Website Traffic Dropped Suddenly? Work Out Why in 30 Minutes (2026)
A sudden traffic drop has five plausible causes, and they're worth ruling out in a fixed order — cheapest check first — before you spend a cent trying to fix the wrong one.
Before you work out why your traffic dropped, spend five minutes confirming that it dropped at all. The most expensive version of this problem is the one where a tracking tag quietly stopped firing during a deploy and the business spent the next three weeks rewriting content, commissioning an SEO review and arguing about the algorithm, to fix a fault that was never in the website's performance. It was in the measurement of it.
The good news is that a sudden drop, as opposed to a slow six-month slide, has a short list of plausible causes: the analytics broke, the season turned, Google changed something, the site changed something, or Google has taken manual action against the site. Each one has a specific check, and the checks get progressively more expensive to run. Do them in that order and half an hour is genuinely enough to know which category you're in.
Minutes 0–5: prove the drop is real
You have two independent measurements of the same thing, and comparing them settles this almost immediately. Google Search Console counts clicks from Google's side of the transaction. Your analytics counts sessions from your side. If Search Console clicks held steady across the drop while analytics sessions fell off a cliff, your traffic didn't go anywhere. Your tag did.
The usual culprits are unglamorous. A deploy dropped the tracking snippet out of a template, sometimes only one template, so the drop is confined to blog pages or product pages rather than the whole site. A cookie consent banner was added and now blocks analytics until a visitor actively accepts. A tag manager container was published with a change nobody reviewed. A second property or data stream was created during a rebuild and the data is now split across both. An internal-traffic filter is excluding more than it was meant to.
The two-minute version of this check: open your site in a private browser window, then look at the Realtime report in your analytics. If you can't see yourself, the tag is gone and the rest of this post doesn't apply to you.
While you're here, ignore the last day or two entirely. Google's own documentation for the Search Console Performance report notes that the newest data can be preliminary, still being collected, and may change. Analytics has the same problem with late-arriving events. Every traffic graph droops at the right-hand edge, and a surprising number of panics start there.
One more thing worth knowing before you mourn a drop: GA4 automatically excludes traffic from known bots and spiders, using a combination of Google research and the International Spiders and Bots List maintained by the Interactive Advertising Bureau, and Google states plainly that you can't disable that exclusion or see how much was excluded. Which means the bots it doesn't recognise — scrapers, uptime monitors, someone's AI crawler — can quietly inflate your baseline for months and then stop. The graph reads as a 20% collapse. Enquiries don't move, because nothing that mattered ever left. If the fall sits in Direct or Referral and the sessions had near-zero engagement, you lost robots, not customers.
Minutes 5–10: find out which channel actually fell
Open your acquisition report, compare the four weeks after the drop against the four weeks before, and read it channel by channel rather than as one line. Three shapes are possible and each routes you somewhere different.
If every channel fell by roughly the same proportion on the same day, you're either looking at a measurement fault, or the site was genuinely unreachable for a while. Check uptime and check the certificate. An expired TLS certificate turns every visitor away with a full-page browser warning, and it happens most often on sites where the auto-renewal quietly stopped working months earlier.
If one channel fell and the others held, the cause lives inside that channel. Paid traffic that stopped is usually a budget that ran out, a card that declined, an ad that got disapproved, or a campaign someone paused and forgot. Referral and social channels are usually carried by one or two sources, so sort by source and find the one that went to zero — a directory listing that lapsed, a partner site that redesigned and dropped your link, a post that stopped circulating. Direct traffic is a catch-all bucket for anything arriving without a referrer, so a drop there often traces back to an email campaign that ended rather than anything on your site.
If organic search fell while branded and direct traffic held steady, the rest of this post is your diagnostic path.
Minutes 10–15: rule out seasonality before anything clever
This is the step people skip because it feels too obvious, and it's the one that most often ends the investigation.
