Google spam update September 2026: was your site hit?

At 9:15 on the morning of 24 September, Pacific time, one line appeared on Google's Search Status Dashboard. The Google spam update for September 2026 had started, it "applies globally and to all languages", and it "may take up to two weeks to complete". That is everything Google said. If your traffic moved since, this post shows how to tell whether the update did it.

A spam update only removes what was propped up. If your graph fell, find out what was holding it up before you change a single page.

In short:

• Google said only: it began 24 September and may take up to two weeks.
• A drop usually means something propping a page up stopped counting.
• Judge only after the rollout finishes.

What did Google actually announce on 24 September?

One sentence, and a link. The full text of the dashboard entry reads: "Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete." There is no blog post on Search Central, no list of targets and no new policy attached to it. The link goes to Google's standing page on spam updates, which has not changed since December 2025.

Screenshot: Google Search Status Dashboard: September 2026 spam update, courtesy of Google, captured 4 Oct 2026.

So any article telling you this update "targets AI content" or "hits guest posts" is guessing. Google did not say. What it did say, on that standing page, is worth reading slowly:

• Spam detection runs all the time. A spam update is a notable improvement to those systems, and SpamBrain, Google's AI-based spam-prevention system, is the example it names.
• Sites that violate the spam policies "may rank lower in results or not appear in results at all."
• Recovery is slow by design. Changes may help "if our automated systems learn over a period of months that the site complies."
• For link spam there may be no recovery at all, because once the effect of spammy links is removed, "any ranking benefit the links may have previously generated for your site is lost."

That last line is the one owners misread most. If you bought links and your rankings fell, nothing is being withheld from you. The links simply stopped counting, and what you see now is roughly where the site stood without them.

Screenshot: Google September 2026 Spam Update Has Been Unleashed, courtesy of Search Engine Roundtable, captured 4 Oct 2026.

How long will the Google spam update of September 2026 take?

Google's estimate is up to two weeks, which would put the end around 8 October. As of 4 October, more than nine days in, the dashboard had not marked it complete. You can check it yourself: the dashboard publishes its full history as JSON at status.search.google.com/incidents.json, which is what the script further down reads.

That history tells a story of its own. Earlier spam updates often ran for one to four weeks. This year they have been quick and frequent: March took under a day, June about two days, August under three. September is already the fourth spam update of 2026, arriving 37 days after the previous one.

Two practical consequences. First, do not read your data mid-rollout and call it a verdict. Google's own guide to traffic drops suggests waiting a few weeks before judging whether a change has helped. Second, a site that keeps swinging every couple of months is not unlucky. With four updates in just over six months, a site on the wrong side of the policies will feel each one.

Was my site hit by the spam update, or is it something else?

Most drops after an update date are not caused by the update. Google's debugging guide lists the usual suspects alongside algorithmic updates: technical problems such as a stray noindex or a broken robots.txt, security issues, seasonality and site migrations. Its advice is to compare the drop against a similar period, then break it down by page, query, country and device.

The shape of the loss is the best clue you have.

A spam update does not send you a message. Manual actions do: Google's site reputation post confirms that "site owners will continue to be notified within Search Console when a manual action is applied". So the Manual Actions report is the first place to look, and an empty one tells you that whatever happened was algorithmic.

If indexing is the problem rather than spam, why your website is not showing up on Google walks through those checks in order.

How do I compare clicks before and after the spam update with the Search Console API?

The Performance report can compare two date ranges, but it is fiddly to do page by page. The Search Console API does it in two calls. The script below reads the update's start date from Google's own dashboard, builds two windows of equal length in whole weeks so that weekdays line up, pulls clicks per page for each, and tells you whether the loss is spread across the site or sits in a handful of pages.

