What was Google's September 2026 spam update, and how do you recover?

Google's September 2026 spam update started on September 24, 2026 at 09:15 Pacific time and finished on October 8, 2026, a rollout of 13 days and 16 hours according to the Google Search Status Dashboard. It applied globally and to all languages, and it was the fourth spam update Google confirmed in 2026, after March, June and August.

Google's announcement was two sentences long and did not say which spam behaviors the update focused on. That matters for diagnosis: you cannot work backwards from a named target, so you have to start from your own data, line it up against the confirmed dates, and then compare your pages with Google's spam policies. This guide covers the verified facts, what a spam update is and is not, how to tell whether it affected you, and the recovery path Google itself describes.

When did the September 2026 spam update run?

The Search Status Dashboard is the only authoritative record of named ranking updates, and Google's own spam updates page points to it. The incident entry for this update reads: "Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete." The completion note followed at 01:37 PDT on October 8, 2026.

The table below lists every spam update the dashboard shows for 2026, verified on November 9, 2026. Times are US Pacific, as Google reports them.

Update	Started	Finished	Rollout time
March 2026 spam update	Mar 24	Mar 25	19 hours, 30 minutes
June 2026 spam update	Jun 24	Jun 26	2 days, 1 hour
August 2026 spam update	Aug 18	Aug 21	2 days, 16 hours
September 2026 spam update	Sep 24, 09:15	Oct 8, 01:00	13 days, 16 hours

Two details stand out. First, the rollout was far longer than the other three 2026 spam updates. When Search Engine Roundtable's Barry Schwartz asked whether the two-week estimate was a typo, John Mueller replied that it was "likely to take longer than some of the previous ones." Second, nothing else was rolling out at the same time. The last core update, May 2026, finished on June 2, and no core update has been listed since. That makes this update easier to date than most, which we come back to in the diagnosis section. For the full 2026 timeline including core updates, see our guide to the March and May 2026 core updates.

What do Google spam updates target?

Google runs automated spam detection all the time. A spam update is what Google calls a notable improvement to those systems. In its documentation, Google names SpamBrain, its AI-based spam prevention system, and says it improves that system "from time-to-time" so it catches new types of spam. A spam update therefore does not introduce new rules. It changes how well Google detects behavior that its existing spam policies already prohibit.

Those policies are published on Google Search Central. They currently cover:

• Cloaking and sneaky redirects: showing users and search engines different content, or sending users somewhere other than what they clicked.
• Doorway abuse: many pages built to rank for similar queries that funnel users to one destination.
• Expired domain abuse: buying an expired domain and reusing its reputation for unrelated, low-value content.
• Hacked content, malware and misleading functionality.
• Hidden text and links and keyword stuffing.
• Link spam: buying or selling links that pass ranking credit, excessive link exchanges, and similar schemes.
• Machine-generated traffic: automated queries sent to Google.
• Scaled content abuse and scraping: producing many pages mainly to manipulate rankings, however they are made, or republishing others' content without adding value.
• Site reputation abuse: third-party pages published on a host site to exploit its ranking signals.
• Thin affiliation and user-generated spam.

For September 2026, Google did not say which of these the update focused on. Search Engine Roundtable reported that it was not a link spam update and that Google would not say what share of queries it affected. Treat any article that claims the update "targeted AI content" or one specific tactic as unconfirmed, unless it quotes Google.

Did the August 2026 site reputation change play a part?

Probably not directly, and Google has not linked them. On August 28, 2026, Google published an update to its site reputation policy. Starting August 30, manual actions under that policy have a different effect for searchers in the European Economic Area than elsewhere: inside the EEA, affected sections may be treated as separate from the host site over time, while outside it the manual action still applies. That is a change to manual enforcement, which comes with a Search Console notice. A spam update is algorithmic and comes with no notice at all.

How is a spam update different from a core update?

Mixing the two up leads to the wrong fix, so it is worth being precise.

	Spam update	Core update
What changes	Detection of behavior that breaks published spam policies	Broad reassessment of how content is ranked overall
Who it affects	Sites that violate a spam policy	Any site; Google says losers "aren't necessarily bad"
Typical 2026 rollout	Under 3 days, except September (about 14 days)	About 12 days (March and May 2026)
Google's advice	Review the spam policies and comply	Use the helpful content self-assessment
Notification	None for algorithmic effects	None
Recovery timing	Months, as systems relearn the site	Days to months, sometimes the next core update

The practical consequence: if a spam update hit you, rewriting content to be "more helpful" will not help while a policy violation remains. If a core update hit you, hunting for spam you do not have wastes time.

How can you tell if the September spam update hit your site?

Use dates first, then the shape of the loss, then the policies. This routine uses only Search Console and your analytics.

