Google's September 2026 Spam Update: What It Means

Google's September 2026 spam update is an algorithmic refresh of the systems Google uses to catch content and links that break its spam policies, and it began rolling out on 24 September 2026. This is for the founder, marketer, or site owner who watched rankings or organic clicks move in late September and wants to know what happened before touching anything. It covers what Google has actually confirmed, how it differs from a core update and from a manual action, how to tell whether this one reached your site, and the response that fits a rollout still in progress. Every date and status below comes from Google's Search Status Dashboard, the record of what Google actually shipped, and nothing here goes past what that dashboard states.

The short version

• Nothing here needs a reconsideration request. A spam update is algorithmic, so no reviewer was involved, no entry lands in your Manual Actions report, and there is nothing to appeal.
• As of publication the rollout is still running. Google lists a 24 September 2026 start on its Search Status Dashboard and has published no completion date, so any duration you see quoted is a guess.
• A spam update has a nameable cause. If it moved your site, it is because your pages carry a behavior Google's spam policies name, which makes this far more diagnosable than a core update.
• The dashboard is the source, not the commentary. Confirm the dates and status there before you attribute any change to this update.
• Do not rebuild mid-rollout. Editing while the systems are still settling adds new faults and destroys your ability to tell what actually moved.

What is Google's September 2026 spam update?

An algorithmic improvement to Google's spam-fighting systems, and it started on 24 September 2026. Google announced it on its Search Status Dashboard, where confirmed ranking changes are logged with their start and end dates.

A spam update sharpens the automated systems Google runs to detect content and links that break its spam policies. When one of these updates moves a site, it is because the improved systems now recognize a pattern the site was already carrying. No person decided your rankings, and the timing was not aimed at you.

That is the whole nature of it, and it is also why the fix, when you need one, is concrete rather than abstract. A core update reassesses quality across the web with no specific fault to point at. A spam update acts on defined behaviors Google names in public, a distinction our guide to how Google algorithm updates work covers in full. This piece stays on the September 2026 event and the practical response to it.

What has Google actually confirmed about it?

Four facts, and little beyond them. Reading the dashboard as the source rather than a secondhand summary matters more than usual while a rollout is live, because an update in progress attracts a lot of confident commentary the record does not support.

• Start date: the update began rolling out on 24 September 2026.
• Status: as of publication it is still rolling out. Google has posted no completion date, so calling it finished or quoting a duration goes past what the record shows.
• Sequence: it is the fourth spam update Google has confirmed in 2026, after ones that started on 24 March, 24 June, and 18 August. Two core updates also ran in 2026, starting 27 March and 21 May, and a core update is a different kind of event.
• Mechanism: it is algorithmic. No manual action is attached, so it does not appear in your Manual Actions report and there is no review to request.

Everything past those four points is inference. If you read that this update targets a particular niche, punishes one specific tactic, or has wrapped up, check the claim against Google's Search Status Dashboard before acting on it. That page is where the March, June, August, and September updates are each recorded, and it is the quickest way to separate what Google shipped from what a blog decided it meant.

Spam update, core update, manual action: what is the practical difference?

Whether there is a named cause to fix. A manual action names one and hands you a route back. A spam update acts on a named pattern but files no report. A core update names nothing at all, so the three call for three different responses.

Event	What it is	What the response looks like
Spam update (the one running now)	An algorithmic improvement to Google's spam-detection systems. Moves a site when it matches a spam-policy pattern.	Find the pattern, clear it site-wide, and wait for a later run to reassess. No report, no appeal.
Core update	A broad reassessment of quality and relevance across the web, with no specific fault flagged.	Improve genuine quality, then wait for a later core update. Nothing specific to fix.
Manual action	A human reviewer's decision that pages break the spam policies.	Fix the named violation, then file a reconsideration request. It is logged in the Manual Actions report.

Two of these are algorithmic and one is human. For the manual-action route, including what goes into a reconsideration request, our guide to what actually counts as a Google penalty covers it end to end. The rest of this article is about the algorithmic update that is live now.

How can you tell if the September 2026 update affected you?

Line up the timing first, then read what moved. The window opened on 24 September 2026 and is still open, so a change that started before the 24th is unlikely to be this update, and a change inside the window is a candidate rather than a verdict, because the systems are still settling.

Two checks narrow it quickly, and neither needs an invented number:

• Timing: find the exact date your clicks or rankings started moving in Search Console and set it against the 24 September start. A decline that predates the rollout points somewhere else.
• Pattern: note which pages and queries moved, and in which direction. A spam update tends to act where a spam-policy pattern lives, so a shift concentrated on a section built from thin, scaled, or link-driven pages is a stronger signal than a small, even wobble across the whole site.