// spam-update-check.mjs
// Compare a site's Google clicks per page before and after the latest spam update.
// Node 18+. Auth: gcloud application-default login with the webmasters scope.
//   node spam-update-check.mjs https://example.com/
//   node spam-update-check.mjs sc-domain:example.com
import { execSync } from 'node:child_process';

const SITE = process.argv[2];
if (!SITE) throw new Error('Pass your Search Console property, e.g. https://example.com/');
const LAG_DAYS = 3; // Search Console data is final roughly two to three days late
const DAY = 864e5;
const iso = (d) => d.toISOString().slice(0, 10);

// 1. Google's own record of ranking updates, from the Search Status Dashboard.
const incidents = await (await fetch('https://status.search.google.com/incidents.json')).json();
const update = incidents
  .filter((i) => /spam update/i.test(i.external_desc))
  .sort((a, b) => b.begin.localeCompare(a.begin))[0];
const begin = new Date(update.begin.slice(0, 10));
const lastDay = new Date(Date.now() - LAG_DAYS * DAY);
console.log(`${update.external_desc}: began ${update.begin}, ` +
  (update.end ? `ended ${update.end}` : 'still rolling out'));

// 2. Two windows of equal length, in whole weeks so weekdays line up.
const available = Math.floor((lastDay - begin) / DAY) + 1;
const days = available >= 14 ? 14 : 7;
if (available < 7) throw new Error(`Only ${available} days of data since the update; wait.`);
const after = { startDate: iso(begin), endDate: iso(new Date(+begin + (days - 1) * DAY)) };
const before = { startDate: iso(new Date(+begin - days * DAY)), endDate: iso(new Date(+begin - DAY)) };

// 3. Search Console API: clicks per page in each window.
const token = execSync('gcloud auth application-default print-access-token', { encoding: 'utf8' }).trim();
const headers = { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' };
if (process.env.QUOTA_PROJECT) headers['x-goog-user-project'] = process.env.QUOTA_PROJECT;

async function clicksByPage(range) {
  const url = `https://searchconsole.googleapis.com/webmasters/v3/sites/${encodeURIComponent(SITE)}/searchAnalytics/query`;
  const res = await fetch(url, {
    method: 'POST',
    headers,
    body: JSON.stringify({ ...range, dimensions: ['page'], type: 'web', rowLimit: 25000 }),
  });
  if (!res.ok) throw new Error(`Search Console ${res.status}: ${await res.text()}`);
  const { rows = [] } = await res.json();
  return new Map(rows.map((r) => [r.keys[0], { clicks: r.clicks, impr: r.impressions }]));
}

const [pre, post] = await Promise.all([clicksByPage(before), clicksByPage(after)]);
const sum = (m, k) => [...m.values()].reduce((a, r) => a + r[k], 0);
const total = { pre: sum(pre, 'clicks'), post: sum(post, 'clicks') };
const pct = (a, b) => (a ? (((b - a) / a) * 100).toFixed(1) + '%' : 'n/a');
console.log(`before ${before.startDate}..${before.endDate}: ${total.pre} clicks, ${sum(pre, 'impr')} impressions`);
console.log(`after  ${after.startDate}..${after.endDate}: ${total.post} clicks (${pct(total.pre, total.post)}), ${sum(post, 'impr')} impressions`);

// 4. Is the loss sitewide or concentrated in a few pages?
const pages = [...new Set([...pre.keys(), ...post.keys()])].map((p) => ({
  page: p, pre: pre.get(p)?.clicks ?? 0, post: post.get(p)?.clicks ?? 0,
})).map((r) => ({ ...r, delta: r.post - r.pre }));
const losers = pages.filter((r) => r.delta < 0).sort((a, b) => a.delta - b.delta);
const lost = -losers.reduce((a, r) => a + r.delta, 0);
const top5 = -losers.slice(0, 5).reduce((a, r) => a + r.delta, 0);
console.log(`pages losing clicks: ${losers.length} of ${pages.length}; ` +
  `top 5 account for ${lost ? ((top5 / lost) * 100).toFixed(0) : 0}% of all clicks lost`);
console.table(losers.slice(0, 15).map(({ page, pre, post, delta }) => ({ page, pre, post, delta })));

A few notes from running it. The API takes dates in Pacific time, which conveniently matches the dashboard. It returns at most 25,000 rows per request, plenty for most small business sites. Run it with gcloud auth application-default login and the webmasters scope first. We ran it against our own property and it works end to end, but our site is young and its numbers are far too small to say anything about the update, so we are not quoting them. Yours may be different.

