Google Spam Update September 2026: What to Check Now

Google released the September 2026 spam update on September 24, 2026, and marked the rollout complete on October 8, 2026, after almost 14 days. It applied globally and to all languages. A Google spam update improves the automated systems that demote pages breaking Google's spam policies, so if your traffic moved between those dates, the first job is to check whether the timing actually matches and whether you have a manual action.

This one stood out for its length, not its scope. Google's three earlier spam updates in 2026 each finished in under three days. Below: what Google confirmed, how spam updates differ from core updates, the exact Search Console date ranges to compare, what to do if you lost traffic, and what nobody outside Google knows yet.

#What Google released, and when

The announcement went up on the Google Search Status Dashboard entry for the September 2026 spam update at 09:15 US Pacific on September 24. The first note read: "Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete." The closing note followed on October 8: "The rollout was complete as of October 8, 2026."

The dashboard records the window as 09:15 on September 24 to 01:00 on October 8, Pacific time. That is 13 days, 15 hours and 45 minutes. For a spam update, that is long.

The "two weeks" wording was unusual enough that Barry Schwartz asked John Mueller on Bluesky whether it was a typo. Mueller replied: "Yes, it's likely to take longer than some of the previous ones." He did not say why. Google's LinkedIn announcement, as quoted by Search Engine Roundtable, described it as "a normal spam update".

Two other things happened in the same window, and neither is part of the spam update. On October 1, Google updated its guide on using generative AI content with material from the Search Quality Rater guidelines. That is a documentation change to a guide, not a ranking update. No core update ran in September or October either: the last one on the dashboard is the May 2026 core update, which finished on June 2.

#What a Google spam update targets

Google runs its spam detection all the time. A spam update is the moment Google ships a notable improvement to those systems. Its documentation on spam updates puts it plainly: "While Google's automated systems to detect search spam are constantly operating, we occasionally make notable improvements to how they work. When we do, we refer to this as a spam update."

The one Google names is SpamBrain, which it calls "our AI-based spam-prevention system". The same page says Google improves it from time to time "to make it better at spotting spam and to help ensure it catches new types of spam." So a spam update does not create new rules. It gets better at enforcing the existing ones.

Those rules are Google's spam policies for web search. The page lists cloaking, doorway abuse, expired domain abuse, hacked content, hidden text and link abuse, keyword stuffing, link spam, machine-generated traffic, malicious practices, misleading functionality, scaled content abuse, scraping, site reputation policy, sneaky redirects, thin affiliation and user-generated spam. Its definition of spam now covers "attempting to manipulate generative AI responses in Google Search" as well as rankings.

The policies themselves changed several times this year. Google's Search documentation changelog records these 2026 changes:

• April 13: "back button hijacking" added to the malicious practices policy.
• April 14: "Google may now use spam report submissions to take manual action."
• May 15: spam policies clarified to "also apply to generative AI responses in Google Search."
• August: the site reputation policy updated, with a changed enforcement approach in the European Economic Area.

None of that tells you what the September update focused on. Google did not name a policy. It does tell you which rules are newest, and new rules are the ones most site owners have not yet checked themselves against.

Two policies catch ordinary businesses more often than the dramatic ones. Scaled content abuse applies to unoriginal pages made in bulk "no matter how it's created", which covers AI tools, templates and hand-written filler alike. Link spam includes paid links, link exchanges and keyword-rich links in guest posts. Paid links are fine when they carry rel="sponsored" or rel="nofollow"; the policy problem is passing ranking credit. If you are unsure whether your own pages pass the people-first test, our guide to what Google means by helpful content walks through Google's self-assessment questions on a real page.

Hacked content is the other one to rule out early. It sits on Google's spam list even though the owner never added it, and cloaked pages planted by attackers can go unseen for months. Our explainer on how Google treats cloaking shows how to fetch a page the way Googlebot does.

#How a spam update differs from a core update

People blame every drop on "the algorithm", but Google's two kinds of announced update work differently, and the fix depends on which one hit you.

Google's core updates guide describes those updates as "significant, broad changes to our search algorithms and systems" made "several times a year". Its analogy is a list of favourite restaurants: places that move down "aren't necessarily bad", there are simply better options now. A spam update has no such comfort. If it demoted you, the systems believe something on your site breaks a rule.

