Alerts: detectors, thresholds and severity

An alert rule runs one detector against the properties you pick and posts to its channel only when the detector fires. You choose the detector, a threshold, a window in days, the lowest severity worth a message and, if you need a quiet spell, a date to stay silent until. A rule fires at most once per property per day, so a bad week produces one message a day rather than one an hour.

Which events can raise an alert

Pick the detector in New alert. The last column shows what the form fills in for you.

The percentage detectors measure relative change. CTR going from 4.0% to 3.0% is a 25% fall, not one point, and an average position moving from 8.0 to 9.2 is 15% worse. New & lost rankings reads up to 5,000 queries per window, so on a larger site a query that merely slips out of the top 5,000 also counts as lost.

How severity is set

Every alert carries a severity of critical, high, medium or low.

• Traffic drop, Position drop, CTR drop, New & lost rankings: from the size of the move. 30% or more is critical, 20% high, 10% medium, anything smaller low.
• Traffic spike: high when clicks at least doubled, otherwise medium.
• Traffic anomaly: critical at a score of minus 7 or lower, high at minus 5 or lower, otherwise medium.
• Index flip: high when ten or more URLs changed, otherwise medium.
• Measured rank drop: from the largest fall, with 20 positions or more critical, 10 high, 5 medium and fewer low.
• Audit regression: high for ten or more extra critical issues, medium for five, otherwise low.

Minimum severity (default low) drops anything below it. Pair a low threshold with a high minimum and the detector notices small moves while only large ones reach the channel. Test rule tells you when that happened, naming the severity and the minimum it fell short of. A fired alert is never below low, so low and info behave the same.

When the checks run

• Every detector except Index flip runs once a day, in the 06:00 UTC run. Its window ends on the previous day (UTC) and is compared with the same number of days before it.
• Index flip runs every hour and counts the changes since the rule last fired, or over the last 24 hours if it has not fired yet. The changes come from the Index Tracker, which re-inspects the URLs you track.
• Once a rule has posted for a property, it stays quiet for that property until the next UTC day.
• If the post fails, nothing is marked as sent, and the next check evaluates the rule again: the next morning for daily detectors, the next hour for index flips.

AutoPSEO asks Search Console for finalised figures only (the dataState option of the Search Analytics API). If Google has not finalised the newest day by the time a check runs, that day counts as empty, so look at the dashboard before acting on an alert about a single day.

The traffic anomaly detector

This is the only detector that judges a single day. It takes the daily clicks of the window, at least 14 days and 28 by default, ending yesterday, and scores the newest day with the modified z-score recommended by Iglewicz and Hoaglin (NIST/SEMATECH e-Handbook):

score = 0.6745 × (newest day − median) ÷ median absolute deviation

It fires when the score is at or below minus the threshold. The default of 3.5 matches the cut-off those authors suggest for potential outliers, and a smaller number catches more. Because the score is built from medians, one odd day earlier in the window barely shifts it.

Know its limits before you trust it:

• It only looks for drops. Use Traffic spike for rises.
• It does not separate weekdays from weekends. A site that goes quiet every Sunday may need a higher threshold.
• On a very small site where at least half the days share the same count, the spread is zero and any lower newest day scores as extreme.

Thresholds, windows and properties

• Threshold: up to 1000, in steps of 0.5; an empty or zero value falls back to the detector's default. The unit follows the detector (percent, z-score, events, positions or issues), and the form explains it under the field.
• Window (days): 1 to 90. For the comparison detectors it sets the length of both windows. Traffic anomaly reads at least 14 days whatever you enter, and Index flip, Measured rank drop and Audit regression compare events, checks or audits, so for them the window only appears in the message.
• Properties: tick any number. With none ticked, the rule covers every property in your account, looked up again at each check.

Muting, pausing and testing

• Mute until takes a date. The rule is skipped until 00:00 UTC on that day, and its row shows a Muted badge while a date is set. Clear the date to end the mute early.
• Pause stops the rule without losing its settings, and Resume starts it again.
• Test rule runs the detector now for every property the rule covers, ignoring the mute and the once-a-day limit. It posts only when the detector fires and otherwise tells you what it measured. A test that posts counts as that property's alert for the day.

Detectors that need research data

Measured rank drop reads Rank Tracking (under Research). It needs a tracker on the property with at least two completed checks, compares each keyword per device between the last two, and treats a keyword that fell out of the tracked depth as one position past it. Audit regression reads Site Audit and needs two completed audits. Both stay silent on the demo property.

What an alert message contains

The title names the detector and the property, followed by a one-sentence summary such as Clicks 1,500 vs 2,000 in the previous window (-25.0%). Then come the metric, the current value, the baseline, the window with its dates and the change, and an Open report button. It opens the dashboard for most detectors, Rank Changes for New & lost rankings, Rank Tracking for Measured rank drop and Site Audit for Audit regression. Slack puts a severity marker at the start of the title, Teams colours the title, and a webhook receives the same facts as JSON (Outbound webhooks).