Google started rolling out the September 2026 spam update on 24 September and says it may take up to two weeks to finish. It targets Google’s automated spam detection, not ordinary ranking factors. Most small-business sites will see nothing. If your traffic drops, check Search Console before you change anything.
What is Google’s September 2026 spam update?
It is an upgrade to the automated systems Google uses to catch search spam, and it is running worldwide in every language.
Google announced the rollout on its Search Status Dashboard at 9:15 a.m. Pacific on 24 September 2026, saying the update "applies globally and to all languages" and that "the rollout may take up to two weeks to complete," as reported by Search Engine Land on 24 September 2026. It is the fourth spam update Google has shipped in 2026, according to Search Engine Journal’s coverage the same day.
Google has not said which spam tactics this one goes after. That is normal, and not something you can wait out for clarification.
Why is a two-week rollout unusual?
Because every other spam update this year finished in under three days.
PPC Land’s timeline of the 2026 spam updates puts the March release at roughly 19.5 hours, June at about two days and August at about three days. A fourteen-day window is close to five times longer than any spam update Google has run this year.
That matters for one practical reason: you cannot judge the damage on day three. Rankings move while the systems roll through, and owners who panic-edit in week one end up unable to tell what caused what. Wait for the "completed" note on the Search Status Dashboard.
Does a spam update affect an ordinary small-business website?
Usually not — spam updates hit policy violations, not mediocre content.
This is the distinction owners get wrong most often, and it costs them money. A core update reassesses how useful Google thinks your pages are; you can lose ground in one while doing nothing against the rules. A spam update is enforcement — it looks for scraped content, doorway pages, hidden text, link schemes and expired-domain abuse.
If you run a plumbing company with fifteen honest service pages, this is not your problem. But one category of small business does get caught, rarely by the owner’s own doing: sites where a cheap SEO contractor built thin location pages for forty towns the business does not serve, or bought links in a package deal. That work is the owner’s liability now, whoever did it.
| Spam update | Core update | |
|---|---|---|
| What it changes | Automated detection of policy violations | How Google assesses overall page usefulness |
| Who is affected | Sites breaking Google’s spam policies | Any site, no rule-breaking required |
| Typical symptom | Sharp drop on specific pages or the whole domain | Gradual shift across many queries |
| Fix | Remove the violating practice | Improve the content itself |
| Recovery timing | Months, once Google recrawls the fix | Often not until the next core update |
| This one’s window | 24 Sept 2026, up to two weeks | Not applicable |
How do you tell a spam hit from an ordinary traffic dip?
Compare the date of the drop against the rollout window in Search Console, and check whether it is one page type or everything.
Open Search Console, set the Performance report to the last three months, and look at clicks and impressions by day. A spam-update hit tends to be abrupt and lands inside the rollout window. September drops in home services, by contrast, are often just the end of summer.
Then check the Manual Actions report. Spam updates are algorithmic and will not put a notice there, but if you do find one, that is a separate and more urgent problem. Finally, look at which pages lost: damage concentrated on a block of near-identical city pages tells you something specific about what to fix.
What to do this week
- Take a benchmark today. Export the last 28 days of Search Console performance data by page and by query. Without a before, you cannot prove an after.
- Audit what a previous agency left behind. Crawl your own site for location pages covering areas you do not serve, duplicated service copy across dozens of URLs, and pages you do not recognise. This is where most small-business exposure sits.
- Check your backlink profile for anything bought. If someone sold you a link package in the last two years, find those links.
- Do not make sweeping changes mid-rollout. Wait for the rollout to be marked complete, then act on evidence. Rewriting your homepage on day four teaches you nothing.
Where does AI search fit into this?
The same fixes serve both, because AI answers are still drawn from the index this update polices.
AI Overviews appeared in 39.4% of Google searches in June 2026, up from 25.8% in July 2025 — Comscore’s Q2 2026 AI Intelligence Report, and it is US desktop data, not Canadian. No equivalent Canadian figure has been published, so treat it as a direction of travel.
The point is that a site suppressed by a spam action does not get quoted in an AI Overview, ChatGPT or Perplexity either — those systems lean on the same crawled corpus. Clean foundations and pages that genuinely answer a question remain the work, whether the traffic arrives as a blue link or a citation. That is the core of our SEO service.
Frequently asked questions
How long does it take to recover from a Google spam update?
Months, not weeks, and only after you have removed the violating practice. Google’s published guidance on spam updates is that once a site complies with the spam policies, rankings may improve as its automated systems recrawl and reassess the site over the following months. There is no form to submit and no way to accelerate an algorithmic spam action. The clock starts when the fix is live and crawled, so the sooner the bad pages or links are genuinely gone, the sooner that window opens.
Should I disavow links after a spam update?
Almost certainly not, unless you know you bought them. Google has said for years that most sites never need the disavow tool, because its systems already ignore the low-quality links that point at every site on the web. The exception is a real history of paid or manipulative link building, often inherited from a past agency. Even then, removing the links at source is the better route, with disavow as a fallback. Disavowing good links by accident does real damage.
Is this the same as a core update?
No. A core update changes how Google judges whether pages are useful, and a site can lose visibility in one without breaking a single rule. A spam update is enforcement against Google’s spam policies. The remedies are different too: a core-update loss is answered with better content and usually recovers at the next core update, while a spam-update loss is answered by removing the offending practice. Google confirms both types separately on its Search Status Dashboard, so you can always check which one you are dealing with by date.
My rankings dropped this week. Is it definitely the spam update?
Not necessarily, and assuming so is the expensive mistake. The rollout runs to roughly 8 October 2026, so a drop inside that window is a candidate, not a verdict. Check the ordinary explanations first: a site outage, an accidental noindex after a redesign, a Google Business Profile suspension, or a seasonal decline. Then check whether impressions fell alongside clicks. If impressions held steady and only clicks fell, that is a click-through problem, not a ranking one.
Not sure whether last week’s drop was the spam update or something in your own setup? We will tell you either way — book a free 48-hour audit and we will look at the data with you.
Sources: Search Engine Land, "Google releases September 2026 spam update," 24 September 2026; Search Engine Journal, "Google Rolls Out September 2026 Spam Update Globally," 24 September 2026; PPC Land, "Google’s September spam update gets a two-week rollout, its longest yet," September 2026; Google Search Central, spam updates documentation; Search Engine Land on Comscore Q2 2026 AI Intelligence Report, 22 September 2026.