Shahid Ali.WhatsApp

field note

Google September 2026 spam update: what changed and what to do

Google updates

Shahid Aliall posts

Google September 2026 spam update: what changed and what to do

Last updated: 25 September 2026. The rollout is still running. I will add the completion date here when Google’s dashboard posts it.

On 24 September 2026 at 09:15 Pacific time, Google logged a new entry on its Search Status Dashboard: the September 2026 spam update. Google’s note says it applies globally and to all languages, and that the rollout “may take up to two weeks to complete”.

That is the whole official announcement. There is no blog post and no new policy with it. So this note sticks to what Google actually wrote, marks clearly where a fact comes from the trade press instead, and then gets practical: how to tell whether your site was touched, and what to leave alone until the rollout ends.

What happened, in dates

This is the fourth spam update of 2026. The last one, the August 2026 spam update, finished only 34 days before this one started, and I covered it in detail there. The gaps between spam updates this year keep getting shorter: 92 days from March to June, 55 from June to August, and 37 from the start of August’s to the start of this one.

Update Started (Pacific) Rollout time Status
March 2026 spam update 24 March 19 hours, 30 minutes Complete
June 2026 spam update 24 June 2 days, 1 hour Complete
August 2026 spam update 18 August, 09:27 2 days, 16 hours Complete 21 August
September 2026 spam update 24 September, 09:15 Up to two weeks, per Google Rolling out as of 25 September

All four rows come from Google’s ranking incident history. In other time zones, the start was 12:15 in New York, 16:15 UTC and 21:15 in Pakistan on 24 September.

The one thing that stands out is the length. The three earlier spam updates this year each finished inside three days. This one comes with a two-week estimate. Two weeks from the start lands on 8 October, but that is Google’s upper estimate, not a finish date. The August 2025 spam update took more than 26 days, so I treat any estimate as a guess until the dashboard says complete. I timed the last ten rollouts in how long Google updates take to roll out if you want the wider pattern.

What a spam update actually targets

Google runs automated spam detection all the time. A spam update is Google’s name for a notable improvement to those systems. Its spam updates page says sites that see a change afterwards should check themselves against the spam policies, and that sites breaking those policies may rank lower or drop out of results completely.

Google did not say which policies this update focuses on. Search Engine Roundtable reported that it covers some of the spam policies, not all of them, and does not target link spam. That comes from a trade publication, not a Google page, so read it as likely rather than confirmed.

In plain words, these are the policies I see most often on real sites, and the ones worth reading against your own:

  • Scaled content abuse. Lots of pages made mainly to rank, not to help anyone. Google’s policy says this applies “no matter how it’s created”, so using AI is not the offence. Hundreds of thin pages that say nothing new is the offence, whether a person, a template or a model wrote them.
  • Doorway abuse. Many near-identical pages, often one per town or keyword, that all funnel to the same place. If only the place name changes from page to page, that is the pattern. I explain what makes a local page worth indexing in location pages that index.
  • Expired domain abuse. Buying an old domain for its history and filling it with unrelated content.
  • Hidden text, cloaking and sneaky redirects. Showing Google something different from what visitors see.
  • Hacked content and user-generated spam. Spam you did not put there yourself, like injected pages or junk in comments and forums. A spam update does not care who posted it.

One wider change is worth knowing. Since May 2026, Google’s definition of spam also covers trying to manipulate the AI answers in Google Search. So AI Overviews and AI Mode play by the same rules as the normal results. If you want to check whether AI search can reach and read your site at all, my AI visibility checker scores that. It does not detect spam problems, and no outside tool can tell you how Google’s spam systems see your site.

How to tell if you were hit

The short answer: you cannot tell yet, and anyone who says they can after one day is guessing. Rankings move, settle and move again during a rollout. A page that drops on Friday and comes back on Tuesday was re-checked twice, not hit. So the real work this week is getting ready to measure properly once it ends.

