Google's September 2026 spam update: a 10-minute check

You opened Search Console or your analytics this week and the line dipped, or you saw a headline that Google just released a spam update. Now you want to know whether your business site is in trouble. Google's September 2026 spam update started on September 24, and Google says it may take up to two weeks to roll out. Google has not named a new list of targets; the update applies its existing spam policies through its automated systems. A drop during the rollout could be the update, or it could be a tracking fault, a slow week or a broken page. You can tell which with a short check today, and you do not need to change anything on your site before you do. Keep a dated record, look for a manual action, then compare what you find with Google's own spam rules.

What did Google announce for the September 2026 spam update?

Google posted the update on its Search Status Dashboard on September 24, 2026, with a start time of 09:15 PDT. The entry says it "applies globally and to all languages" and that "the rollout may take up to two weeks to complete." Counting from the start, that window runs to about October 8.

That is the whole of Google's statement. Google did not publish a narrower list of what this update goes after. What it does, per Google's page on spam updates and your site, is improve the automated systems that apply Google's existing spam policies. Search Engine Roundtable reports that Google said this update does not target link spam, and notes that the August 2026 spam update took about two days, so a two-week window is long by this year's standard. Treat any list of "winners and losers" you read this week as someone's observation of sampled rankings, not as Google's word.

Is a normal small business site at risk?

A site is at risk when something on it matches one of Google's spam policies, not because it is small or because it sells a service. Google defines spam as techniques meant to deceive visitors or manipulate Search into ranking content higher. Its list includes cloaking, sneaky redirects, scaled content abuse, scraping, link spam, hidden text, keyword stuffing, site reputation abuse and hacked content.

In everyday terms, those policies cover things like pages that show Google one thing and visitors another, links that send people somewhere they did not expect, large batches of pages published mainly to rank, copied content, bought links, text hidden in the page, and pages stuffed with the same phrase. Hacked content belongs on the list too, and it can appear on a site whose owner did nothing wrong. Google's policy does not say that AI-assisted writing is spam. It says content made mainly to manipulate rankings can break the scaled content abuse policy whether a person, a tool or both produced it.

How can I tell in 10 minutes whether the update affected my site?

You can run this check yourself with the free tools you already have. The goal is a dated record of what moved and when, so any decision you make later rests on evidence rather than a headline. Write down what you find at each step, including what you do not know yet.

Minutes 1 to 4: compare Search Console by day

Open the Search Console Performance report and look at daily clicks, impressions and average position for the weeks before and after September 24. Compare the same weekdays in earlier weeks, and the same period last year if your business is seasonal. If impressions fell, your site is showing up less. If clicks fell while impressions held steady, demand or the look of the results page may have changed instead.

Minutes 5 and 6: find where the drop sits

Filter by page, query, country and device. A drop across the whole site points one way. A drop in one folder, one page template or one group of searches points another, and it tells you where to look.

Minute 7: open the Manual actions report

In Search Console, open Security and Manual Actions, then Manual actions. If a reviewer at Google has flagged your site, it shows there with the reason. If the report is empty, you have no manual action, but a ranking change can still come from Google's automated systems.

Minute 8: confirm the site works

Load your key pages and make sure they open normally. Check that nothing was accidentally set to noindex or blocked in robots.txt, that redirects still point where they should, and that your analytics and consent tools still record visits.

Minutes 9 and 10: list recent changes

Write down anything that changed on the site lately: new pages, redirects, bought links, an expired domain you took over, comment or forum sections, or pages published in bulk with AI tools. Then hold that list up against Google's spam policies and note what matches, what does not and what you are still testing.

What else could explain a drop this week?

Plenty of things can look like an update hit. Google has not published a ranking of causes for this update, so the order below is a practical troubleshooting order, starting with the quickest to rule out. It is not a measure of how often each one happens.

If your site was hacked, that comes before anything else. Our guide to the first 24 hours after a website is hacked walks through containment. If the drop started well before September 24, the update is less likely to be the cause, and the steps in what to do when website traffic drops suddenly apply.

What should I fix if the update did hit my site?

Google's advice is short: sites that see a change after a spam update should review its spam policies and make sure they comply with them. Fix the specific practice that matches a policy, and keep a record of what you changed and when. Leave the rest of the site alone.

For a manual action, the path is set out in the Manual actions report. Google names the issue, you fix it, you document what you did, and you submit a reconsideration request. Google reviews the request and may lift the action once the problem is resolved.

For an automated change, there is no request to file. Google says changes "may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies." If bought or spammy links were involved, Google also says any ranking benefit those links gave you is lost and "cannot be regained." That means the goal is a clean site going forward, not a return to the old numbers on a schedule.

What should I avoid doing during the rollout?

While the update is still rolling out, big changes make your evidence harder to read and can cause new problems. Hold off on these until you have tied a drop to a named policy issue.

• Mass deletes: Removing whole sections because one folder lost impressions.
• Mass rewrites: Rewriting every page before you know which pages moved.
• Disavow files and link buying: Buying more links to make up for a drop, or filing a disavow without evidence of a link problem.
• Domain moves and emergency redesigns: Switching domains or rebuilding the site in the middle of the rollout.
• Judging too early: Measuring recovery before the two-week window has closed.

If your impressions and rankings are steady, you may not need any SEO work at all; the cause may be tracking, a seasonal dip or something on the page that stops visitors from getting in touch. If the cause is a broken setting, the fix may be a small repair rather than an ongoing campaign. Anyone who promises you a recovery date for this update is promising something Google itself does not.

Frequently Asked Questions About google september 2026 spam update

When did Google's September 2026 spam update start?

On September 24, 2026, at 09:15 PDT, according to Google's Search Status Dashboard.

How long will the Google spam update rollout take?

Google says the rollout may take up to two weeks to complete, which puts the end of the window around October 8.

Is the Google spam update September 2026 global?

Yes. Google says it applies globally and to all languages.

Does a traffic drop mean Google penalized me?

Not by itself. The update, a tracking fault, a seasonal dip, a technical problem or a change in demand can all cause a drop. Compare Search Console by day and check the Manual actions report first.

Where do I check for a manual action?

In Search Console, under Security and Manual Actions, then Manual actions. If a reviewer has flagged your site, the reason shows there.

How long does recovery from a Google spam update take?

Google gives no recovery date. It says fixes may help once its automated systems learn over a period of months that the site complies, and benefits from spammy links are lost for good.

What This Means for You

The September 2026 spam update started on September 24 and can run for up to two weeks. It applies Google's existing spam policies worldwide; Google has not named a new target for it. A dip in your numbers during that window is a reason to check, not a reason to rebuild.

Spend ten minutes on the check: Search Console by day, where the drop sits, the Manual actions report, whether the site works, and what changed lately. If nothing on your site matches a spam policy and your impressions are steady, keep watching until the rollout ends. If something does match, fix that one practice, write down what you did, and give Google's systems time.

If the evidence is mixed, your site has many pages or templates, or you suspect hacked content, we can help. At Web Leveling, we look at your Search Console data, your site's setup and your content against Google's spam policies, and we tell you what needs fixing and what does not. Our search engine optimization service covers the diagnosis and the fixes, measured against real clicks and impressions, with no promised recovery date. We work with small and medium businesses across the country and overseas. Tell us what you are seeing in Search Console and we will take a look.

Terms