Google September 2026 Spam Update: Quick Guide

TL;DR

• When: The update began on September 24, 2026, at 9:15 AM Pacific.
• Where: It applies globally and to all languages.
• What it targets: Sites that break Google’s spam policies. Google hasn’t said which specific policy or tactic it’s aimed at.
• Why it’s unusual: It’s the fourth spam update of 2026, and the first this year with a two-week window. The earlier three each finished within about three days.
• Impact: Google declined to say what percentage of queries are affected. No industries have been named.
• Named sites: None confirmed. Any list of “sites hit” published this week is guesswork.
• What to do: Don’t make big changes mid-rollout. Wait for it to finish, check Search Console for manual actions, then review your site against Google’s spam policies.

What Is the September 2026 Spam Update?

Google announced it on its Search Status Dashboard with a short note: the update applies globally and to all languages, and the rollout may take up to two weeks to complete.

Google Search Central’s LinkedIn post added only a little more. It described the release as a normal spam update covering all languages and locations. On X, Google said it would update its ranking release history page once the rollout finishes.

That’s the entire official record. Google hasn’t said which spam policy or tactic this update targets. Anything more specific you read this week, including some of what’s below, is informed analysis rather than a Google statement.

Spam updates vs. core updates

People often mix these up, and it matters for diagnosing a drop.

	Spam update	Core update
Purpose	Improves Google’s automated systems that detect content and practices that break its spam policies	Changes how Google assesses site quality in general
Who gets hit	Sites using tactics that break spam policies, plus some collateral damage	Any site, including ones doing nothing wrong
Main system involved	SpamBrain, Google’s AI-based spam-prevention system	Google’s broader ranking systems
Recovery	Fix the violations, then wait months for systems to reassess	Improve overall content quality, usually seen at the next core update

Timeline: When Did It Happen?

The spam update started on September 24. According to Search Engine Roundtable, the tracker volatility many SEOs noticed just before the announcement was not the update itself. The day after launch, though, volatility did rise noticeably.

Date	Event
Sept 4–13	Unexplained ranking swings picked up by trackers
Sept 15	Another round of unexplained movement
Sept 22–24	Elevated volatility before any announcement
Sept 24, 9:15 AM PT	Google officially starts the September 2026 spam update
Sept 25	Volatility climbs the day after launch
~Oct 8 (estimated)	Latest expected completion, based on Google’s two-week window

So far, John Mueller of Google has made the only comment about timing. Asked whether the two-week estimate was a typo, he confirmed this rollout will probably take longer than some of the earlier ones.

The Fourth Spam Update of 2026

This is Google’s busiest year for spam updates in a long time. According to the release history, which goes back to November 2021, no other calendar year has more than three updates labeled as spam updates.

2026 spam updates compared

Update	Started	Rollout time	Estimated window
March 2026 spam update	March 24	19 hours 30 minutes	“A few days”
June 2026 spam update	June 24	2 days 1 hour	“A few days”
August 2026 spam update	August 18	2 days 16 hours	“A few days”
September 2026 spam update	September 24	Ongoing	Up to 2 weeks

Earlier spam updates for context

Update	Duration
October 2023 spam update	15 days
March 2024 spam update	15 days
June 2024 spam update	7 days
December 2024 spam update	7 days
August 2025 spam update	27 days

A long rollout doesn’t necessarily mean a big impact. The August 2025 update ran for 27 days, yet Sistrix data showed its effects were smaller than normal day-to-day fluctuations.

Are There New Ranking Factors?

No new ranking factors have been announced. Google hasn’t described any new signal, and it hasn’t said the update targets any particular policy. Search Engine Roundtable noted that it’s not a link spam update, and Google didn’t mention any policy changes alongside it.

That said, Google’s spam policy page itself has changed in ways worth knowing about, even though Google hasn’t tied them to this update:

1. Manipulating AI answers now counts as spam. Google’s definition of spam now explicitly includes attempts to manipulate generative AI responses in Search, not just attempts to rank content higher. Put simply, trying to game AI Overviews or AI Mode falls under the same rules as trying to game regular rankings.

