# Google's September 2026 spam update: what it means for your website > Google's fourth spam update of 2026 began on 24 September and is taking longer than any before it. What it is, who tends to get caught, and how to tell whether a traffic drop is really the update. - Source: https://webdivine.agency/insights/google-september-2026-spam-update - Author: Fady Ilias, Director, Web Divine - Published: 2026-10-05 - Updated: 2026-10-07 --- Google started rolling out its September 2026 spam update on 24 September, at 2:15am on Friday 25 September Melbourne time. It applies worldwide and in every language, and Google said it may take up to two weeks to finish. At the time of writing (6 October) the rollout is still running. If your enquiries or rankings have wobbled in the last fortnight, this is probably the first thing you will hear blamed. Sometimes that is right. Often it is not. Here is what the update actually is, which websites tend to get caught, and how to work out whether it touched yours. *Checked against Google's Search Status Dashboard and Search Central documentation as at 6 October 2026.* ## What a spam update actually does Google runs two very different kinds of ranking update. **Core updates** re-weigh how Google judges quality and relevance across the whole web. Sites can rise or fall without having done anything wrong. **Spam updates** are narrower. They improve Google's automated spam detection, which Google calls SpamBrain, so it gets better at spotting sites that break its published spam policies. Sites caught by it rank lower or drop out of results altogether. Two things are worth knowing straight away. First, a spam update is entirely automated: no person at Google has looked at your site, and you will not see a message about it in Search Console. Second, it is not a verdict on whether your site is good. A beautifully designed site can still be demoted if part of it breaks the rules. ## What is different this time This is the fourth spam update of 2026, after March, June and August. Each of those finished in under three days. September's came with a two-week estimate, and Google's John Mueller confirmed publicly that the figure was not a typo. ![Google ranking updates in 2026 so far: two core updates, four spam updates and a Discover-only update](https://vtsswbfzioalwmcwkzbo.supabase.co/storage/v1/object/public/portfolio/blog-diagrams/google-2026-updates.jpg) Google has not said what this update targets beyond describing it as a normal spam update. What we do have is early reporting from the SEO industry, which is worth treating as observation rather than fact: - Rank-tracking tools showed large swings between 25 and 27 September, peaking on the Saturday. - Well-known SEO consultants reported that sites built on mass-produced AI content or rigid templates were among those dropping. One example given was a site with a separate, near-identical page for every phone area code. - A second wave of movement was reported around 30 September. One related change is confirmed. On 1 October, Google updated its guidance on AI-generated content to stress that it is critical to fact-check and manually review AI output before publishing. Google has not linked that change to this update, but the direction of travel is clear. ## The spam policies that catch small businesses out Most small businesses are not running spam operations. They get caught because a supplier, a plugin or a shortcut did something on their behalf. These are the policies we see trip up ordinary business websites most often: - **Scaled content abuse.** Publishing lots of low-value pages mainly to rank, including pages churned out with AI that add nothing a visitor could not find elsewhere. A blog of 200 generic AI articles is a risk, not an asset. - **Doorway pages.** Many near-identical pages aimed at different suburbs or cities that all funnel to the same place. Location pages are fine when each one genuinely serves that area. Fifty copies with the suburb name swapped are not. - **Link spam.** Buying links, swapping links at scale, or using automated link schemes. If a cheap SEO package promised "500 backlinks", this is where it comes back to bite. - **Hacked content.** Spam pages, links or redirects injected by an attacker. Google treats these as a problem on your site whether or not you put them there, which is why keeping your platform patched matters for SEO too. We covered the latest round of fixes in [WordPress security updates, September 2026](https://webdivine.agency/insights/wordpress-security-updates-september-2026). - **Hidden text and links.** Text visitors cannot see but Google can, such as white text on a white background. Normal accordions, tabs and screen-reader text are fine. - **Expired domain abuse.** Buying an old domain and filling it with unrelated content to borrow its past reputation. - **Thin affiliate pages.