Google’s September 2026 spam update started on September 24 and finished on October 8, 2026, according to Google’s own Search Status Dashboard. It applies globally and to all languages, and Google has not said what kind of spam it targeted. If your traffic dropped in that window, check Search Console first, then compare your site against Google’s spam policies before you change anything.
Most small business sites playing it straight won’t see much change from a spam update. If you’ve bought links, mass-produced pages, or let someone else publish on your domain, this is the time to look closely.
What Google actually confirmed
Here’s everything Google has said officially, and it isn’t much.
The Search Status Dashboard incident for the September 2026 spam update has two entries:
- September 24, 2026, 9:15 a.m. PDT: Google released the update, said it applies globally and to all languages, and said the rollout may take up to two weeks.
- October 8, 2026, 1:37 a.m. PDT: Google posted that the rollout was complete as of October 8, 2026.
That works out to about 13 days and 16 hours, which is close to the full two weeks Google warned about. That’s notable because the earlier 2026 spam updates (March, June and August) each finished in under three days, according to the dashboard’s ranking history.
What Google did not say:
- It did not name a target. There is no official statement that this update was about AI content, links, site reputation abuse or anything else.
- It did not say why this rollout ran so much longer than the earlier ones this year.
- It did not publish new spam policies alongside it.
The one related change worth knowing: Google’s spam policies page was last updated on August 28, 2026. That update changed how site reputation abuse manual actions are handled for searchers in the European Economic Area. Outside the EEA, including Canada and the US, the policy is unchanged. Google has not linked that change to this spam update.
What is speculation (and should be treated that way)
The SEO industry fills every gap Google leaves, so you’ll read plenty of confident theories. Keep them in their lane.
- “It targeted AI content.” Some commentators think heavy AI content abuse is a likely focus. Plausible, since scaled content abuse is a live policy, but unconfirmed.
- “It was about parasite SEO.” The timing near the August site reputation change makes this tempting. Google hasn’t connected them.
- “Everyone lost traffic.” Search Engine Journal’s completion report notes that some rank-tracking tools showed sudden swings during the rollout that real searchers didn’t see. A rank tracker drop alone is not proof you were hit.
Our rule of thumb: act on Google’s own statements and your own Search Console data. Everything else is a hypothesis.
Spam updates are not core updates
These get lumped together, but they’re different animals.
| Spam update | Core update | |
|---|---|---|
| What changes | Google improves its automated spam detection (including its AI-based system, SpamBrain) | Google reworks how it assesses overall content quality and relevance |
| Who usually moves | Sites breaking a specific spam policy | Broad shifts across many sites, often with nothing “wrong” |
| What to do if hit | Find and fix the policy violation | Improve overall usefulness of content and site |
| Recovery | Google says it can take “a period of months” after you comply | Often seen at the next core update |
Google’s spam updates documentation is blunt about one thing: if you were benefiting from spammy links and Google neutralizes them, the ranking boost those links gave you is gone. Cleaning them up stops further damage. It doesn’t bring the old boost back.
If you want the core update side of the story, we covered the March 2026 core and spam updates in Google’s March 2026 algorithm update.
How to tell if your site was hit
Don’t guess. Five minutes in Search Console will tell you most of what you need.
1. Check the Performance report around the dates
In Search Console, open Performance, then Search results. Set a custom date comparison: roughly September 10 to 23 against September 24 to October 8. Then look at the Pages and Queries tabs.
What you’re looking for:
- A sustained drop in clicks and impressions that starts during the rollout window, not a one-day blip.
- Whether the drop is site-wide or limited to a set of pages (for example, all your city pages, or a blog section a third party writes).
- Whether a specific query group fell off while everything else held steady.
A drop concentrated in one type of page usually points straight at the problem. If you’re new to the newer reporting views, our guide to Search Console’s AI performance reports walks through the interface.
2. Check the Manual actions report
Spam updates are automated, but it’s worth ruling out a human penalty at the same time. In Search Console, go to Security and manual actions, then Manual actions. Google’s Manual actions report help page explains it: a green check mark means no manual action. Anything else lists the issue and the affected pages.
3. Rule out the boring causes
Before blaming Google, confirm it’s not something on your end: a site migration, a broken redirect, a noindex tag left on after a redesign, a seasonal dip, or a tracking change. Plenty of “algorithm hits” turn out to be a plugin update.
