Google Spam Update September 2026: Was Your Site Hit, and What Should You Do?
By Ashikur Rahman19 min readQuick answer: Google released the September 2026 spam update on 24 September 2026 at 9:15 a.m. PDT. It applies globally and to all languages, and Google says the rollout "may take up to two weeks", so it can run until about 8 October 2026. That window is the news: the March, June and August 2026 spam updates were each announced as "a few days" and each finished in under three. Google has not said what this one targets. If your traffic fell inside the window, check the Manual Actions report first, then compare your drop date against the rollout before you change anything.
What did Google announce on 24 September 2026?
The announcement is one entry on the Google Search Status Dashboard, posted at 9:15 a.m. Pacific time (16:15 UTC). It reads, in full: "Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete."
That is everything Google has published about it. There is no blog post, no list of targeted practices, no estimate of how many sites are affected and no example of a site that was hit. When I read the dashboard on 29 September 2026 the incident was still open, five days into the rollout, with no completion note.
Every article that tells you this update is "about AI content" or "about parasite SEO" is guessing. Some of those guesses may turn out right. None of them comes from Google, and you should not rebuild a site on a guess. What you can work from is the announcement, Google's history of spam updates, and the policy page the update enforces. All three are public, and together they say more than the rumours do.
Why is a two-week rollout unusual for a spam update?
Because the three spam updates before it this year were quick. Each was announced with the words "may take a few days to complete", and each finished well inside that. The September update is the first of 2026 announced in weeks. The table below comes from the dashboard's own incident pages, with durations worked out from the start and completion times Google prints.
| Spam update | Announced window | Started | Actual duration |
|---|---|---|---|
| March 2024 | "up 2 weeks" | 5 Mar 2024 | 14 days, 22 hours |
| June 2024 | "up to 1 week" | 20 Jun 2024 | 7 days, 1 hour |
| December 2024 | "up to 1 week" | 19 Dec 2024 | 7 days, 2 hours |
| August 2025 | "a few weeks" | 26 Aug 2025 | 26 days, 15 hours |
| March 2026 | "a few days" | 24 Mar 2026 | 19 hours, 30 minutes |
| June 2026 | "a few days" | 24 Jun 2026 | 2 days, 1 hour |
| August 2026 | "a few days" | 18 Aug 2026 | 2 days, 16 hours |
| September 2026 | "up to two weeks" | 24 Sep 2026 | Still running on 29 Sep 2026 |
Two things follow from the table. First, Google's stated windows are ceilings, not forecasts. June 2024 was given a week and used almost all of it; March 2026 was given "a few days" and was done in under a day. So "up to two weeks" means the rollout could end any day before 8 October, not that it will run the full fourteen days.
Second, a longer window suggests there is more to roll out than in the three quick updates earlier this year. That is an inference from the pattern, and I am labelling it as one. The window says nothing about what the change is, and Google has confirmed nothing about scope beyond the words quoted above.
For you, the practical meaning is simple. Movement you see during the next two weeks is not final, and positions can shift more than once before the rollout ends. Judge the result after Google posts the completion note, not during the rollout.
What changed in Google's spam policies since the last update?
A spam update does not create new rules. Google's page on spam updates and your site describes it as an improvement to automated systems that "are constantly operating", and it tells affected sites to "review our spam policies to ensure they are complying with those." So the useful question is what those policies say today, and whether they say something different from what they said last time an update ran.
They do, twice. I compared Wayback Machine captures of Google's spam policies page across 2026, and the page's own "Last updated" stamp confirms both changes.
15 May 2026: generative AI answers entered the definition of spam. The opening definition now reads that spam includes "attempting to manipulate Search systems into ranking content highly or attempting to manipulate generative AI responses in Google Search." The phrase about generative AI responses is absent from the 30 April 2026 capture and present from 15 May 2026. Content written to get lifted into AI Overviews by deception is now inside the same definition as content written to rank by deception.