2. Back button hijacking is named as a malicious practice. The policy lists back button hijacking, where a site manipulates browser history so visitors can’t use the back button to return to where they came from, under malicious practices.

3. The site reputation abuse policy changed in the EEA. In August 2026, Google changed how the site reputation policy applies in the European Economic Area. In the EEA, third-party sections of a site found out of line with the policy may be treated as separate from the main domain and ranked on their own merits, rather than receiving a manual action. Outside the EEA, those pages can still get a manual action.

The spam policy page was last updated on August 28, 2026, about a month before this rollout.

How Many Queries Were Affected?

We don’t know, and Google isn’t saying. Google declined to tell Search Engine Roundtable what percentage of queries or searches the update affects.

Third-party data this week is also less reliable than usual. On September 16, Sistrix’s status page confirmed its data collection had slowed. Separately, Nozzle’s Derek Perkins said the volume of Google results he could retrieve had dropped by about 80%. Glenn Gabe compared one recovering site across tools: Ahrefs showed the recovery, Semrush showed it late, and Sistrix hadn’t picked it up yet.

Semrush also recalculated its baseline volatility formula on September 18, which may have shifted its Sensor scores. That makes comparisons with earlier weeks harder.

The practical point: volatility trackers measure movement across each vendor’s own keyword set. They don’t show how far the update actually reaches. Your own Search Console data is a far better guide than any public chart.

Which Industries Are Affected?

Google hasn’t named any industries. The update is described as general, covering all languages and locations.

Based on Google’s spam policy examples and the patterns of past spam updates, these are the site types that tend to be most exposed. This is analysis, not something Google has confirmed for this update.

Site type	Why it’s at risk	Relevant policy
Mass-produced AI content sites	Many pages created mainly to rank, adding little value	Scaled content abuse
Thin affiliate sites	Product descriptions copied from merchants with nothing original added	Thin affiliation
Expired domain projects	Old domains repurposed for unrelated content	Expired domain abuse
Parasite SEO pages on big sites	Third-party content riding on a host site’s authority	Site reputation abuse
Local service doorway networks	Near-identical city pages that funnel to one destination	Doorway abuse
Scraper and aggregator sites	Republished content with no original value	Scraping
Casino, CBD, payday loan, and similar niches	Frequent targets of parasite placements and link schemes	Several policies
Sites with open forums or comments	Spam posted by users, often without the owner noticing	User-generated spam

Keep in mind that site reputation abuse is handled mainly through human review and manual actions, not by automated spam updates alone.

Which Websites Were Impacted?

No specific websites have been credibly confirmed as hit by this update. As of September 27, the rollout is only three days old, and Google never names affected sites.

Be careful with articles already publishing “winners and losers” lists. At this stage it’s impossible to tell whether a site’s drop comes from:

• the spam update itself
• the volatility that started before the announcement
• normal seasonal changes
• a separate change, such as the Discover traffic drop being reported at the same time

As PPC Land put it, from the outside it’s not possible to separate reports about the spam update from the volatility that came before it or from ordinary seasonal noise.

Also remember that a ranking drop during the rollout doesn’t mean Google has classified your site as spam. Legitimate sites can see fluctuations during spam updates too.

Reliable lists of affected domains usually appear a week or two after a rollout finishes, once tools like Sistrix and Semrush have clean before-and-after data.

Google’s Spam Policies: The Full List

Google spells out exactly which practices violate its rules. If your site was hit, go through this list honestly and check every item.

