Google began rolling out the September 2026 spam update on 24 September, and it can take up to two weeks to finish. It applies worldwide, in every language, and Google has not said what it targets. If your traffic has dipped since the 24th, do not panic and do not start rewriting pages yet. First work out whether this update is actually the cause, because a longer rollout means the picture will keep shifting for days.
What we know so far
Here are the confirmed facts, straight from Google's Search Status Dashboard and the reporting around it. Everything else you read this week is informed guessing.
| Detail | What is confirmed |
|---|---|
| Start | 24 September 2026, 9:15 a.m. Pacific time |
| Rollout window | Up to two weeks. It could finish sooner. |
| Reach | Global, all languages |
| Place in the year | The fourth spam update of 2026, after March, June, and August |
| Stated target | None. Google has not said what this update focuses on. |
| Status at time of writing | Still rolling out |
Why this one is different
Two things set this update apart from the rest of the year, and both matter for how you read your data.
- The rollout window is far longer. Google gave the March, June, and August spam updates a window of a few days, and none took longer than two days and sixteen hours. March finished in under a day. A window of up to two weeks means changes can arrive gradually, so the first few days of data may not show the full effect.
- The pace is unusual. Four spam updates in seven months makes 2026 one of the busiest years for spam enforcement in a long time. With updates this close together, it is getting genuinely harder to tell which one caused which ranking change.
Spam update or core update? They are not the same
This distinction clears up most of the confusion. A core update changes how Google judges quality across the whole web, so good sites can move up or down as relative standards shift. A spam update is narrower. It improves the automated systems that catch practices already against Google's spam policies.
The practical difference is this: a core update can move an honest site, while a spam update is designed to hit sites doing something the rules already forbid. If you run a genuine business site with original content and clean links, a spam update is far less likely to be your problem than normal volatility, a technical fault, or one of the usual reasons traffic drops.
How to tell whether you were actually hit
Most drops people blame on an update turn out to be something else. Work through these checks in order before you change anything.
- Match the dates. Open Search Console and look at clicks and impressions from 24 September onward. A real hit lines up with the rollout. A decline that started earlier has a different cause.
- Check the whole site, not one page. Spam demotions tend to hit broadly, across many pages or a whole section. One page slipping a few places is usually ordinary movement.
- Rule out tracking faults. Analytics outages and reporting glitches happen, and they look exactly like a traffic collapse. Confirm the drop appears in Search Console as well as in your analytics.
- Rule out indexing problems. If pages have fallen out of the index, that is a technical issue, not a penalty. Our guide on why Google does not index your content covers the common causes.
- Wait for the rollout to finish. Judge the damage only once Google marks the update complete. Mid-rollout numbers are a moving target.
One detail catches people out. Spam systems demote pages automatically. There is no manual action and no warning in Search Console, so the absence of a notice does not mean you were spared, and a drop does not mean a human reviewed your site.
What spam updates go after
Google has not named a target this time, but its spam policies have not changed, and those policies define what any spam update enforces. The practices most likely to get caught include:
- Scaled low-value content. Large volumes of pages produced mainly to rank rather than to help anyone, whether written by people, by AI, or by both. The method is not the issue. The low value is. We covered this in whether AI content hurts SEO.
- Manipulating AI answers. Google has confirmed that trying to game its AI features, including AI Overviews and AI Mode, falls under its existing spam policies. Content engineered purely to be scraped into AI answers is in scope.
- Link schemes. Bought links, link exchanges, and private networks built to inflate authority.
- Borrowed authority. Publishing unrelated third-party content on a trusted domain to ride its reputation, and buying expired domains to repurpose their history.
- Old manipulation tricks. Hidden text, keyword stuffing, cloaking, and doorway pages. Many of these belong on our list of SEO tactics that aged like milk.
If you were hit: what to do
Recovery from a spam update is about removing the cause, not about waiting it out or chasing tricks.
- Let the rollout finish before making sweeping changes, so you are diagnosing the final picture.
- Audit honestly against the spam policies. Look for thin pages produced at scale, suspicious links, and anything that exists mainly to manipulate rankings.
- Remove or fix the problem, do not hide it. Improve or delete low-value pages, and disavow or remove manipulative links you control.
- Be patient. Google says it can take months for its systems to recognise that a site now complies. There is no fast lane.
If you were not hit, the best move is the unglamorous one: keep publishing genuinely useful content and keep your technical setup clean. The sites that ride out update after update are the ones that never gave the spam systems anything to catch.
Frequently asked questions
When did the September 2026 spam update start?
Google began rolling it out on 24 September 2026 at 9:15 a.m. Pacific time. It applies globally and in every language.
How long will the September 2026 spam update take?
Google gave it a rollout window of up to two weeks, much longer than the few days given to this year's earlier spam updates. It could finish sooner. Wait for Google to confirm completion before judging the full impact.
Will Google tell me if my site was hit?
No. Spam updates demote pages automatically through Google's systems, with no manual action and no notice in Search Console. The only evidence is in your own data, which is why matching dates in Search Console matters.
Does the September 2026 spam update target AI content?
Google has not said so. It has confirmed that manipulating its AI features falls under existing spam policies, and sites relying on large volumes of low-value automated content carry more risk. Useful content written with AI assistance is not the target. Low value at scale is.
How long does it take to recover from a spam update?
Months, in most cases. After you fix the violations, Google says its systems can take months to recognise that the site now complies. Recovery depends on how severe and widespread the issue was.
The bottom line
The September 2026 spam update is live, long, and unannounced in its target. For most honest business sites, it is not the reason traffic moved this week. Match your dates, rule out the ordinary causes, wait for the rollout to finish, and only then act. If you were genuinely hit, the fix is removing what the spam systems caught, followed by patience.
Not sure whether a drop is this update or something else entirely? Our free SEO and AEO audit shows exactly what is holding your site back, from technical faults to thin pages, so you can fix the real cause instead of guessing at an algorithm.
