single day reveals.

How a day is scored

1. Baseline. The expected value for a day is the median of the 8 nearest days that fall on the same weekday, earlier or later, leaving out the day itself. A Monday is compared with Mondays, so a normal weekend dip is never an anomaly. At least 3 such days are needed, otherwise the day is not scored.
2. Spread. The typical variation is the median absolute deviation (MAD) of those days, multiplied by 1.4826 so that it is comparable with a standard deviation. When the MAD is zero, the mean absolute deviation is used instead.
3. Score. The z-score is the day's distance from the median divided by that spread. This is the modified z-score that the NIST engineering handbook describes for outlier detection, where it suggests a cut-off of 3.5.
4. Two gates. A day is an anomaly only when its score reaches the Sensitivity you set and it is also at least 10% away from the expected value. The second gate keeps tiny but very regular series from flagging trivial moves.

Sensitivity runs from 1.0 to 4.0 with 2.5 as the default: lower values flag more days. Severity is the score as a multiple of the sensitivity: under 1.5 times is Low, under 2 times is Medium, under 3 times is High, and 3 times or more is Critical.

Reading the results

• Cards: Anomalies, Spikes, Drops, Share of days scored that were anomalies, and the Most extreme day.
• Actual vs expected with confidence band draws the series, the same-weekday median and a dashed band of ± sensitivity × the robust spread. Markers flag anomalies, coloured by severity.
• The table lists Date, Weekday, Actual, Expected, Deviation, Z-score, Severity and Direction (Spike or Drop).

Direction is numeric. For Position, a Spike means the number went up, which is a worse ranking, and a Drop means it improved.

Switch the metric or move the slider after a run and the scores are recalculated in the browser. The run covers at least 90 days; a shorter range is extended backwards and the note above the results gives the dates used. The minimum is 21 days.

The EWMA chart: slow drifts

Open EWMA control chart (small persistent shifts) for a different question. An exponentially weighted moving average with a weight of 0.3 on each new day runs around the series' median, with control limits at ± sensitivity × the robust spread, narrower while the average warms up. A run of days outside the limits, without single-day anomalies, means the level is drifting. NIST's handbook explains why EWMA charts catch small, gradual shifts that a day-by-day check misses. When the chart reports such a run, date it with Change Point Detection.

Limits worth knowing

• It looks both ways in time. The baseline uses later weeks as well as earlier ones, so it is a review of the past rather than a live alarm, and the score of a recent day can change as more weeks arrive.
• The newest days are judged on history alone, with fewer peers, so they deserve a second look a week later.
• Missing days count as zero. A gap in the data, or a property younger than the window, produces drops that are not real.
• CTR and position move with the mix of queries. A day can look anomalous because different searches showed your site, not because anything broke. Check the queries for that day before reacting.
• It describes, it does not explain. Match flagged dates with releases, outages and the ranking update history, and record the reason as an annotation.

Anomaly alerts are a separate check

The Traffic anomaly alert rule does not reuse this report. It scores only the latest settled day's clicks against the median of a recent window, looks for drops, and has its own sensitivity. See alerts to get those posted to Slack, Microsoft Teams or a webhook.