Policy	What it means	Quick self-check
Cloaking	Showing search engines different content than users see	Does Googlebot see the same page your visitors do?
Doorway abuse	Pages built to rank for similar queries that funnel users elsewhere	Do you have dozens of near-identical city or keyword pages?
Expired domain abuse	Buying old domains to host unrelated, low-value content	Did you repurpose a domain for a completely different topic?
Hacked content	Content injected through security holes	Have you checked for pages you never created?
Hidden text and links	Text or links hidden from visitors but visible to search engines	Any white-on-white text or links set to zero size?
Keyword stuffing	Unnatural repetition, or lists of cities or phone numbers	Does your copy read naturally out loud?
Link spam	Buying, selling, or trading links to manipulate rankings	Are paid links marked nofollow or sponsored?
Machine-generated traffic	Sending automated queries to Google	Are you scraping Google without permission?
Malicious practices	Malware, unwanted software, back button hijacking	Does your site interfere with the back button?
Misleading functionality	Fake tools or generators that don’t work	Do your tools actually do what they promise?
Scaled content abuse	Mass-producing low-value pages by any method	Would a reader get real value from every page?
Scraping	Republishing others’ content without adding value	Is your content original?
Site reputation abuse	Third-party content hosted mainly to borrow a site’s authority	Is outside content edited and integrated like your own?
Sneaky redirects	Sending users somewhere they didn’t expect	Do mobile users land somewhere different from desktop users?
Thin affiliation	Affiliate pages with copied merchant descriptions	Do your reviews include original testing or insight?
User-generated spam	Spam posted by users in forums or comments	Are comments and profiles moderated?

Other things that can get a site demoted

• Policy circumvention: Moving spam to new subdomains, subdirectories, or sites to keep breaking the rules can lead Google to remove eligibility for features like Top Stories and Discover, or to take broader action against the site.
• Scams and fraud: Impersonating real businesses or posting fake customer support numbers.
• Removal-based demotions: A large volume of valid copyright complaints against a site can lead Google to demote other content on that site too.

Is AI-Generated Content Targeted?

Google hasn’t said this update targets AI content specifically. The policy is about purpose and value, not the tool used to create the content.

Google’s own wording makes this clear. Scaled content abuse means generating many pages mainly to manipulate rankings rather than help users, and the policy applies no matter how the content is created. Using generative AI to produce many pages without adding value for users is listed as one example.

So AI-assisted content that’s edited, fact-checked, and genuinely useful is fine. Hundreds of unedited AI pages targeting keyword variations are not.

How to Tell If You Were Hit

Work through these steps in order.

Step 1: Wait for the rollout to finish. On day one, you should be diagnosing, not changing things. Rankings move around during a rollout and often settle.

Step 2: Check the timing. Compare your traffic drop against the September 24 start date in Search Console’s Performance report. If your drop began earlier, from September 4 to 23, it probably wasn’t this update.

Step 3: Check for a manual action. Go to Search Console > Security & Manual Actions > Manual actions. A manual action is a completely separate issue from an algorithmic update and needs a different fix.

Step 4: Rule out other causes. Google’s guide to traffic drops separates algorithm updates from technical problems, spam policy violations, manual actions, and seasonal changes.

Symptom	Likely cause
Drop started September 24–25, spread across the whole site	Possibly the spam update
Drop started before September 24	Earlier volatility or another cause
Message in the Manual actions report	Manual penalty, not the update
Only Discover traffic fell	A Discover change, reported separately this week
Pages returning errors or noindexed	A technical issue
Same drop as the same time last year	Seasonality

Step 5: Look at which pages dropped. If one section fell, such as a coupons folder, a set of city pages, or a batch of AI articles, that section is almost certainly the problem.

Recovery: What to Do If You Were Hit

Google’s guidance is straightforward. Sites that see a change after a spam update should review the spam policies to make sure they comply. Making changes may help, once Google’s automated systems learn over a period of months that the site follows the rules.

There’s an important exception for links. If a link spam update removes the benefit of spammy links, making changes might not help, because any ranking value those links provided is gone for good. It doesn’t come back.

