The Q4 Playbook Just Changed: 4 Shifts to Act On Before the Holidays

If your marketing feels like it’s working harder for less, you’re not imagining it.

Over the past few months, Google and Meta rolled out some of their biggest changes of the year. Many of them landed right before the busiest selling season. Some change where your customers find you. Others change how much control you have over your ads.

The good news: none of these shifts require a bigger budget. They require adjusting early. Below are the four changes we’re watching most closely for our clients, and exactly what we’d do about each one before holiday traffic peaks.

Search is answering instead of sending

More people are getting their answer on Google without ever visiting a website. A SparkToro study using Similarweb data found that 68% of U.S. Google searches ended without a click from January to April 2026. That’s up from 60% in 2024.

AI is a big part of the reason. Google says its AI Mode has passed 1 billion monthly users, with queries more than doubling each quarter. And at Google Marketing Live 2026, Google announced it is testing ads inside AI Mode:

So when people ask “is WordPress secure?”, the better question is: is your WordPress site secure? That depends on three things:

Why it matters

When there’s no click to win, the business that gets recommended wins. AI tools pull from your website, your Google Business Profile, your reviews and your product data. If that information is thin, vague or out of date, you’re easy to skip.

What we’d do

1. Update your Google Business Profile: hours (including holiday hours), services, photos and categories.
2. Rewrite key service and product pages to answer real customer questions in plain language: what it is, who it’s for, what it costs, how it works.
3. Clean up your product feed in Google Merchant Center if you sell online. Accurate titles, prices and stock levels feed both Shopping ads and AI answers.
4. Ask happy customers for reviews now, before the holiday rush.

Attackers move within hours, not weeks

Here’s the number every site owner should know: the median time from a vulnerability being disclosed to mass exploitation is just 5 hours. About half of high-impact vulnerabilities are exploited within 24 hours.

Put simply, if a plugin on your site has a security flaw and you update it “sometime next month,” you’ve likely already been scanned, and possibly hacked.

Hosting protection alone isn’t enough

Many site owners assume their web host handles security. Patchstack tested this and found typical hosting defences blocked only 12% to 26% of attacks on known WordPress vulnerabilities. Your host is one layer. It shouldn’t be your only one

Meta is taking the wheel

Meta is testing the removal of placement controls for Sales and Leads campaigns. In those ad sets, advertisers can no longer exclude specific placements, platforms, devices or operating systems. Meta’s AI decides where your ads appear across Facebook, Instagram, Messenger and its partner network.

It’s a test for now, not a full rollout. But it fits a clear pattern: Meta keeps handing more decisions to its algorithm and fewer to advertisers. Some control remains. You can still adjust bids by placement with value rules, or block placements at the account level.

So when people ask “is WordPress secure?”, the better question is: is your WordPress site secure? That depends on three things:

Why it matters

When the algorithm picks where your ads run, the quality of what you feed it matters more than ever. That means your creative and your conversion data.

What we’d do

1. Build creatives for every placement: vertical 9:16 video for Reels and Stories, square for feeds. Don’t let Meta crop a single horizontal ad to fit everywhere.
2. Run several creative variations per ad set so the algorithm has options to test.
3. Check your Meta Pixel and Conversions API setup. Make sure Meta is optimizing toward real purchases and qualified leads, not cheap clicks.
4. Review your placement results weekly during Q4, and use account-level controls if a placement is clearly wasting spend.

Attackers move within hours, not weeks

Here’s the number every site owner should know: the median time from a vulnerability being disclosed to mass exploitation is just 5 hours. About half of high-impact vulnerabilities are exploited within 24 hours.

Put simply, if a plugin on your site has a security flaw and you update it “sometime next month,” you’ve likely already been scanned, and possibly hacked.

Hosting protection alone isn’t enough

Many site owners assume their web host handles security. Patchstack tested this and found typical hosting defences blocked only 12% to 26% of attacks on known WordPress vulnerabilities. Your host is one layer. It shouldn’t be your only one

Creators’ Instagram Lives are now an ad format

On September 15, Meta launched its Creator Marketing Hub globally. It combines the old Creator Marketplace and Partnership Ads Hub into one place. Brands can find creators, message them directly, and turn their content into ads in one click.

As of September 29, 2026 brands can also run a creator’s Instagram Live as a partnership ad. That was previously only possible on Facebook.

Why it matters

People trust people more than brands. MediaPost cites the 2025 IAB Creator Economy Report, which found 45% of consumer purchases are influenced by creator recommendations. Partnership ads let you put that trust behind paid reach, and Live adds real-time demos and Q&A.

What we’d do

1. Pick one or two creators whose audience looks like your customers. Local and niche creators often beat big names on cost and trust.
2. Start small: a single product demo, a behind-the-scenes look, or a holiday gift guide. 
3. Run the best-performing creator posts as partnership ads, and compare the results against your own brand ads.
4. Get the test live before Black Friday so you have data to scale into December.

Attackers move within hours, not weeks

Here’s the number every site owner should know: the median time from a vulnerability being disclosed to mass exploitation is just 5 hours. About half of high-impact vulnerabilities are exploited within 24 hours.

Put simply, if a plugin on your site has a security flaw and you update it “sometime next month,” you’ve likely already been scanned, and possibly hacked.

Hosting protection alone isn’t enough

Many site owners assume their web host handles security. Patchstack tested this and found typical hosting defences blocked only 12% to 26% of attacks on known WordPress vulnerabilities. Your host is one layer. It shouldn’t be your only one

Google Display is moving into Demand Gen

Google is folding standalone Display campaigns into Demand Gen. Demand Gen campaigns can now reach the Google Display Network’s 2 million-plus sites and apps, alongside YouTube, Discover, Gmail and Google Maps. You can still choose to serve ads only on the Display Network if you prefer.

Google expects the migration to finish by 2027 and says it will provide a migration tool. It also reports that advertisers who add the Display Network to Demand Gen see a 9.5% average increase in ROI. That’s Google’s own number, so treat it as a starting hypothesis, not a promise.

Why it matters

Your current Display campaigns will eventually move whether you’re ready or not. Demand Gen leans heavily on visual creative and automation, so campaigns built for old-style Display often need rework to perform.

What we’d do

1. Don’t wait for a forced switch. Launch a small Demand Gen test alongside your existing Display campaigns.
2. Build the creative Demand Gen needs: strong images in multiple sizes, plus short vertical and horizontal video.
3. Compare costs per lead or sale across both before shifting more budget.
4. Keep your biggest holiday budgets in whatever is proven, and scale the winner in January.

Your pre-holiday checklist

Want a second set of eyes before the holidays?

The businesses that win this holiday season will be the ones that adjusted early. If you’re not sure where to start, we can help.

We offer complimentary 30 to 60 minute strategy calls. We’ll look at your ads, tracking and search visibility, and point out the quick wins worth making before holiday traffic peaks.