28 August 2026: "Site reputation abuse" became "Site reputation policy". The section on third-party content published on a strong host site was rewritten a week after the August spam update finished on 21 August. The new version adds human review ("If we detect that a portion of your site may be out of line with this policy, a site will be subject to human review"), different treatment inside the European Economic Area, where such pages "may be categorized as separate from the main domain but won't be subject to the impact of manual action", a list of factors reviewers weigh, and a mediation route after a reconsideration request.
Put those dates next to the update history and the timing is plain. The September 2026 spam update is the first spam update since either change. That is a fact about the calendar. Google has not said the update enforces either clause, and I am not claiming it does. But if you run content aimed at AI answers or host third-party sections on a strong domain, these are the two paragraphs to reread this week, because they are newer than any spam update you have lived through.
| Date | Change on the spam policies page | Who should reread it |
|---|---|---|
| 15 May 2026 | Definition extended to "attempting to manipulate generative AI responses" | Anyone publishing pages built mainly to be quoted by AI Overviews or AI Mode |
| 28 August 2026 | Site reputation section rewritten as a policy with human review, EEA treatment and mediation | Publishers hosting coupon, review or partner sections written by third parties |
If AI answers are where you want to appear, the honest route is the one Google describes for everyone, and I have set out what its 2026 guide actually says in how to rank in AI Overviews. Nothing in that guide requires the kind of manipulation the new clause describes.
How do you tell whether this update hit your site?
Start with the dates, not the news. Open the Performance report in Search Console, set the range to the last three months, and look at clicks and average position by day. Then answer one question: did the drop begin on or after 24 September 2026?
If it began before, this update did not cause it. It might have been the August spam update (18 to 21 August 2026), a technical change on your side, seasonality, or a competitor. If it began inside the window, the update is a suspect, not a verdict. Other things happen in the same fortnight.
There is one piece of good news in the calendar. The status dashboard lists no core update running alongside this one. The last core update was the May 2026 core update, which finished on 2 June; I covered what it changed and how to read its effects in the May 2026 core update breakdown. When a spam update and a core update land close together, as in March 2026 when the core update began two days after the spam update finished, separating the two is guesswork. This time a sharp drop between 24 September and the completion note has fewer named suspects than usual.
| What you see | What it most likely means | Where to check |
|---|---|---|
| Drop started before 24 September | Not this update | Performance report, daily view, and your own change log |
| A few positions lost on some queries, impressions steady | Normal movement; Google's example of a small drop is "dropping from position 2 to 4" | Performance report by query |
| Whole site falls out of the top results inside the window | A spam system demotion is plausible; Google's large-drop example is "from the top 10 results to position 29" | Manual Actions report first, then the policy self-audit below |
| Pages leave the index rather than fall in rank | Could be spam, could be indexing | Page indexing report: see the notes on the two "not indexed" statuses below |
| One section drops, the rest holds | Look at what that section has in common: template, author, source or host | Performance report filtered by page path |
If pages are leaving the index rather than sliding down it, the status Search Console gives them matters more than the update. Crawled, currently not indexed means Google read the page and declined it, which is where quality and spam verdicts show up. Discovered, currently not indexed means Google never fetched the page at all, which points at crawl demand rather than anything a spam system judged.
Work with me
Did the spam update cause your drop, or did something else?
Most owners who search for this update after a bad week have a traffic drop and a date, and they join the two because the news is loud. Sometimes that is right. Often the drop started days before the rollout, or it sits on a set of pages no spam policy would touch, or Search Console is carrying a manual action nobody opened. Each of those needs a different first move, and the wrong one costs you months.
Send me the Search Console Performance export for the last three months and a note of when you first saw the drop. I will line the dates up against the rollout, check whether a manual action or a security issue is on the account, and tell you which policy your footprint resembles, or that it is not a spam problem at all. The first look is free.