** Product pages copied from a supplier or affiliate feed with nothing original added. ## How to tell whether it affected you Traffic moves for many reasons: seasonality, a site change, a broken tracking tag, a competitor's new campaign. Before you blame the update, work through it in order. ![Was it the spam update? Wait for the rollout to finish, rule out manual actions and security issues, compare like-for-like weeks, then fix the underlying pattern](https://vtsswbfzioalwmcwkzbo.supabase.co/storage/v1/object/public/portfolio/blog-diagrams/spam-update-diagnosis.jpg) 1. **Wait for the rollout to finish.** Google's Search Status Dashboard will mark it complete. Then give it about a week, so you are comparing settled data rather than mid-rollout noise. 2. **Rule out the other two culprits.** In Google Search Console, check the **Manual actions** and **Security issues** reports. A manual action means a person at Google reviewed your site, and it has a different fix (more on that below). A security issue means your site may have been hacked. 3. **Compare like with like.** In Search Console's Performance report, compare the week after the rollout ends with the week before 24 September. Then break the change down by page and by query, so you can see whether it is site-wide or confined to one section. 4. **Look for the pattern.** A site-wide drop that lines up with the rollout dates points to the update. A drop that started earlier, or only affects a handful of pages, usually has another cause. ![Search Console and analytics data tell you whether a drop lines up with the update dates](https://webdivine.agency/images/insights/1686061594183-8c864f508b00.jpg) ## If you were hit: what to do, and what not to do Google's advice is to review its spam policies and fix whatever breaks them. It is also candid that recovery is slow: its systems can take months to recognise that a site now complies. **Do:** - **Fix the cause across the whole site**, not just the pages that dropped. If the problem is templated location pages, either make each one genuinely local (real projects, staff, reviews and details for that area) or consolidate them and redirect the rest. - **Review AI-assisted content properly.** Check every page for accuracy and real usefulness, and remove or merge pages that exist only to fill a keyword gap. - **Stop any paid or swapped link activity.** Note that any ranking benefit those links once gave is gone for good, even after you clean up, so do not wait for it to return. - **Check for a hack** if anything looks unfamiliar: pages you never published, odd redirects, links you did not add. **Do not:** - **Make dozens of panicked changes mid-rollout.** You will not be able to tell what helped. - **Buy a "spam update recovery" package.** There is no switch to flip. Recovery comes from fixing the underlying issue and waiting. - **Confuse it with a manual action.** If Search Console does show a manual action, fix the issue and submit a reconsideration request from that report. Those are reviewed by people, typically within days to weeks. ## The bigger picture Spam updates are becoming more frequent, and the line Google draws keeps moving towards the same place: content and pages that exist for search engines rather than for people. The sites that ride these updates out are rarely the ones with the cleverest tactics. They are the ones where every page has a reason to exist. That is how we approach [SEO](https://webdivine.agency/services/seo) for our clients. If you are also seeing fewer clicks even where rankings have held, that is a separate shift worth understanding: see [why your traffic is down when your SEO isn't broken](https://webdivine.agency/insights/google-ai-search-traffic-australia). **Worried about your site?** Start with our free [website health check](https://webdivine.agency/resources/website-health-check) for a quick read on technical and SEO basics, or [talk to us](https://webdivine.agency/lets-talk). We will tell you honestly whether the update is the problem, and what to do about it if it is. ## Sources - [September 2026 spam update](https://status.search.google.com/incidents/XhUDXP7A67iHCD2kmbVu), Google Search Status Dashboard - [Spam policies for Google web search](https://developers.google.com/search/docs/essentials/spam-policies), Google Search Central - [Spam updates](https://developers.google.com/search/docs/appearance/spam-updates), Google Search Central - [Debugging drops in Google Search traffic](https://developers.google.com/search/docs/monitor-debug/debugging-search-traffic-drops), Google Search Central - [Guidance on using generative AI content](https://developers.google.com/search/docs/fundamentals/using-gen-ai-content), Google Search Central - [Manual actions report](https://support.google.com/webmasters/answer/9044175), Search Console Help - Coverage of the [rollout](https://www.seroundtable.com/google-september-2026-spam-update-42163.html) and [early ranking movement](https://seroundtable.com/google-september-2026-spam-update-weekend-impact-42174.html), Search Engine Roundtable --- Web Divine is a web design and development studio in Melbourne, Australia. More articles: https://webdivine.agency/insights. Site index for AI assistants: https://webdivine.agency/llms.txt