Every SEO conversation we've had this year has turned to AI within about five minutes. Usually the question is some version of "can't we just generate a hundred pages and rank for everything?" You can generate them. They probably won't rank, and the shortcut can cost you more than the time you saved.
We use AI every week in SEO work, and it's genuinely useful. The trouble starts when people treat it as a publishing machine instead of an assistant, and when nobody asks what the new tools are connected to.
Where AI earns its place
The boring jobs. Grouping a few thousand keywords by intent. Drafting meta descriptions you'll then rewrite. Suggesting internal links between related pages. Spotting pages with duplicate titles. Turning a messy FAQ into clean schema markup you can check before it goes live. That's real time saved, and a mistake in any of it is cheap to catch.
Where it goes wrong
Mass-produced pages are the obvious one. Fifty "best plumber in [city]" pages with the same paragraphs reshuffled is exactly the pattern search engines got good at ignoring. The less obvious one is confident nonsense: a made-up statistic, a wrong price, or a feature your product doesn't have, all written in a tone that sounds sure of itself. When it's on your service page, it's your claim, not the tool's.
Our rule is simple: AI can draft, but a person who knows the business signs off on everything that gets published. If nobody on the team could have written the page themselves, it probably shouldn't go live.
The security side nobody budgets for
Here's the part that rarely comes up in SEO meetings. People paste client lists, unpublished pricing, and analytics exports into public chat tools to "get insights." Read the data terms first. If you wouldn't email it to a stranger, don't paste it into a tool whose retention policy you've never read.
Then there are plugins. AI SEO add-ons often ask for admin access, an API key, and permission to edit every post. Each one is another piece of code running with high privileges on your site. We've cleaned up WordPress installs where a stale plugin let attackers inject hidden spam pages, the kind that fill Google with pharmacy or casino links under your domain. Rankings drop, Search Console flags the site as hacked, and you lose weeks recovering.
A few habits prevent most of it:
- Keep API keys for AI tools on the server, never in front-end JavaScript where anyone can copy them.
- Give plugins the smallest role that works, and delete the ones you stopped using.
- Check Search Console's Security Issues and Pages reports every month, not only when traffic drops.
- Decide on purpose which AI crawlers you allow in
robots.txt, rather than leaving it to defaults.
A hacked site doesn't rank
This is the point we keep coming back to: SEO and security aren't separate projects. A site full of injected spam, malware warnings, or a broken certificate will lose rankings no matter how good the content is. Treat them as one job. That's how we run SEO for clients: content and technical fixes, plus a regular check that nothing is quietly undoing the work.