Here is what I do on the sites I look after, and what I would do on yours:

  1. Write the date down. 24 September 2026. Search Console has no notes feature, so put it in a spreadsheet next to the property.
  2. Wait for the word complete on the dashboard. Not a forum post, not a tweet. The incident page will get a closing line when it is done.
  3. Compare two clean weeks in the Performance report. The before window is 17 to 23 September, the seven full days ending the day before the start. The after window is the seven full days starting the day after the completion date. Use Compare in the date picker, and look at impressions before clicks. Impressions tell you whether Google is still showing the page at all.
  4. Look at pages, not the site total. Click the Pages tab in the same report and sort by the difference. Spam updates rarely take a flat slice off a whole site. They tend to hit one kind of page. If most of a drop sits in one folder or one template, that folder is your answer.
  5. Check indexing as well as ranking. Spam systems can remove pages from the index, not just push them down. Watch the Pages report under Indexing. A group of URLs moving from indexed to “Crawled - currently not indexed” in the same week is a stronger sign than any position change. My bulk index checker reads the real index status of a list of URLs from your own Search Console property in one run, so take a snapshot of your key folders now and again after the rollout. If a page did fall out, run it through the indexability checker before blaming the update: a stray noindex or a wrong canonical does the same damage and is a five-minute fix. My guide to indexed pages that dropped out of Google walks through the other causes.
  6. Open the Manual actions report once. A spam update is automatic, so you should see nothing there. If you do see a manual action, that is a separate problem with a separate fix: a human reviewer at Google flagged the site, and you fix it and file a reconsideration request.

One more thing to rule out. If your traffic started moving a few days before 24 September, that is probably not this update. Search Engine Roundtable reported that the volatility seen before the announcement was something else, and in August John Mueller said Google does not roll spam updates out before announcing them. Keep your before window ending on 23 September, whatever your charts did earlier.

What to do, and what not to do

Do not make big changes during the rollout. This is where site owners lose the most, and it has nothing to do with spam. If you rewrite, delete or redirect pages mid-rollout, you can no longer tell what the update did and what you did. My full routine for an update week is in what to do during a Google update. Most of it is not touching things.

Do not disavow links in a panic. Google has not said this update is about links, and the trade press reports it is not. Disavowing on a guess can remove links that were helping you.

Do not pay anyone who promises a fast recovery. Google’s own page says a site may improve only if its systems learn “over a period of months” that the site follows the policies. That is months, not days, and Google says it also runs periodic refreshes. Nobody can speed that up.

Do run an honest check once the rollout is complete. If one group of pages lost its traffic, ask whether a visitor would miss those pages if they disappeared. If the answer is no, remove them properly. That means a 410 or a noindex, or a 301 redirect to the one page that genuinely replaces them. Never send hundreds of redirects to the homepage. If the pages are worth keeping, add what they were missing: first-hand information, real numbers, a clear answer. Not just more words.

Do check for spam you did not create. Hacked pages and spam comments count against you too. Look at your site’s indexed URLs for pages you do not recognise. One way is to list what you meant to publish with my sitemap checker, then compare it with the indexed pages in Search Console’s Pages report. If Google has indexed URLs that are not in your sitemap and you did not make them, look closer.

If your link-based rankings drop after a link spam update, know that Google’s page says those gains are gone for good. Removing the links will not bring them back. Google has not said this is a link spam update, so this is only a caution if that changes.

Common questions

When did the September 2026 spam update start?

On 24 September 2026 at 09:15 Pacific time, according to Google’s Search Status Dashboard. Google says it applies globally and to all languages.

How long will it take to roll out?

Google says up to two weeks. That puts the latest expected finish around 8 October 2026, but only the dashboard’s closing line makes it official. I will add the real date to this page when it appears.

Is this update about AI content?

Not in anything Google has written. The spam policies judge pages by whether they were made at scale to rank without helping people, whoever or whatever wrote them. Using AI to write good, useful pages is not a policy breach.

Will I get a message in Search Console if I was hit?

No. Spam updates are automatic. The Manual actions report only shows actions a person at Google took, and those are separate from this update.

How long does recovery take?

Google says it can take months after you fix the problem, because its systems have to learn over time that the site now follows the policies. There is no request you can file to speed that up.

My traffic dropped. Should I change things now?

Not yet. Wait until the rollout is complete, then compare a clean week before 24 September with a clean week after the completion date. Changes made mid-rollout make it impossible to tell what caused what.

What I am doing on client sites

Very little, on purpose. The date is written down on every property I look after, and the index snapshots are taken. Nothing gets rewritten or deleted until the dashboard says complete and a full clean week has passed after it. Then I compare, page by page.

If your site is built from pages that each have a reason to exist, a spam update is usually a non-event. Most sites see no change at all, and that is the correct result for a site that never did the things the policies describe.

Sources

Message me on WhatsAppRead the guides