Ashikur Rahman
SEO and AI Search Specialist
The contact links above go to me directly, so I earn from it if you hire me. Nothing else on this page is a paid placement.
Is it a spam update or a manual action?
These are different mechanisms, and people who treat them as the same waste weeks. Google's spam policies page says violations are detected "both through automated systems and, as needed, human review that can result in a manual action." A spam update changes the automated part. A manual action is the human part.
The Manual Actions report in Search Console tells you which one you have. Google's help page defines the second clearly: "Google issues a manual action against a site when a human reviewer at Google has determined that pages on the site are not compliant with Google's spam policies." If the report is empty, nobody at Google has taken action on your site, and whatever happened was automated.
| Spam update (automated) | Manual action (human review) | |
|---|---|---|
| How you find out | Traffic or rankings fall; nothing in Search Console names it | Listed in the Manual Actions report in Search Console |
| Who decided | SpamBrain and related systems | A reviewer at Google |
| Can you ask for a review? | No. There is no request form for an algorithmic demotion | Yes, a reconsideration request after you fix the issue |
| What Google says about timing | Improvement may come if systems "learn over a period of months" that the site complies | "Most reconsideration reviews can take several days or weeks" |
Two practical points. If you do have a manual action, the reconsideration process is the whole game: fix every listed issue, document it, send one request, and wait. Google's page asks you not to resubmit "before you get a final decision on your outstanding request." And if you do not have one, stop looking for a form. The only lever for an automated demotion is changing the site and giving the systems time to notice.
Check the Security Issues report while you are there. A hacked site can drop for reasons that look exactly like a spam demotion, because injected spam pages are a spam problem Google will act on whether or not you wrote them.
Which spam policies should a small business or affiliate site check?
Google lists sixteen spam practices on the policy page, plus sections on legal removals, personal information removals, policy circumvention and scams. Most small sites can rule most of them out in a minute: you know whether you cloak, stuff keywords or run sneaky redirects. The ones that catch honest owners are the ones where a normal business habit, scaled up, starts to match the definition. These are the five I would read first.
| Policy | Google's words | The question to ask your own site |
|---|---|---|
| Scaled content abuse | "many pages are generated for the primary purpose of manipulating search rankings and not helping users" ... "no matter how it's created" | Did we publish many pages quickly that say the same thing with a different keyword? |
| Thin affiliation | "product descriptions and reviews are copied directly from the original merchant without any original content or added value" | Could a reader get everything on this page from the merchant's own listing? |
| Doorway abuse | "multiple domain names or pages targeted at specific regions or cities that funnel users to one page" | Do our city or service-area pages differ in anything but the place name? |
| Expired domain abuse | "an expired domain name is purchased and repurposed primarily to manipulate search rankings" | Is this domain ranking on a reputation it earned under a previous owner for a different subject? |
| Link spam | "Buying or selling links for ranking purposes" | Have we paid, swapped goods, or traded links for placements that pass ranking credit? |
Two of those are worth a longer look because they catch well-meaning sites.
Scaled content abuse is about the pattern, not the tool. The policy's own example is "Using generative AI tools or other similar tools to generate many pages without adding value for users", but the words "no matter how it's created" mean hand-written pages count too. A hundred location pages written by a person, each with the same paragraphs and a new town name, match the definition as well as a hundred generated ones. The test is what each page adds that the others do not.
Thin affiliation is narrower than people fear. Google says outright that "Not every site that participates in an affiliate program is a thin affiliate." The policy targets pages where the reviews and descriptions come straight from the merchant. An affiliate page with its own comparison, its own arithmetic and its own reasons is not what this paragraph describes. The fix for a thin page is to add what only you can add, not to remove the links.
One more policy deserves a line. Policy circumvention covers "Using existing or creating new subdomains, subdirectories, or sites with the intention of continuing to violate our policies." Moving a demoted section to a new subdomain is the move this sentence was written for. Do not do it.