That difference changes the work. After a core update, Google suggests improving content and avoiding quick fixes. After a spam update, the first question is narrower: which policy, and on which pages?

#How to tell whether the September 2026 spam update hit your site

Google does not notify sites that an automated spam update affected them. You infer it from timing and pattern. Work through these checks in order, because the cheap ones rule out most false alarms.

1. Open the Manual Actions report first

In Search Console, go to Security & Manual Actions → Manual actions. A manual action is different from a spam update. Google issues one "when a human reviewer at Google has determined that pages on the site are not compliant with Google's spam policies", and it appears in that report with the affected URL patterns. If you have one, the path forward is clear: fix it and request review. If the report says "No issues detected", any spam-related demotion is algorithmic.

2. Line up the right dates in the Performance report

Use Performance → Search results → Date → Compare → Custom. These ranges work for this update:

• Baseline: September 10 to 23, 2026. That is two clean weeks: the August spam update finished on August 21, and nothing else appears on the dashboard until September 24.
• Rollout: September 24 to October 8. Check the daily chart for a step change. Third-party rank trackers, as rounded up by Search Engine Roundtable, showed the heaviest movement from Friday September 25 to Sunday September 27. Those trackers measure volatility across keyword sets, not the cause of any one site's change.
• After: October 8 to 21. Google's core update guidance recommends waiting at least a full week after a rollout finishes before judging, and Search Console data lags by a day or two, so the earliest fair after-week is October 8 to 14, readable from about October 16.

Compare 14 days against 14 days, so the same weekdays line up. Then click through the Queries, Pages, Countries and Devices tabs, as Google's guide to debugging traffic drops recommends, to see whether the change is site-wide or concentrated.

3. Size the drop

Google's guidance draws a line between a small drop, "dropping from position 2 to 4", and a large one, "dropping from position 4 to 29". A two-place slip across a few queries is normal movement. A page or a whole folder falling off page one in the rollout window is the pattern worth investigating as a possible spam demotion.

4. Look for a pattern in the pages that lost clicks

In the Pages tab, sort by Clicks Difference. If the losses cluster in one section, such as /locations/, /deals/, a set of programmatic city pages or a guest-post category, compare that section against the spam policies above. Doorway pages, scaled content and paid-link posts tend to live together in one folder. A site-wide drop across unrelated pages points more towards a technical problem or a manual action.

5. Rule out the boring causes

Before blaming the update, check the Page indexing and Crawl stats reports for a spike in errors, set the date range to Last 16 months to spot seasonal dips, and check the Search Console data anomalies page for reporting problems. A Diwali sale page in India, a Black Friday page in the US or a January-sales page in the UK will rise and fall every year regardless of Google. If the cause is that pages dropped out of the index, our checklist for why a website is not showing on Google covers those checks in order.

If you track rankings per page in Project Rankup's Rank Tracker, its click and position deltas give you the same before-and-after view by URL. Search Console alone is enough, though.

#What to do if your traffic dropped

Decide first which kind of problem you have. The work for a manual action and the work for an algorithmic demotion overlap, but the way you find out it worked does not.

If you have a manual action, fix every issue listed on every affected page, then select Request review and describe what you changed. Google says most reconsideration reviews "can take several days or weeks", and link-related ones can take longer. You will get an email when the review is done.

If you have no manual action but the timing and pattern fit, there is no request to file. Google's spam update documentation says: "Making changes may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies." Months, not days. The practical sequence:

1. Name the policy. Match the section that lost traffic to a specific policy on Google's list. "Thin affiliation" or "scaled content abuse" is something you can act on; "quality" is not.
2. Fix it at the source. Rewrite or consolidate bulk-made pages into fewer, genuinely useful ones. Add rel="sponsored" to paid placements. Remove injected pages and close the security hole that let them in. If a section cannot be made useful, Google's spam policies say to exclude it from Search, for example with noindex.
3. Fix the process that made it. If a vendor, plugin or template produced the problem, the same thing will come back next quarter unless the process changes. An audit that only cleans up last month's pages is half the job; our guide on how to do a content audit sets up a repeatable keep, improve, merge or remove decision.
4. Log the date of every change and watch the affected folder, not the whole site.