Common spam policy risks for small businesses
Most small business owners never set out to spam Google. They hired someone, bought a package, or said yes to a “partnership” without knowing the rules. These are the ones we see come up most, all drawn from Google’s spam policies.
Bought links and link schemes. Paying for links that pass ranking credit is link spam. That includes cheap backlink packages, guest posts on networks that exist only to sell links, and link swaps at scale. Paid links are fine if they’re marked rel="sponsored" or rel="nofollow". If you bought a “500 backlinks” gig at some point, this is the first place to look. Our guide on how to get backlinks the right way covers what still works.
Scaled low-value pages (often AI-written). Google’s scaled content abuse policy covers generating many pages mainly to manipulate rankings, with little value to users, regardless of how they’re made. The tool isn’t the problem. Fifty thin, near-identical articles are. We dig into where the line sits in AI-generated content and SEO in 2026.
Doorway city pages. Google names city or region pages that funnel visitors to one destination as a doorway example. A real page for each town you genuinely serve, with local work and details, is fine. Forty templated pages with the town name swapped are not.
Third-party content on your domain (site reputation abuse). If you let someone publish coupon pages, casino reviews or unrelated affiliate content on your site because your domain “has authority,” that’s the pattern this policy targets.
Expired domain abuse. Buying an old domain and filling it with low-value content to ride its history is its own policy violation. Using a lapsed domain for a genuine new business is not the same thing.
Hacked content. This is the one that catches honest owners. Injected pages, hidden links or sneaky redirects on an out-of-date WordPress install can get you hit even though you did nothing on purpose. Search your site with site:yourdomain.ca and look for pages you didn’t make.
Recovery checklist
If Search Console shows a real, sustained drop that lines up with the rollout, work through this in order.
- Confirm the timing. Drop starts between September 24 and October 8, lasts more than a few days, and shows in clicks and impressions.
- Check Manual actions. If there’s an action listed, that’s your priority. Fix every affected page, then request review.
- Read the spam policies against your site. Go through each one honestly. Note anything that’s even close.
- Audit your backlinks. Identify paid or obviously manufactured links. Remove what you can and mark any legitimate paid placements as sponsored.
- Prune or rewrite thin pages. Merge, improve or remove mass-produced pages that don’t help a real visitor.
- Fix or cut doorway city pages. Keep the towns you genuinely serve and make those pages earn their place.
- Remove third-party content that doesn’t belong. End any “publish on our domain” arrangements that aren’t editorially yours.
- Scan for hacked content. Update your CMS, plugins and passwords. Clean up injected pages and redirects.
- Document everything. If you ever need a reconsideration request, Google wants the specific problem, what you did, and the result.
- Be patient. Google says automated systems may take months to recognize that a site now complies. Don’t keep tearing things up week to week.
What not to do: don’t panic-delete large parts of a healthy site, don’t buy a “penalty recovery” link package (that’s more of the same problem), and don’t trust anyone who promises recovery by a specific date.
What we’d do
If your numbers held steady through October 8, you’re fine. Keep publishing genuinely useful pages and stay away from shortcuts.
If they didn’t, start with the Search Console checks above, then get a second set of eyes on your links, pages and site health. Our free website audit flags the technical and content issues that tend to sit behind spam problems, and our SEO services team at TheBomb® can take you through a clean-up and a long-term plan that doesn’t rely on anything Google is trying to catch.
FAQ
When did the Google September 2026 spam update start and end?
Google’s Search Status Dashboard shows it started on September 24, 2026 and completed on October 8, 2026. That’s a rollout of about 13 days and 16 hours, much longer than the earlier 2026 spam updates.
What did the September 2026 spam update target?
Google didn’t say. It described the update as global and in all languages, nothing more. Theories about AI content or parasite SEO are industry speculation, not confirmed by Google.
How do I know if my site was hit by the spam update?
Compare Search Console Performance data for the two weeks before September 24 against September 24 to October 8, by page and by query. Look for a sustained drop, not a one-day dip, and check the Manual actions report to rule out a human penalty.
How long does Google spam update recovery take?
Google says it can take a period of months for its automated systems to learn that a site now complies with its spam policies. If the drop came from links Google has neutralized, the old boost from those links won’t come back.
Is a spam update the same as a core update?
No. A spam update improves Google’s spam detection and mainly affects sites breaking a specific policy. A core update changes how Google assesses overall quality, and sites can move without having done anything wrong.
