If your rankings have moved since 24 September, the September 2026 spam update is the most likely cause, and it is not finished yet. Google released it on 24 September 2026. It applies globally and to all languages, and Google said the rollout may take up to two weeks. As of 28 September it is still in progress.
That last point changes what you should do this week. Below I cover what Google confirmed, how this rollout compares with the short August spam update, how I monitor a site while an update runs, which policies to check, and what to avoid until it is done.
What Google Has Said About the September 2026 Spam Update
Google’s announcement is short. Here is everything posted on the Search Status Dashboard entry for the September 2026 spam update so far:
- 24 September 2026, 09:15 PDT: “Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete.”
There is no completion notice yet. When the rollout ends, Google will add a second line to the same entry, as it did for every other update this year.
What Google Did Not Say
What is missing matters as much as what was said. A lot of commentary is already filling the gaps with guesses.
- Google did not say which spam policies or tactics the update focuses on.
- Google did not explain why this rollout may take up to two weeks, when the earlier 2026 spam updates were expected to take “a few days”. The last spam update I tracked with a rollout this long was the August 2025 spam update.
- Google did not call it a link spam update.
- Google gave no figure for how many queries or sites are affected.
- Google did not announce a new spam policy with it.
So if you see a confident list of “what the September update targets”, treat it as one person’s reading of tool data. It is not confirmed. I don’t base any decisions on those lists.
What a Spam Update Actually Changes
Google’s spam detection runs all the time. A “spam update” is the name Google gives to a notable improvement in those automated systems. The main one is SpamBrain, which Google describes as its AI-based system for stopping spam.
The rules do not change in a spam update. The detection does. Pages that already broke Google’s spam policies become more likely to be caught. Once caught, they may rank lower or drop out of results.
How It Compares With the August 2026 Spam Update
This is the fourth spam update of 2026, and it came only 37 days after the last one. The August 2026 spam update was released on 18 August at 09:28 PDT. Google confirmed it complete on 21 August. The dashboard puts its total length at about 2 days and 16 hours.
The September update has already run longer than that. By the morning of 28 September it had been rolling out for about four days. Google has given no sign that it is close to done.
| Update | Released (PDT) | Google’s estimate | Length |
|---|---|---|---|
| March 2026 spam update | 24 March, 12:18 | A few days | About 19.5 hours |
| June 2026 spam update | 24 June, 09:03 | A few days | About 2 days |
| August 2026 spam update | 18 August, 09:28 | A few days | About 2 days, 16 hours |
| September 2026 spam update | 24 September, 09:15 | Up to two weeks | In progress (about 4 days so far) |
Two things stand out to me. First, the gaps between spam updates keep getting shorter: 92 days from March to June, 55 from June to August, and 37 from August to September. Second, this is the first spam update this year that Google expected to take weeks, not days.
A longer rollout does not prove a bigger impact. It tells you the change will reach Google’s systems slowly, so the effects can show up in stages, not in one sharp step. Here is what that means for you: a site that looks fine on day four can still move on day ten.
If you were hit in August, read your data carefully. A drop that began between 18 and 21 August and stayed flat through September belongs to August. New movement from 24 September onwards is more likely the new update. Some sites will have both.
How to Monitor Your Site While the Update Rolls Out
The goal this week is to collect clean evidence, not to react. Here is the process I use during any rollout.
1. Set a Fixed Baseline
In the Search Console Performance report, use a baseline (a “before” period to compare against) that ends on 23 September. For most sites, the four weeks before that date work well. If you were hit in August, start the baseline after 21 August, so you are not comparing against traffic from before August.
Remember that Search Console data usually runs a day or two behind. Data for 27 and 28 September may still be incomplete when you look.
2. Watch for a Reporting Change on the Same Day
On 24 September, the same day this update started, Google also added a Multimodal option to the Search type filter in the Performance report. It separates searches that start from an image, photo or screenshot from text searches. Our article on how Search Console now splits text and multimodal searches explains the change.
When you compare before and after, make sure you compare the same search type on both sides. If not, you could mistake a reporting change for a ranking change.
3. Track Daily, but Judge Weekly
Check clicks and impressions every day so you can see when a change began. Do not draw conclusions from a single day. On many sites, weekday and weekend patterns alone can swing traffic a lot.
A habit I like is to log three numbers each morning in a simple sheet: total clicks, non-branded clicks, and clicks to your top ten landing pages. A step change that holds for several days is a signal. A one-day dip that recovers is usually noise.
4. Look at Which Pages Move, Not Just the Total
Spam systems act on content or behaviour that breaks a policy. When they act, the losses tend to group together. Open the Pages tab, compare against your baseline, and sort by change in clicks.
- Is the loss focused in one subfolder, template or content type?
- Did pages published in bulk, or supplied by a third party, fall the most?
- Are branded queries steady while non-branded queries drop?
