Google September 2026 Spam Update: Were You Hit?

Google's September 2026 spam update began on 24 September. If clicks fell after that date, check which pages dropped and which spam policy they break.

Google started rolling out its September 2026 spam update on 24 September at 9:15 a.m. Pacific time, and unlike the usual two-day spam updates, it said this one could take up to two weeks. SEO trackers saw volatility in several waves, the last around 4 to 6 October. If your traffic dropped somewhere in that window, you're probably asking two questions: was it the spam update, and what do I do now? I do technical SEO audits for client sites, and this is the process I follow before anyone changes a single page.

Key takeaways

• Dates matter. The rollout began 24 September 2026. A drop before that date has a different cause.
• Look at pages, not totals. A spam update usually hits a type of page (thin programmatic pages, a third-party section, hacked spam), not the whole site evenly.
• No message doesn't mean no problem. Spam updates are algorithmic. Search Console's Manual actions report only covers penalties a person applied.
• Recovery takes months. Google says its systems learn "over a period of months" that a site now complies. Ranking value from bought links doesn't come back.
• AI isn't the issue; scale without value is. Using AI tools doesn't break Google's rules. Publishing lots of pages mainly to rank does.

What was the September 2026 spam update?

It's the fourth spam update of 2026, after March, June and August. Google described it only as a spam update that "applies globally and to all languages", without naming a target. That's normal: spam updates improve SpamBrain, Google's automated spam detection, across all its spam policies at once.

Two things set this one apart. The rollout window was two weeks instead of the usual couple of days, and it landed in waves, so some sites dropped on 25 September and others only in early October. And there was no core update running at the same time (the last one started in May), which makes diagnosis cleaner than usual.

The official place to check whether it has finished is the Google Search Status Dashboard.

How to tell if the spam update hit your site

1. Line up the dates in Search Console

Open Performance, then Search results. Set the date to compare the 28 days before 24 September with the period since. Look at clicks and impressions, not average position; position averages hide what's actually happening.

2. Break the drop down by page

Switch to the Pages tab with the comparison still on, and sort by the difference in clicks. Group what you see. Is it one folder (/locations/, /tags/, /coupons/)? One template? Pages a partner publishes on your domain? A spam hit almost always has a pattern. A drop spread evenly across every page points somewhere else.

3. Rule out the boring causes first

Before you blame Google, spend ten minutes on these. I've seen each one mistaken for a penalty:

• A deploy that added noindex, broke canonicals or changed URLs without redirects.
• The site being slow or down when Googlebot visited (check Settings, then Crawl stats).
• Analytics or consent banner changes that cut tracked visits, while Search Console clicks stayed flat.
• Seasonality: compare with the same weeks last year.

If pages show up as "Crawled, currently not indexed", that's a different problem with a different fix, which I covered in this indexing guide.

4. Check Manual actions and Security issues

Both are in the Search Console menu. A manual action is a human penalty with a reconsideration request process. A security issue means Google found hacked content or malware. Neither is what the spam update does, but if either shows anything, deal with it first.

Which spam policies usually cause a drop?

Google's spam policies list more than a dozen behaviours. On real business sites, these are the ones I actually find:

• Scaled content abuse. Many pages made mainly to rank rather than to help: a page per city with only the city name swapped, thousands of auto-generated "best X in Y" pages, rewritten copies of other sites. Whether a person or a tool produced them doesn't matter; the scale and the lack of value do.
• Site reputation abuse. Third-party content hosted on your domain to borrow its rankings, like a coupon or casino section run by a partner that has nothing to do with your business.
• Expired domain abuse. Buying an old domain with good history and filling it with unrelated content.
• Link spam. Paid links, link exchanges, mass guest posts with keyword anchors. Google is clear that ranking value gained from these doesn't come back after you remove them.
• Hacked content. Not your fault, but still your problem. Attackers inject thousands of spam pages (pharma or "Japanese keyword" hacks are common) into vulnerable sites. Search for site:yourdomain.com plus words like "viagra" or "casino". If you find any, my hacked server guide covers cleanup.

How to recover from a spam update

1. Remove or fix the pages that break the policy. For thin programmatic pages, either merge them into a few genuinely useful pages and 301 the rest, or delete them (a 404 or 410 is fine). Don't just add noindex and wait; removing the problem is cleaner.
2. Improve what's left. Pages should show first-hand experience: real photos, real prices, real steps you've done, a named author. That's what separates helpful content from the scaled kind.
3. Clean up links you control. Stop buying links. You don't need to disavow random spam pointing at you; Google ignores most of it.
4. Be patient. There's no "recovered" button. Google says improvements can help as its systems learn over a period of months. Sites often see movement at the next spam or core update.

Whatever you do, don't panic-delete good content or rewrite every page in a week. That causes more damage than the update.

How I write content that doesn't get hit

People ask me whether using AI to write will get them penalised. Google's own guidance answers it: using AI tools isn't against its rules; using automation to mass-produce pages mainly to manipulate rankings is. In practice I follow a few rules on this blog and on client sites. Every post answers one real question. Every version number, date and price is checked against the official source before it goes live. Each post includes something only someone who has done the work would know. And I publish fewer, better pages instead of many thin ones. If you want to be quoted by AI answers too, the same rules apply; I wrote about that in getting cited by ChatGPT and AI Overviews.

Frequently asked questions

When did the Google September 2026 spam update finish?

Google said the rollout could take up to two weeks from 24 September 2026. Trackers saw the last big wave around 4 to 6 October. Google marks the update as complete on its Search Status Dashboard; check there for the official end date.

Will Google tell me if my site was hit?

No. Spam updates are algorithmic, so there's no message. You only get a notice in Search Console for a manual action or a security issue.

How long does it take to recover from a spam update?

Usually months, not weeks. Google says its systems need time to learn that a site now complies with its policies. Fix the problems properly once, then keep publishing useful pages.

Does AI-generated content get penalised by Google?

Not because it's AI-generated. Google targets scaled content abuse: many pages made mainly to rank, by any method. AI content that's checked, accurate and genuinely useful is treated like any other content.

Should I use the disavow tool after a spam update?

Only if you bought links or took part in link schemes and can't get them removed. For random spammy links you didn't ask for, Google already ignores most of them, and disavowing good links by mistake can hurt.

Need a second pair of eyes?

I run technical SEO audits that separate real penalties from tracking bugs and broken deploys, then fix what's actually wrong. See my website design and SEO services, the technical SEO audit package, or send me your Search Console screenshot and I'll tell you what I see.