A deindexing on a site I own that was not a spam update
I learned to date a drop before naming a cause on my own site. In July 2026, bestdogcarseat.com, an affiliate site I own, lost its Google indexing. Search Console showed no manual action. Every URL sat at Crawled, currently not indexed. The story that fitted the news was that the June 2026 spam update had caught it, and the site's footprint matched the thin-affiliate and scaled-content definitions closely enough to make that story tempting.
The dates did not fit it. The June 2026 spam update completed on 26 June 2026. The site lost its indexing around 21 July 2026, 25 days after that. 15 of its posts had been published on 10 July 2026, after the June update had already finished running. And the dashboard shows no named ranking update running on 21 July: June's spam update was over and August's did not start until 18 August.
So I did not blame an update, because none was running. I treated the loss as what the Search Console status said it was: Google had read the site and declined it. I consolidated 56 posts into 18 on 28 July 2026 and removed claims on the pages that were not true. As of 29 September 2026 the site has not verifiably recovered, and I am not claiming it has.
The lesson carries straight over to this update. If your drop date sits inside the September window, the update is a reasonable suspect. If it does not, the update is a distraction, and the time you spend reading about it is time not spent on the real cause.
What does recovery from a spam update look like?
Slower than recovery from almost anything else, and Google says so. Its page on spam updates gives the only timing it publishes: "Making changes may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies." Note the two hedges, "may help" and "over a period of months". Google does not promise recovery and does not promise a date.
Google's page on debugging traffic drops adds the practical version: "some changes can take effect in a few days, while others could take several months." It also suggests waiting "a few weeks to analyze your site in Search Console again" after making changes. That is the right cadence. Checking daily during a rollout tells you nothing but how nervous you are.
Link spam is the exception, and it is the harshest paragraph on the page. When Google's systems discount spammy links, "any ranking benefit the links may have previously generated for your site is lost. Any potential ranking benefits generated by those links cannot be regained." If your rankings were held up by bought or swapped links, cleaning them up does not restore the old positions. It removes a liability. The positions have to be earned again with pages and links that would have existed anyway.
Anyone who tells you a spam demotion reverses in a set number of days is quoting a figure Google has never published. Plan for months, and treat a quicker return as a bonus.
What should you not do while the rollout runs?
Several common reactions either make things worse or destroy the evidence you need to diagnose the drop. These are the moves I would hold back on until Google posts the completion note.
- Do not rewrite the site mid-rollout. Google's own advice on small drops is to avoid "making radical changes if your page is already performing well." Positions move during a rollout and some come back. Rewriting on day three makes it impossible to tell what caused what.
- Do not mass-disavow links out of panic. If the links were spam, Google has already stopped counting them. If they were not, you are throwing away real ones.
- Do not move content to a new domain or subdomain. That is the exact behaviour the policy circumvention section describes.
- Do not file a reconsideration request without a manual action. There is nothing for it to reconsider.
- Do not diagnose from a third-party traffic estimate. Rank trackers and SEO tools model your traffic; Search Console reports it. Use Search Console's own data and URL Inspection when you want to know what Google saw.
- Do not delete pages because a rumour named their type. Delete or consolidate because a page fails the question in the policy table above, not because a forum thread said this update is about listicles.
What you can do this week is write things down. Export the Performance report now, while the pre-update baseline is still inside the three-month view. Note the date you first saw movement. List every change you made to the site in September. When the rollout finishes, you will have what you need to tell a spam demotion from everything else.
The short version
Google released the September 2026 spam update on 24 September 2026 at 9:15 a.m. PDT, globally and in all languages, with a rollout that "may take up to two weeks." That window is the one unusual fact: the three spam updates earlier in 2026 were each announced as "a few days" and each finished in under three. It is also the first spam update since Google extended its spam definition to manipulating generative AI responses in May and rewrote its site reputation section in August. Google has not said what the update targets.