How to read the output: if every page lost a similar share, look for a technical cause or a sitewide signal. If five pages account for most of the loss, open those five and ask what they have in common. That question usually answers itself.

What does research say spam updates actually do?

Google publishes almost nothing about the effect of its updates, so the most useful evidence comes from outside. In Is Google Getting Worse?, presented at ECIR 2024, Janek Bevendorff, Matti Wiegmann, Martin Potthast and Benno Stein tracked 7,392 product review queries for a year, from October 2022 to September 2023, scraping the top 20 results roughly every two weeks across eleven Google ranking updates. They measured Google through Startpage, which serves Google's results, alongside Bing and DuckDuckGo.

Screenshot: Bevendorff, Wiegmann, Potthast and Stein, Is Google Getting Worse? A Longitudinal Investigation of SEO Spam in Search Engines (ECIR 2024), courtesy of Webis.

Their baseline is what makes the paper useful. Across a large sample of the open web (ClueWeb22), only 2.35% of pages carried affiliate links. In the search results, the share was 29% on Google, 41% on DuckDuckGo and 42% on Bing.

Three findings matter for anyone watching this rollout:

1. Updates bite, and on schedule. Spam sites "often vanish (at least for a while) after Google's ranker updates, either immediately or up to two weeks later, which is the usual update rollout time."
2. The effect fades. The authors call Google's updates "noticeable, yet mostly short-lived", with affiliate pages "slowly regaining their lost momentum between updates."
3. Sites that flip get caught. A common pattern was pages that "start off as seemingly legitimate review pages", then switch to mass spam. Those were usually gone by the end of the study.

Read that second finding from the other side and it explains this year's chart. Short updates every couple of months are the obvious answer to spam that creeps back between them. That is our inference, not something Google has said, but it fits the timing.

Which spam policies should small business sites check first?

Google's spam policies name sixteen practices, and the page was last updated on 28 August 2026. For the sites we see, five matter far more than the rest:

• Scaled content abuse: "many pages are generated for the primary purpose of manipulating search rankings and not helping users." Fifty near-identical service pages, or AI-written posts published to fill a calendar, are the usual form.
• Doorway abuse: one page per town that differs only in the town's name. A location page earns its place with facts only that place has.
• Site reputation: third-party content placed on your site "mainly because of that host's already-established ranking signals", such as a paid coupon or casino section on a respected local paper.
• Expired domain abuse: buying an old domain to borrow its history for unrelated content.
• Link spam: paid links, link swaps, and widgets that slip links onto other sites. Our 60-second reel on PageRank explains why Google treats every link as a vote, and why bought votes are the first thing discounted.

One regional detail worth knowing if you sell into Europe. Since 30 August, a manual action under the site reputation policy affects searchers outside the European Economic Area, but not those inside it, after Google's discussions with the European Commission. A business in London is outside the EEA, so the old rule still applies there in full. This changes manual actions only; Google has not said it changes how automated spam systems work.

If a term here is new, the glossary defines it.

What should I do while the rollout finishes?

Not much, and that is the point. Write down today's date and your Search Console totals. Check the Manual Actions report. Wait until the dashboard says the rollout is complete, then give it another week of data before running the comparison above.

If the numbers say you were hit, resist the urge to delete half the site overnight. Find the pattern first: one folder, one template, one batch of pages written in a hurry, one set of links you would not want to explain. Fix that properly, and expect it to take months, because Google says its systems need that long to learn a site has changed.

If you were not hit, notice why. Usually it is because every page answers a real question with facts only your business has. The same quality is what gets a page quoted by AI assistants, and what makes ChatGPT cite a website looks at the evidence for that.

Where this studio stands

We do not build sites that need defending after a spam update. That means one page per real service, location pages only where we have something true to say about the place, no bought links, and no content written to fill a quota. Our answer engine optimisation work starts from that foundation, because a site that is easy for Google to trust is also easy for an assistant to quote.

Here is a test for tonight. Open your five most-visited pages and ask, for each one: if Google sent a person to review this page by hand, would I be glad or nervous? Your answer will tell you more than any rollout chart.