Search Console

The SEO app can connect to Google Search Console — Google’s own view of your site in search. Once connected, Overwatch joins that data onto the reports it already produces:

• A Search performance section on the SEO report: clicks, impressions, CTR, and average position over the last 28 days, a daily trend, top pages, and top queries.
• Traffic-weighted findings: pages in the SEO report show their search impressions, and broken links that still earn impressions are flagged — a dead page people still find in Google outranks a forgotten one.
• Index coverage from the URL Inspection API: which crawled pages are in Google’s index, which aren’t (and why), and the canonical Google actually chose for each page.

Connecting

Search Console is connected per site, from Settings → Apps → SEO (owner/admin only):

1. Connect Google Search Console sends you to Google’s consent screen — sign in with an account that can read the site’s Search Console property (the webmasters.readonly scope; Overwatch never gets write access).
2. Back in Overwatch, choose the property. Domain properties (sc-domain:example.com) are preferred over URL-prefix properties (https://example.com/) because they cover every protocol and subdomain — a URL-prefix property that doesn’t match the crawled host (e.g. www. versus bare) returns no data.
3. Data arrives with the next sync (within the hour).

The Google refresh token is encrypted at rest and never appears in any API response. Disconnecting revokes it at Google and deletes all stored search data for the site.

How syncing works

• Search Analytics (clicks/impressions/position) syncs about once a day per site. Google’s search data lags roughly two days, so “last 28 days” ends two days ago.
• URL Inspection is quota-limited by Google (~2,000 URLs per property per day), so Overwatch inspects a bounded batch every few minutes, cycling through the latest crawl’s pages oldest-first. A large site’s first full index-coverage picture builds up over a few days.
• If two Overwatch sites connect the same Search Console property (e.g. staging and production), they share that property’s inspection quota.

Search insights and alerts

The Search performance section computes a few opinionated findings from the synced data:

• Striking-distance queries — queries ranking between position 5 and 20 with real impressions, where targeted improvements can reach page 1.
• Low-CTR pages — pages ranking well but earning far fewer clicks than their position normally gets; usually a truncated or unappealing search snippet (check the title/description findings).
• Orphan winners — URLs receiving clicks that the crawl never found: removed or unlinked content still in Google’s index.
• URL-variant splits — the same page collecting traffic under http/https or www variants, splitting its ranking signals.

A search-traffic-drop alert (own recipient list under Notifications) fires when a site’s weekly clicks fall at least 35% against the previous week, with a minimum baseline so low-traffic noise never pages anyone. It’s transition-based: one alert per drop, reset by recovery. Generic webhooks receive a search.dropped event.

The URL Inspection results also feed back into the SEO report: when Google’s chosen canonical is known for a page with a canonical mismatch, the finding says whether Google agreed with the declared canonical or ignored it.

Revocation and errors

If the Google account’s access is revoked (or the password owner removes the grant), the connection flips to revoked and the SEO app’s settings show a Reconnect button. Sync errors likewise surface there without interrupting the rest of the app.

Note for self-hosters: the connector requires a Google Cloud OAuth client (GSC_CLIENT_ID / GSC_CLIENT_SECRET secrets, plus a GSC_TOKEN_KEY for token encryption) with <worker-origin>/v1/gsc/callback as an authorized redirect URI. The webmasters.readonly scope is classed as sensitive, so an unverified consent screen runs in Testing mode with allow-listed users until Google verifies the app.