September 2026 Spam Update Complete: What Changed

If your Google traffic dipped in late September or early October, you’re probably asking whether the spam update hit your site. The short answer: the September 2026 spam update is complete. Google started it on 24 September and confirmed it finished on 8 October 2026, after 13 days and 16 hours.

That makes it Google’s longest spam update this year, by a wide margin. It was still shorter than the August 2025 spam update, which took close to four weeks. Below I cover what Google actually said and what the search community saw during the rollout. Then I share the simple process I use to work out whether a site was hit and what to do next.

September 2026 Spam Update Complete: The Key Facts

Here is what is confirmed on Google’s Search Status Dashboard entry for the update:

• Start: 24 September 2026 at 09:15 Pacific time.
• Scope: Google said it “applies globally and to all languages.”
• Expected length: Google said the rollout “may take up to two weeks to complete.”
• Finish: Google posted on 8 October 2026 (01:37 Pacific) that “the rollout was complete as of October 8, 2026.”
• Total time: 13 days, 16 hours, as listed on the dashboard.

On its social channels, Google also called it a normal spam update. It did not say which spam policies were the focus or how many queries were affected. It also didn’t say why this rollout ran longer than earlier ones this year.

If you want the background on how this update started, my launch coverage of the September 2026 spam update rollout explains the announcement and what we knew in the first days.

Why This Rollout Was so Long

Spam updates in 2026 have mostly been quick. This one was not. Here is how it compares with the other spam updates on the dashboard this year:

So the June update took about two days and the August update just under three. September took roughly five times longer than either.

Google gave no reason for the difference, so anything more is guesswork. What I can say is that a longer rollout usually means changes reach different parts of the index at different times. That matters when you look for the cause. A drop on 26 September and a drop on 5 October could both come from the same update.

For comparison, my write-ups of the short August 2026 spam update and the June 2026 spam update show how short those rollouts were. With those, you could check your data a few days later and see the full effect. With September, you had to wait two weeks.

What People Saw During the Rollout

Google does not publish impact data for spam updates. So everything in this section comes from community reports and rank-tracking tools. Treat it as patterns, not proof.

Rankings Moved in Waves

Instead of one big shift, trackers and community reports pointed to several separate periods of ranking movement:

• Around 25–27 September, shortly after launch.
• Around 30 September.
• Around 4–6 October, in the final week.

This fits a rollout that happens in stages. It also means a site could look fine in the first week and still be hit later.

Some Felt It Looked More Like a Core Update

Some people in the search community said the movement felt broader than a normal spam update. To them it looked closer to a core update. Nobody has shown solid proof of that, and Google has not suggested it.

My advice is simple: don’t assume a drop in this window must be about spam. Quality and relevance changes can look the same in your reports, and the fixes are different.

Not Every Tracker Spike Was Real

There were also warnings that some rank trackers showed sharp drops that real searchers were not seeing. Third-party tools only sample results, and sometimes they pick up test results or glitches. How those tools collect Google’s results is itself disputed, as Google’s lawsuit against SerpApi shows.

A real change shows up in your own Search Console data and lasts for several days. If a tracker says you fell but your clicks and impressions held steady, I’d trust Search Console every time.

What Google Did Not Confirm

• Which spam policies the update focused on.
• The share of queries or sites affected.
• Whether any type of site, niche or country was hit harder.

You will see confident claims about who “lost” in this update. Google hasn’t confirmed any targets, so I’d be careful with anyone who says they know exactly what it went after.

How Spam Updates Actually Work

It helps to understand how this works before you start changing your site.

Google runs automatic spam detection all the time. Its AI-based system, SpamBrain, is part of that. A “spam update” is when Google makes a notable improvement to these systems and announces it. Sites that break the spam policies can then rank lower or drop out of results completely.

Three points from Google’s own documentation matter most for recovery:

1. Automatic actions come with no notice. Unlike a manual action, there is no message in Search Console and no reconsideration request to file.
2. Recovery is slow. Google says things can improve once its automatic systems learn “over a period of months” that a site follows its spam policies.
3. Link spam gains are gone for good. If an update ignores spammy links, the ranking boost those links gave you is lost. Removing them will not bring that boost back.

Algorithmic Demotion vs Manual Action

People mix these up all the time, so I want to be clear:

• Manual action: a person at Google flags your site. You get a notice in the Manual actions report in Search Console. You fix the issue and send a reconsideration request.
• Algorithmic demotion: Google’s automatic systems push your site down. There is no notice. You fix the issue and wait for the systems to check your site again.

A spam update affects sites automatically. A manual action can happen at any time, including during an update, so I always check for both.

How to Tell If Your Site Was Affected

Now that the rollout is done, you can see the full picture. Here is the process I use.

1. Compare the Right Date Ranges in Search Console

Open the Performance report. Compare 24 September to 8 October with the 14 days before (10 to 23 September). Look at clicks, impressions and average position.

Then widen the view to the last 28 days or three months. You want to see whether a drop started inside the update window and stayed down. A short dip that bounced back is a different story.

2. Match Drops to the Dates Rankings Moved

Switch to a daily view. Did clicks fall sharply around 25–27 September, 30 September or 4–6 October and not recover? If so, that’s a strong sign the update is involved.

If your drop started before 24 September, or after 8 October, look for another cause first.