The decision rule is short. If your drop began before 24 September, look elsewhere. If it began inside the window, check the Manual Actions report, wait for the completion note, then read your site against the five policies above. Change what fails the question, not what a rumour named, and expect months rather than days.
Frequently asked questions
When was the Google spam update in September 2026?
Google released the September 2026 spam update on 24 September 2026 at 9:15 a.m. PDT, which is 16:15 UTC. The Google Search Status Dashboard says it "applies globally and to all languages" and that the rollout "may take up to two weeks to complete." On 29 September 2026 the rollout was still running, with no completion note posted.
How long does the September 2026 spam update take to roll out?
Google says up to two weeks, which would end around 8 October 2026. That is a ceiling, not a forecast. Earlier spam updates often finished before their stated window: March 2026 was announced as "a few days" and completed in 19 hours and 30 minutes. Watch the status dashboard for the completion note before judging results.
What does the September 2026 spam update target?
Google has not said. The announcement names no practice, policy or type of site, and Google publishes no list of what any 2026 spam update targeted. It is the first spam update since Google added manipulating generative AI responses to its spam definition in May 2026 and rewrote its site reputation section in August 2026, but Google has not linked the update to either change.
How many Google spam updates have there been in 2026?
Four, according to the Google Search Status Dashboard: March 2026 (24 March), June 2026 (24 June), August 2026 (18 August) and September 2026 (24 September). The first three were announced as taking "a few days" and each completed in under three days. September is the first of the year announced with a two-week window.
How do I know if the spam update affected my site?
Compare the date your traffic dropped with the rollout window. In Search Console's Performance report, view clicks and position by day over the last three months. If the decline started before 24 September 2026, this update did not cause it. If it started inside the window, check the Manual Actions report, then review your site against Google's spam policies after the rollout finishes.
What is the difference between a spam update and a manual action?
A spam update is an improvement to Google's automated spam detection, and it leaves no notice in Search Console. A manual action is a decision by a human reviewer at Google, listed in the Manual Actions report. You can file a reconsideration request after fixing a manual action. There is no request process for an automated demotion; the site has to change and the systems have to notice.
How long does it take to recover from a Google spam update?
Google publishes no fixed time. Its page on spam updates says changes "may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies." Plan in months. For link spam, Google says the ranking benefit those links gave "cannot be regained", so cleanup removes the risk but does not restore old positions.
Can I submit a reconsideration request after a spam update?
Only if Search Console shows a manual action. Reconsideration requests exist for manual actions, and Google says most reviews "can take several days or weeks", with link-related requests sometimes taking longer. If the Manual Actions report is empty, there is nothing to reconsider, and a request will not speed up an automated re-evaluation.
Does the spam update target AI-generated content?
Not as such. Google's scaled content abuse policy covers pages "generated for the primary purpose of manipulating search rankings and not helping users", and adds "no matter how it's created." AI-written pages that help readers are not the target; hand-written pages mass-produced with no added value are. Google has not said this update focuses on AI content.
Should I change my website during the spam update rollout?
Hold major changes until Google posts the completion note. Positions move during a rollout and some recover on their own, and Google advises "avoiding making radical changes if your page is already performing well." Use the time to export Search Console data, note when movement began and list recent site changes, so you can diagnose properly once the rollout ends.
Transparency: the announcement, the rollout history and every quotation in this article were read from the Google Search Status Dashboard, Google Search Central documentation and Search Console Help on 29 September 2026. The two policy-page changes were dated by comparing Wayback Machine captures of Google's spam policies page with that page's own "Last updated" stamps. Where Google publishes nothing, including what this update targets and how long recovery takes, this article says so rather than substituting an estimate. The bestdogcarseat.com case is a site owned by Ashikur Rahman and is reported as unrecovered because it is. I sell search diagnosis and recovery work myself, which is a commercial interest you should weigh. There are no affiliate or tracking links on this page.
