Google finished the September 2026 spam update on 8 October, 13 days and 16 hours after it started, making it the longest of its four spam updates this year. Google called it “a normal spam update” and named no new policy or target. Some sites lost real traffic, and some of the drops site owners panicked over came from broken rank tracker data.
The short answer
The September 2026 spam update enforced Google’s existing spam policies, globally and in every language, from 24 September to 8 October 2026. Google published no new rule, no list of targeted tactics and no share of affected queries. Sites built on scaled content, expired domains or rented reputation had the most to lose. Link profiles, Google’s European site reputation changes and sites that follow the rules sat outside its reach.
What Google confirmed
Google posted the update on its Search Status Dashboard at 09:15 Pacific on 24 September and warned the rollout “may take up to two weeks to complete”. It marked the rollout complete on 8 October. Google’s ranking update history logs the full run at 13 days and 16 hours.
That breaks the pattern of 2026. Google’s three earlier spam updates this year each finished in under three days.
| Update | Started | Rollout time |
| September 2026 spam update | 24 September | 13 days, 16 hours |
| August 2026 spam update | 18 August | 2 days, 16 hours |
| June 2026 spam update | 24 June | 2 days, 1 hour |
| March 2026 spam update | 24 March | 19 hours, 30 minutes |
Two weeks still falls short of the record. The August 2025 spam update took 26 days and 15 hours. For dates, volatility windows and next steps, see this full breakdown of the September 2026 spam update.
What it hit
Google named no targets, so treat its whole spam policy page as the scope. If you lost traffic, audit these four areas first, because they cover the tactics people run at scale:
- Scaled content abuse. Google defines it as “many pages are generated for the primary purpose of manipulating search rankings”. City page spinners, AI article farms and scraped product pages all qualify, whether a person or a tool wrote them.
- Expired domain abuse. Buying an expired domain and repurposing it “primarily to manipulate search rankings”. One of Google’s own examples is casino content placed on a former school website.
- Site reputation abuse. Third party content published on a host site mainly to borrow the host’s ranking signals, such as coupon sections on news sites.
- Back button hijacking. Google lists this under malicious practices: a site that manipulates browser history so the back button keeps you on the page.
Early traffic data shows a real hit. Diib analysed 32,569 sites with Google Analytics connected and compared 24 to 26 September with the same days a week earlier. The median share of visits from unpaid Google search fell from 34% to 31%. The share of sites losing half or more of that traffic doubled, from 5% to 10%. Diib called it “an early read, not a verdict”, since its data can’t show which sites Google flagged.
Barry Schwartz at Search Engine Roundtable called the update “pretty impactful” and logged volatility spikes on 25 to 27 September, 30 September and 4 to 6 October.
What it left alone
Your backlinks. Google gave no sign this was a link spam update. Link spam updates work on a different mechanism: Google neutralises the links, and its documentation says any ranking benefit from them “cannot be regained”. If your rankings fell in this window, look at your content before your link profile.
The rulebook. Google announced no policy change alongside the update. Its spam policy page carries a last updated date of 28 August 2026, nearly a month before the rollout began.
Site reputation enforcement in Europe. Since 30 August, Google no longer applies site reputation manual actions to searches made inside the European Economic Area, following Digital Markets Act talks with the European Commission. Google may separate the offending section so it ranks on its own instead. The September update left that arrangement in place. The UK sits outside the EEA, so UK searches still see the manual action demotions.
Manual actions. A spam update runs on Google’s automated systems and sends no Search Console message. If you have a manual action, it appears in the Manual actions report, and you fix it through a reconsideration request.
Sites that follow the rules. Some of the drops site owners reported never happened. SEOmonitor found that many rank trackers recorded sudden ranking changes from 26 September that searchers never saw, because Google returned incomplete and incorrect results to automated searches. Real spam demotions hold for days and show up in Search Console clicks and impressions.
Check a drop in four steps
- Open the Search Console Performance report and compare 24 September to 8 October with the previous period. Trust clicks and impressions over tracker positions.
- Open the Manual actions report. An empty report means any hit came from the algorithm.
- Sort pages by lost clicks. If the losses cluster in one folder, such as location pages, a sponsored section or a batch of AI written posts, audit that folder against the four policies above.
- Improve or remove the pages that break the rules. Google says a site can recover “if our automated systems learn over a period of months that the site complies”. Plan for months, not weeks.
Google ran core updates in March and May this year, and Schwartz expects another soon. If one lands in the next few weeks, report on the two windows separately so you can tell a spam demotion from a core shift.
FAQs
When did the September 2026 spam update finish? Google confirmed the rollout complete on 8 October 2026, 13 days and 16 hours after it began on 24 September.
Did the September 2026 spam update target AI content? Google named no target. Its scaled content abuse policy covers pages produced at scale to manipulate rankings, whatever tool produced them. Helpful AI assisted content falls outside that definition.
How long does recovery from a spam update take? Months. Google’s systems need time to learn that a site now complies, and you may not see gains until a later refresh.
Does a spam update affect UK sites differently from EU sites? The algorithmic update applied in every country. The difference sits in manual enforcement: site reputation manual actions still apply to UK searches but no longer apply to searches inside the EEA.
actualSEO is an SEO agency that audits traffic drops and rebuilds sites hit by Google penalties.