3. Rule Out Other Causes

Before blaming the update, I always check the boring things first:

• Seasonality: compare with the same period last year.
• Technical changes: a site migration, robots.txt edit, noindex tag or broken redirects can all cause sudden losses. Check the Pages report in Search Console for sudden jumps in excluded or not-found URLs.
• Tracking: if GA4 shows a drop but Search Console doesn’t, the problem may be your analytics setup, not your rankings.
• Other channels: if direct, paid and social traffic fell at the same time, the cause is probably not Google Search.

4. Check the Manual Actions Report

In Search Console, go to Security & Manual Actions, then Manual actions. If you see “No issues detected,” any problem you have is automatic, not manual. If an action is listed, deal with that first. It tells you exactly which policy Google applied.

5. Split the Loss by Section

A spam-related drop is often focused on one area. Filter the Performance report by page or folder and look for patterns:

• Did one section (for example, /deals/, /reviews/ or /locations/) take most of the hit?
• Were the losing pages made quickly, in bulk, or with heavy automation?
• Do the losing pages host content from third parties?

If the whole site dropped evenly across every section, that points more to a broad quality reassessment than a focused spam issue.

Which Spam Policies to Review First

Google did not name targets for this update, so review your site against the full list of Google’s spam policies. In practice, these are the ones I see causing trouble most often for normal business and publisher sites:

Scaled Content Abuse

This means making large numbers of pages mainly to rank, with little value for the reader. It doesn’t matter if AI, people or both wrote them. Examples include hundreds of near-identical “best X in [city]” pages, or AI-written articles published in bulk with no editing or original input.

Site Reputation Abuse

This applies when a site hosts third-party content mainly to borrow the host’s ranking strength. Think coupon sections or sponsored product reviews run by an outside company with little oversight. Google recently changed how manual actions under this policy apply in the European Economic Area, but the policy itself still stands.

Thin Affiliation

Affiliate pages that copy product descriptions and add nothing of their own are a common risk. Affiliate links themselves are fine. The problem is pages with no original testing, comparison or insight.

Doorway Abuse

Doorways are pages built to rank for specific searches that send users somewhere else. They can also be many pages that are almost the same apart from a place name. If you’re a business with many locations, take care here.

Link Spam and Expired Domain Abuse

Buying links and large-scale link swaps are spam. So is buying an expired domain to rank unrelated content on its old reputation. Remember that ignored link value does not come back.

Recovery: What to Do If You Were Hit

If your checks point to the update, this is the order I’d work in.

1. Confirm the pattern. Make sure the drop is real in Search Console and sits in the update window. Make sure technical or seasonal causes don’t explain it.
2. Find the affected sections. Split by folder and page type to see where the losses are focused.
3. Audit those pages against the spam policies. Be honest. Ask whether each page would exist if search engines did not.
4. Fix, merge or remove. Improve pages with real potential by adding original information. Merge near-duplicates into one strong page and redirect the rest. Remove or noindex pages that help no reader.
5. Clean up risky deals. End or closely supervise third-party content deals, and stop any paid link activity.
6. Write down what you changed. Keep a dated log so you can match future movements to your fixes.
7. Be patient and keep watching. Expect months, not weeks, before Google checks your site again.

What Not to Do

• Don’t file a reconsideration request unless you have a manual action. There is nothing to reconsider for an automatic change.
• Don’t mass-delete content in a panic. Removing good pages along with bad ones can make things worse. In my experience, this is the most common mistake after a drop.
• Don’t disavow every link you don’t recognise. Focus on links you know were bought or built to game rankings.
• Don’t chase daily rank-tracker swings. Judge progress on weekly and monthly Search Console trends.

A Simple Example

Picture a home services company that launched 300 city pages in the summer. Each page has the same text with only the town name swapped. Search Console shows those pages lost most of their impressions around 30 September, while the main service pages held steady. In that case, the city pages are the obvious place to start.

A sensible fix is to keep only the locations the business really serves. Give each one real local detail, like the team, projects, service area and local reviews, and merge the rest. My guide to location pages that aren’t thin walks through that approach step by step.

If You Were Not Affected

No change in your data is good news, but it’s not a free pass. Spam systems run all the time, and Google updates them several times a year.

Use the quiet time to quickly review any bulk-made sections, third-party content and old link building. Fixing risks now is much cheaper than recovering later.

If your traffic went up, it may be because rule-breaking competitors dropped. Gains like that can be fragile if they rely on the same tactics. So make sure the pages that gained are truly strong.

What to Watch Next

Rankings can keep settling for a short while after Google marks an update complete. I’d watch your Search Console data for the next couple of weeks before drawing firm conclusions.

If your drop looks more like a broad quality shift than a spam problem, the recovery path is different. It usually focuses on content quality and usefulness. My article on how long core update recovery takes explains what Google says about timelines for that kind of change.

Conclusion

The September 2026 spam update is complete after almost two weeks. That’s a much longer run than the June and August spam updates. Google confirmed the dates and worldwide scope but not the targets, and rankings moved in several waves, not one.

Your next step is simple. Compare 24 September to 8 October with the two weeks before in Search Console, check the Manual actions report, and split any losses by section. That will tell you whether the September 2026 spam update complete rollout left you a spam problem to fix, a different issue to look into, or nothing to worry about.