Compare the same weeks against last year, and against the year before if you have the data. Not against last month. Month-on-month comparisons in a seasonal business are close to meaningless, and Australian and New Zealand calendars are lumpier than most. January half-shuts. School holidays move demand around for anything family-facing. The 30 June financial year end pulls a month of spending forward and leaves July looking dreadful by comparison. Easter drifts between March and April, so the same calendar week isn't the same trading week two years running.
If last year's graph has the same notch in the same fortnight, you've found your answer, and the correct response is to do nothing and stop looking. Wasting a fortnight and a consultant's fee on a dip that arrives every winter is a cost that's entirely avoidable with a year-on-year toggle.
Minutes 15–20: check whether Google moved, not you
Google publishes every confirmed ranking update, with the date each one started rolling out, on its Search Status Dashboard. Find the day the line bent in your Search Console Performance report, then check that date against the dashboard. If they line up within a day or two, you've almost certainly found the trigger, and what happens next is a different process to the one you'd run for a technical fault — updates roll out over one to three weeks, the middle of a rollout is noise rather than signal, and reactive changes made inside that window usually make things harder to read. We've written the full checklist for an algorithm-driven drop if the dates match.
While you're in the Performance report, look at impressions and clicks as a pair rather than separately. Impressions down means Google is showing your site less often, which is a ranking or indexing problem. Impressions steady with clicks down means Google is still showing you at the same rate and something about the results page itself is absorbing the click — a bigger local pack, an AI Overview, a competitor with a better snippet. Those two patterns look identical in a traffic graph and lead to completely different work.
Minutes 20–27: the technical faults that look exactly like a penalty
Genuine technical causes of a sudden organic drop are a short list, and every one of them is checkable in about a minute.
Load yourdomain.com/robots.txt and confirm it isn't disallowing everything. Check the page source of an important page for a noindex tag that came across from staging. Confirm the certificate is valid and HTTP still forces to HTTPS. Check whether the site got substantially slower, which usually traces to a plugin or theme auto-update, a new third-party script, or an unoptimised image someone uploaded straight off a camera.
Then do the thing that finds the cause faster than any tool: line the drop date up against your own change log. A deploy, a plugin update, a new booking widget, a DNS change, a rebrand, a content migration. If URLs changed without redirects, that alone explains it, and what actually breaks during a host or domain move covers the specific faults worth checking. For the broader question of whether you're looking at a site problem or an SEO problem, the ranking-drop diagnostic works through it properly.
Minutes 27–30: the one cause Google tells you about directly
Open Search Console, go to Security & Manual actions, and look at the Manual actions report. Google's documentation is direct about what this means: a manual action is issued "when a human reviewer at Google has determined that pages on the site are not compliant with Google's spam policies," and if a site has one, "some or all of that site will not be shown in Google search results."
For a legitimate business this is rare, and it's almost never something the owner did knowingly. The common route is inherited: a domain bought with history attached, or link-building an agency ran years ago that hasn't aged well. The report tells you the issue, you fix it across every affected page, then request a review and describe what you changed. Google notes that reconsideration reviews take days or weeks, and that resubmitting before you get a decision doesn't help.
Check the Security issues report on the same screen while you're there. Hacked content and injected spam pages produce exactly this shape of drop, and they're considerably more common than a manual action.
When thirty minutes isn't enough
If all five come back clean — the tag is firing, the drop is confined to organic, last year's graph is flat through the same weeks, no confirmed update lines up, nothing changed on the site, no manual action — then you're most likely looking at a competitor who improved, a link you lost, or a structural decline that only looks sudden because this is the first time anyone opened the report in six months. That's a longer piece of work than half an hour, but at least you're spending it on the right question.
The honest limit of this process is that thirty minutes gets you the category, not the cure. It's still the best thirty minutes available, because every fix from here is expensive and aiming one at the wrong cause costs more than the drop did.
If you want the platform side ruled in or out before you go any further, run the free audit. It checks Core Web Vitals and PageSpeed on mobile and desktop, your TLS certificate, DNS and email records, page weight, HTML structure, and whether robots.txt and your sitemap are letting crawlers through at all — in about a minute, no signup, and it will tell you quickly whether the site underneath the traffic is part of the story.