Recovery checklist

1. Identify the affected pages in Search Console by comparing the two weeks before September 24 with the period after.
2. Audit them against the policy table above. Be honest about what you find.
3. Remove or noindex scaled, thin, or copied content. Google itself advises excluding that kind of content from Search if you’re hosting it.
4. Merge doorway pages into fewer, genuinely useful pages.
5. Rework affiliate content with original testing, photos, and opinions.
6. Clean up third-party sections of your site, or noindex anything you don’t editorially control.
7. Scan for hacked content and user-generated spam.
8. Mark paid links with rel=”sponsored” or rel=”nofollow”.
9. Don’t move the problem elsewhere. Shifting spam to a new subdomain counts as policy circumvention.
10. Be patient. Recovery can take months, and Google refreshes spam detection periodically.

How to Stay Safe from Future Spam Updates

Four spam updates in seven months suggests Google is tuning its systems more often. Sites that stay safe tend to follow a few steady habits:

• Write for readers first. If a page exists only because a keyword tool suggested it, ask whether a real person would find it useful.
• Use AI as a tool, not a publisher. Edit, fact-check, and add your own experience to anything AI drafts.
• Keep affiliate content honest. Real testing, real photos, and real opinions.
• Control what’s published under your domain. Every third-party article should be edited and integrated like your own work.
• Moderate user content. Use spam filters on comments and forums, and apply nofollow to user-submitted links.
• Don’t buy links that pass ranking value. Sponsored placements are fine as long as they’re labeled correctly.
• Keep your site secure. Update your CMS and plugins, and check regularly for pages you didn’t create.
• Avoid manipulative UX. No fake tools and no back button tricks.
• Don’t try to game AI Overviews. Google now treats manipulating AI answers as spam.
• Monitor Search Console weekly. Catch problems early instead of after an update hits.

FAQs

When did the September 2026 spam update start?

It began on September 24, 2026, at 9:15 AM Pacific time, according to Google’s Search Status Dashboard.

How long will the rollout take?

Google says up to two weeks, which puts the expected finish around October 8. That doesn’t mean it will necessarily take the full two weeks.

Is this update global?

Yes. It applies globally and to all languages.

What does the September 2026 spam update target?

Sites that violate Google’s spam policies. Google hasn’t said whether it targets any specific policy or tactic.

Does this update target link spam?

Search Engine Roundtable reported that it doesn’t target link spam specifically. Link-based violations are still against Google’s policies, though.

How many queries were affected?

Google declined to say what percentage of queries or searches were affected.

Which websites were hit?

No sites have been credibly confirmed yet. The rollout is still in progress, and early “losers” lists can’t reliably separate this update from the volatility that came before it.

Why is this update taking longer than earlier ones?

Google hasn’t explained why. The earlier three spam updates of 2026 each finished in less than three days, while this one has a two-week window. John Mueller confirmed the longer estimate was intentional, not a typo.

I lost traffic on September 23. Was that the spam update?

Probably not. Search Engine Roundtable noted that the volatility seen before the announcement wasn’t the update itself.

Is this a penalty?

Not in the manual sense. Spam updates are algorithmic. If you have a manual action, it will show up in Search Console’s Manual actions report, which is a separate issue.

How long does recovery take?

It can take months. Google’s systems need time to learn that a site now follows its spam policies.

Can I recover lost link value?

No. If spammy links were helping your rankings and Google’s systems remove their effect, that ranking benefit can’t be regained.

Should I make changes during the rollout?

It’s better to wait. Rankings move around during a rollout, and changes made mid-update make it harder to see what actually happened.

Is AI content being penalized?

Not simply for being AI-generated. The problem is mass-producing pages to manipulate rankings without adding value, however the content is made.

Will there be more spam updates this year?

Google hasn’t announced any. However, Google periodically refreshes its spam systems, and a new core update is also widely expected soon.

Final Thoughts

The September 2026 spam update is still rolling out, and the most honest summary right now is that we don’t yet know much about its impact. Google has confirmed the dates, the global scope, and that it targets spam policy violations. It hasn’t shared which policies, how many queries, or which industries.

If your traffic dropped, don’t panic and don’t start rewriting pages yet. Let the rollout finish, check Search Console, rule out other causes, and then go through the spam policies line by line. If your site is built for readers, a spam update is much more likely to shake things up briefly than to cause lasting damage.