1. Pin the start of the decline. In the Search Console Performance report, set a daily view from early September to late October. If clicks or impressions started falling before 09:15 PT on September 24, the spam update did not start it. Look elsewhere first: tracking, releases, migrations, or a seasonal pattern.
2. Compare clean windows. Compare a full week after completion, such as October 9 to 15, with the week before the rollout, September 17 to 23. Because nothing else was rolling out, a sharp change between those windows is a reasonable signal.
3. Check Manual Actions and Security Issues. Both reports are in Search Console. A manual action is a separate, human-applied penalty with its own fix and a reconsideration request. A security issue such as hacked content can look like a spam hit and needs cleanup first.
4. Read the shape. A steep, site-wide drop across many unrelated queries points to a site-level spam signal. A drop limited to one directory, a subdomain or one template points to that section, for example a hosted third-party section or a batch of generated pages.
5. Match the affected pages to a policy. List the pages that lost the most. For each, ask which policy could apply: were they produced at scale with little original value, placed on your domain by a partner, built as near-duplicate location or keyword pages, or supported by bought links?

Third-party rank trackers can help with timing, but be careful with them for this update. Search Engine Roundtable reported in September that Google had been blocking scrapers and rank trackers more aggressively, which reduced the data some tools collected. Your own Search Console data is the safer source. If the dates do not line up, our step-by-step guide on why website traffic drops covers the other common causes.

How do you recover from a Google spam update?

Google's guidance is short. Sites that see a change after a spam update "should review our spam policies to ensure they are complying with those." Sites that violate the policies "may rank lower in results or not appear in results at all." Recovery is possible: "Making changes may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies."

Here is how that translates into work, in order:

1. Remove or fix the violating pattern, not just the worst pages. Spam systems often assess patterns. If a template generated thousands of near-duplicate pages, fix or remove the template output, not ten examples.
2. Clean up scaled pages honestly. Consolidate thin variants into fewer, genuinely useful pages, redirect the rest to the closest match, or return 404 or 410 for pages with no equivalent. Our guide to programmatic SEO explains where templated pages stay useful and where they tip into scale for its own sake.
3. End hosted third-party arrangements that exploit your domain. If a partner publishes content on your site mainly to rank on your reputation, remove it or block it from indexing.
4. Stop buying links and remove paid links you control. For links you cannot remove, read the next section before reaching for the disavow tool.
5. Fix hacked content and security issues immediately, then request a review in the Security Issues report.
6. Keep publishing useful work. Recovery depends on Google's systems relearning the whole site over time, so normal, policy-compliant publishing continues to matter.
7. Measure monthly, not daily. Google says this takes months. Daily checking leads to panic changes that can make diagnosis harder.

What if links were the problem?

Google is explicit that link spam is different. When its systems neutralize spammy links, "any ranking benefit the links may have previously generated for your site is lost," and "any potential ranking benefits generated by those links cannot be regained." In other words, if part of your visibility rested on bought or manipulative links, removing them will not restore that visibility. The only path is earning links that Google counts, which our guide to link building without existing authority covers.

On disavowing: Google's Search Console help says you should disavow only if you have a considerable number of spammy, artificial or low-quality links pointing to your site, and if those links have caused a manual action or likely will. In most cases, Google says it can assess which links to trust without additional guidance. Mass disavowing in response to an algorithmic spam update is rarely useful and can remove links that were helping you.

What should you avoid after a spam update?

• Blaming the update without checking dates. A decline that began on September 20 is not this update.
• Treating it like a core update. Rewriting for helpfulness will not offset an ongoing policy violation.
• Deleting large, healthy sections in a panic. Remove what violates a policy; leave pages that are performing well alone.
• Hiding problems instead of fixing them. Moving thin pages to a new subdomain or a new domain does not change what they are.
• Trusting speculation. Google did not publish a target for this update. Act on your own data and the published policies.

If you need a second pair of eyes on a large site, Klepha's Blog Ranking service and our technical SEO expertise cover exactly this kind of audit, and our case studies show how we document changes and results. We do not promise recovery dates, because Google does not either.

Sources

• Google Search Status Dashboard, "September 2026 spam update" incident page and "All incidents reported for Ranking", accessed November 9, 2026. status.search.google.com
• Google Search Central, "Google Search spam updates and your site", last updated December 10, 2025, accessed November 9, 2026. developers.google.com
• Google Search Central, "Spam policies for Google web search", accessed November 9, 2026. developers.google.com
• Google Search Central Blog, "Update to the site reputation policy", August 28, 2026. developers.google.com
• Google Search Console Help, "Disavow links to your site", accessed November 9, 2026. support.google.com
• Search Engine Journal (Matt G. Southern), "Google Completes September 2026 Spam Update After Nearly 14 Days", October 8, 2026. searchenginejournal.com
• Search Engine Roundtable (Barry Schwartz), "Google September 2026 Spam Update Is Done Rolling Out", October 8, 2026. seroundtable.com
• Semrush (Cecilia Meis), "Google releases September 2026 spam update", September 29, 2026, quoting John Mueller. semrush.com

Frequently asked questions