Quick answer: Google’s September 2026 spam update began on 24 September and Google’s dashboard reported it complete as of 8 October 2026, about 13 days and 16 hours in total. It applied globally to all languages and was the longest of the four spam updates Google ran this year. Google called it a normal spam update and said little else, so the best response is to audit your site against Google’s published spam policies.
What happened
Google announced the September 2026 spam update on 24 September 2026, saying it applied globally and to all languages and that the rollout could take up to two weeks. The Search Status Dashboard lists the incident at 13 days and 16 hours. Its closing note says the rollout was complete as of 8 October 2026. The timestamps are in US Pacific time, so some trackers quote 7 October for the end; the difference is just the time zone and the hour of the day.
Compared with Google’s other 2026 spam updates as listed on the dashboard, this one stands out:
| 2026 spam update | Listed duration |
|---|---|
| March (from 24 March) | about 19 hours 30 minutes |
| June (from 24 June) | about 2 days 1 hour |
| August (from 18 August) | about 2 days 16 hours |
| September (from 24 September) | about 13 days 16 hours |
Google has not explained why this rollout took so much longer than the others, and it has not said what the update targeted. A longer rollout could mean many things, so we are not going to guess.
What Google said
Google described it as a normal spam update. As explained on Google’s spam updates page, its automated spam detection runs all the time, and a spam update is a notable improvement to those systems. No new policies were announced. That means the rules you need to check are the existing ones in Google’s spam policies.
For background on how the earlier ones behaved, see our post on the June and August 2026 spam updates.
How to tell whether it affected you
- Check for a manual action first. In Search Console, open the Manual actions report and your message center. A manual action is a different thing from an automated spam update, and it comes with a message and a route to a reconsideration request.
- Define your comparison windows. The rollout ran 24 September to 8 October. Compare a period after it ended with an equivalent period before 24 September. Because the rollout was long, individual days in the middle are not reliable evidence of anything.
- Identify which pages moved. Export top pages and queries from Search Console. Look for groups: a whole folder, a template, a city-page set, or a section of old blog posts.
- Rule out other causes. Seasonality, a site migration, a plugin update, tracking changes, a lost listing, or a technical error can all look like a penalty.
If your traffic was steady, there is nothing to fix. Use the update as a prompt to run the audit below anyway while nothing is on fire.
How to audit for spam-policy risk
Scaled content
Scaled content abuse means producing many low-value pages mainly to manipulate rankings, whether by AI, scraping or stitching. It is not about whether AI was used; it is about whether the pages are useful. Check for:
- Large batches of posts published in a short period with similar structure and thin substance.
- Location or service pages where only the town name changes.
- Pages that add nothing to what is already on your own site or others.
If you find them, merge, rewrite with real local detail, or remove. Our content SEO process is built around fewer, better pages.
Site reputation abuse
This is hosting third-party content, mainly to benefit from your site’s established ranking strength. Look for sections on your domain, such as coupon pages, sponsored reviews, or partner content, that someone else largely controls and that has little to do with your business. If you have those, review whether the arrangement is sound.
Expired domain abuse
This is buying an expired domain and repurposing it to host low-value content that targets rankings. If you own more than one site, check whether any is an old domain with unrelated content on it. If you recently bought a domain for your business, check what it hosted before.
Cloaking and sneaky redirects
Cloaking shows search engines different content than users. Sneaky redirects send users somewhere they did not expect. Use Search Console’s URL Inspection tool to view the page as Google sees it, and compare it to what a visitor sees on a phone. Test links from search results on mobile too. Oddities here often come from caching or ad plugins, not intent, but Google does not distinguish.
Hacked content
Hacked content is unauthorized content added through security flaws: injected pages, text, links, or redirects. Search Google for your domain plus words like pills, casino or replica. Review the Security issues report, scan the site, check your sitemap for unfamiliar URLs, and update everything. Our WordPress team can help with clean-up and hardening.
Link spam
Link spam means buying, selling or swapping links mainly to influence rankings, including unqualified paid links. Review the backlinks you know about and any agreements with past vendors. Ensure that sponsored and paid links carry the appropriate rel attributes. Note Google’s warning: if it neutralises the value of spammy links, you do not get that value back. The answer is to earn better links. See our link building approach.
The rest of the list
Also scan for keyword stuffing, hidden text, thin affiliate pages, scraped content, user-generated spam in comments and profiles, and misleading functionality. The policy page lists them all.
If you did lose traffic
- Document the dates and the affected pages.
- Match them to a policy. If you cannot, the cause may not be spam at all.
- Fix the cause properly: clean the hack, remove or rewrite thin sets, correct the redirect, end the link arrangement.
- Keep a dated log of what you changed.
- Be patient. Google says that after changes, a site may improve as its systems learn over several months that it complies.
If your drop instead looks like a broad quality shift, read our core update recovery playbook.
What not to do
- Do not assume the worst from one bad week. The rollout was long and noisy.
- Do not blanket-disavow. Only act on links you know you paid for or built unnaturally.
- Do not replace one set of mass pages with another.
- Do not hide the problem. If a page violates policy, fixing it beats disguising it.
- Do not expect a core update to fix a spam problem, or the reverse. They are separate systems.
For Oregon businesses in our Oregon service area, the most common problems we see in audits are thin duplicated city pages and compromised plugins, not deliberate spam. That is good news, because both are fixable.
Frequently asked questions
When did the September 2026 spam update start and end?
It started on 24 September 2026. Google’s Search Status Dashboard reported the rollout complete as of 8 October 2026, which is about 13 days and 16 hours in total.
Was it the longest spam update this year?
Yes, based on the durations listed on the dashboard for the four 2026 spam updates: March, June, August and September. Google has not said why it took longer.
What did the September update target?
Google has not said. It called the update a normal spam update, applying globally to all languages, and did not name specific policies.
Is a spam update the same as a manual action?
No. A spam update is an automated improvement to detection. A manual action is applied by a human reviewer and reported in Search Console, with a reconsideration process.
Will another core update follow?
Google does not announce updates in advance, so we cannot say. Keep improving your content and avoid reacting to speculation.
Want a second opinion on spam risk? Request a free SEO audit and we will check your site against these policies.