One case will not recover the way people hope. For link spam, Google is blunt: once its systems remove the effect of spammy links, "any ranking benefit the links may have previously generated for your site is lost. Any potential ranking benefits generated by those links cannot be regained." If your rankings were built on bought links, the rankings were the thing that was removed. The only route back is earning links and content that justify the position.

#What not to do after a spam update

Most damage after an update comes from panicked changes rather than from the update itself.

Do not rush to the disavow tool. Google's own help page says "most sites will not need to use this tool", and it is meant for a large number of bad links that have caused, or are likely to cause, a manual action. A batch of strange links in a backlink tool is not evidence of an attack. Our explainer on what disavow does and when Google says to use it covers the two conditions, and our guide to telling a real negative SEO attack from normal noise explains why spam links pointing at you are usually ignored.

Do not rewrite pages that only slipped a little. Google advises "avoiding making radical changes if your page is already performing well". A product page that moved from position 2 to 4 is not a spam case.

Do not mass-delete content on a hunch. Even in its core update guidance, Google calls deleting content "a last resort". Delete or noindex the pages that break a policy; leave the rest alone until you know what happened.

Do not judge results mid-rollout. Rankings moved on different days during the two weeks. A drop on day three told you nothing final, and changes made during the rollout make it harder to tell later which action worked.

Do not pay for a "spam update recovery" package that promises results in days. Google's documentation says recovery takes months for algorithmic demotions, and nobody outside Google can see SpamBrain's verdict on your site.

#What is still unknown about the September 2026 update

Google publishes no list of affected sites, and it did not name a policy or tactic this update focused on. Claims that it targeted AI content, link spam or any one niche are guesses until Google says otherwise.

We also do not know why it took longer. Mueller confirmed only that it would. A longer rollout could mean more systems changed, a staged release or simply a cautious pace. Nothing published supports one reading over the others.

Impact numbers are missing too. Google gave no share of queries affected, and third-party volatility indexes measure how much rankings moved across their own keyword sets, not why. Treat any "X% of sites hit" figure as a tracker's estimate.

Finally, there is no way to know whether the update has settled your site for good. Spam systems keep running between announced updates, so a site that escaped in September can still be caught later, and a site that cleans up can recover between updates. The next confirmed event will appear on the same dashboard. Bookmark it rather than relying on social media summaries.

Frequently asked questions

When was the last Google spam update?

The most recent confirmed one is the September 2026 spam update. It began on September 24, 2026 and Google marked it complete on October 8, 2026. Before that, Google released spam updates in August 2026 (August 18 to 21), June 2026 and March 2026. Google lists every confirmed ranking update on its Search Status Dashboard.

How long does a Google spam update take to roll out?

It varies. In 2026 the March, June and August spam updates each finished in under three days, and Google estimated "a few days" for each. The September 2026 update was announced as "up to two weeks" and took 13 days and 16 hours. Core updates usually take about two weeks.

Does Google tell you if a spam update affected your site?

No. Algorithmic demotions from a spam update do not generate a message. Search Console only notifies you about manual actions, which a human reviewer issues and which appear in the Manual actions report. For an automated update, you infer impact by comparing Search Console data from before, during and after the rollout dates.

Can a site recover from a Google spam update?

Yes, if the problem is fixed. Google says changes may help "if our automated systems learn over a period of months" that the site complies with its spam policies, so expect months. The exception is link spam: ranking benefit that came from spammy links is removed for good and cannot be regained.

Should I disavow links after a spam update?

Usually not. Google says most sites do not need the disavow tool and reserves it for many spammy links that have caused, or are likely to cause, a manual action. An algorithmic spam update already discounts the links it identifies, so disavowing adds little, and Google warns the tool can harm performance if used incorrectly.

Is a spam update the same as a manual action?

No. A spam update is an automated change to systems like SpamBrain that affects many sites at once, with no notification. A manual action is a penalty a Google reviewer places on one site, shown in Search Console, and lifted through a reconsideration request after you fix the issue.