For example, picture an online shop where product pages hold steady, but a folder of 600 near-identical “best gifts for [city]” pages loses most of its clicks. That is a clear pattern to look into. A site where every section slips a little is looking at something else.
5. Check Manual Actions and Security Issues
Spam updates are automated, so they do not trigger a Search Console message. A manual action is applied by a human reviewer, and it does show up in the Manual actions report.
Check that report and the Security issues report once this week. If either shows a problem, that is a separate issue with its own fix. It needs attention whatever the rollout does. Hacked content, in particular, should be cleaned up right away.
6. Rule Out the Ordinary Causes
Before you blame the update, check the boring explanations. A site release that added a stray noindex tag, a robots.txt change, a broken redirect, a tracking change or seasonal demand can all look like an algorithm hit. A quick crawl and a look at the Page indexing report will catch most of these. In my experience, this step explains more “update drops” than people expect.
Which Spam Policies Matter Most Right Now
Google did not name a focus. So the sensible approach is to check against the policies that most often catch ordinary businesses and publishers. I covered these in detail in our articles on the June 2026 spam update and the March 2026 spam update, so I will not repeat the full explanations here. These are the ones I would check first:
- Scaled content abuse: large numbers of pages made mainly to rank, whether by AI, scraping or human writers. Templated location and comparison pages are the most common example in 2026.
- Site reputation abuse: third-party content on your domain, such as a rented subfolder, published with little real oversight from you.
- Expired domain abuse: using an old domain’s reputation to rank unrelated, low-value content.
- Link spam: bought links, large-scale link swaps, or links from networks built to pass ranking value.
- Hacked content and user-generated spam: spam pages or comments that others placed on your site without you knowing.
One note on links. Google’s guidance on spam updates says that when its systems stop counting spammy links, any ranking benefit those links gave you is lost and cannot be won back. Removing or disavowing the links will not bring that value back.
What Not to Do While the Update Is Still Rolling Out
This is where most damage happens. Rankings move up and down during a rollout. Sites that react to day-three data often end up fixing the wrong thing.
Do Not Delete or Noindex Large Sections Yet
If a folder drops on day two, it may partly recover by day nine, or the drop may spread. Mass deletion based on early data can remove pages that were never the problem and break internal links. I’d make a list of the pages you suspect and decide once the rollout ends.
The exception is content that clearly breaks policy and that you would remove anyway. Think of hacked pages, spam comments, or a third-party section you never meant to host. Fix those now.
Do Not Rush Out a Disavow File
A spam update is not a reason to disavow every link you dislike. A disavow file is a list that asks Google to ignore certain links. If you know you bought links or ran a link scheme, deal with that carefully. If not, a rushed disavow file risks telling Google to ignore links that were helping you.
Do Not Start a Migration or Big Structural Change
Changing URLs, merging sites or rebuilding navigation in the middle of a rollout makes it almost impossible to tell what caused any later movement. If a planned launch can wait until Google confirms completion, let it wait.
Do Not “Refresh” Pages Just to Change the Date
Updating publish dates or swapping a few words across hundreds of pages is not a fix. It does nothing about a policy problem, and it adds noise to the data you need to read later.
Do Not Buy Links or Content to Make Up for It
When traffic falls, it is tempting to buy a quick package of links or articles. That is exactly the behaviour spam updates are built to catch. It can turn a short dip into a lasting problem.
Do Not Treat Third-Party Tool Charts as Proof
Volatility trackers show that results are moving across many sites. They cannot tell you why your site moved. Your own Search Console data, read against a clean baseline, is the evidence that counts.
What to Do If You Think You Are Affected
Use the rollout period to prepare, then act once it ends. See our article on the completed September 2026 spam update.
- Write down the date your change started and which page groups it hit.
- For each affected group, note who made the content, how it was produced and how many near-identical pages exist.
- Read the relevant spam policies and be honest about whether those pages would pass.
- Plan fixes that deal with the cause. That could mean merging or removing thin templated pages, adding real oversight to third-party content, or ending link deals.
- Wait for Google’s completion notice, check your data against your baseline again, and then carry out the plan.
Set expectations early, especially with clients or managers. Google says that if a site makes changes to follow its spam policies, improvement can come once its automated systems learn, over a period of months, that the site complies. That is explained in Google’s documentation on spam updates. There is no reconsideration request for an automated demotion. That process exists only for manual actions.
If your data shows no unusual movement by the end of the rollout, that is also a result. I still think a quick audit of any scaled or third-party sections is worth it, because spam updates now arrive every few weeks.
Conclusion: Watch, Write It Down, Then Act
The September 2026 spam update is Google’s fourth this year and the first expected to take up to two weeks. Four days in, it has already outlasted the whole August rollout. So early winners and losers may not be final.
For now, set a clean baseline, compare like with like in Search Console, note which page groups move, and fix only clear policy problems such as hacked content. Save larger changes for after Google confirms the rollout is complete. If you want a reminder of how the last few spam updates played out and how to recover, start with our breakdown of the June 2026 spam update.