Resist the urge to attach a threshold to this. There is no published share of sites affected and no number of positions lost that confirms a spam-update hit, and anyone quoting one is guessing. Confirm the drop is real and read its shape before you conclude anything; our diagnostic guide to a Google traffic drop walks through ruling out a bad deploy, a stray noindex, lost backlinks, and seasonality first. Doing that before you accept the update as the cause is the difference between fixing the right thing and rebuilding the wrong one.

Which spam patterns should you audit your site against?

The ones Google publishes, because a spam update acts on those and not on a vendor's toxicity score. Google's spam policies name the behaviors its systems look for, and most sites that get moved by a spam update are carrying one of them somewhere, often on pages nobody has opened in a year. Read each row as an honest question about your own site.

Spam-policy pattern	Ask yourself	If the answer is yes
Scaled content abuse	Are you publishing many pages, however produced, chiefly to pull in search clicks rather than to help a reader?	Consolidate or remove pages that only exist to chase a keyword.
Thin affiliate pages	Do pages carry merchant descriptions or affiliate links with nothing of your own added?	Add genuine first-hand value, or remove the page.
Scraped content	Is any content copied from other sites and hosted with little original work around it?	Replace it with material that is yours.
Doorway abuse	Do you run near-duplicate pages built to funnel searchers from many similar queries into the same place?	Merge them into one page that genuinely serves the query.
Link spam	Did you buy, exchange, or build links mainly to move rankings, or publish paid links that pass PageRank?	Stop the practice; for inbound link actions, see the note in the next section.
Cloaking or sneaky redirects	Do users and Googlebot ever get shown different content, or sent to different URLs?	Serve the same page to both, and remove the redirect.
Hidden text or keyword stuffing	Is there text hidden from readers, or keywords packed in to rank?	Take it out.
Expired domain abuse	Did you buy an expired domain and repurpose it mainly for its old ranking signals?	Rebuild the site on its own merits, or retire it.
Site reputation abuse	Is third-party content published on your domain mainly to borrow your site's ranking strength?	Bring it under real editorial control, or remove it.
User-generated spam	Are forums, profiles, or comments filling with spam through open channels?	Moderate, and close the channels being abused.

This is a self-audit, not the report a manual action would hand you. Because a spam update is algorithmic, nothing here will show up named in Search Console; the work is to find the pattern yourself and read it against Google's own definitions. One category behaves differently: inbound link spam is the single case where a disavow file can belong, and only under the narrow test Google actually sets out. For everything else on this list, the fix lives on your own pages.

What should you do if you think you were hit?

Fix the nameable cause, then wait for a later run. Because a spam update acts on defined patterns, it offers a recovery path a core update never does: pinpoint the exact spam-policy behavior your pages carry, clear it from every page it touches rather than a sample, and leave the improved systems to reach a new judgment on their next pass.

Three things make that work in practice:

• Fix at the root: a pattern produced by a template repeats on every page built from that template. Cleaning ten example pages and leaving the template alone changes nothing the systems will notice.
• Keep the fixed pages reachable: the systems have to be able to crawl the cleaned pages, so do not leave them behind a login, a stray noindex, or a robots.txt block.
• Then wait, without a countdown: there is no reconsideration request to submit, because nothing was manually actioned, and no published timeline for when a later run lands. Recovery, if it comes, arrives when the systems next reassess, which may be weeks out.

That last point is the uncomfortable one. You can do correct, thorough work and see nothing move for a while, because the pass that would credit it has not run yet. It is still the right work, and it is the only work that holds up.

Does the September 2026 spam update penalize AI-generated content?

Not for being AI-generated. Google's spam policies judge a page by what it offers and why it exists, not by whether a model wrote it, and the policy that applies is scaled content abuse: producing many pages mainly to game rankings rather than to help people. A page a model wrote that genuinely answers the query is not the target. A thousand pages generated to blanket a keyword set are, and so is the same low-value output produced by hand.

The practical read for anyone using AI in their workflow: the question is not the tool, it is whether the page would earn its place if a person landed on it with no search engine involved. If your AI use produces pages that clear that bar, this update is not about you. If it produces volume for its own sake, that is the pattern to address, whatever created it.

What should you not do during a live rollout?

Do not rebuild while the systems are still moving. The most common way to turn a spam-update dip into a longer problem is to change many things at once, mid-rollout, before the cause is even confirmed.

• Do not panic-rewrite pages that still serve readers: if a page carries no spam pattern, rewriting it strips signals that were working and diagnoses nothing.
• Do not file a disavow as a reflex: inbound link spam is one narrow case with a specific test, and a disavow is the hardest change to reverse. Our guide on whether filing a disavow is the right call at all sets out that test.
• Do not buy links to recover: acquiring manipulative links is itself a spam pattern, so it works directly against the systems this update sharpened.
• Do not roll back releases or bolt on schema on a hunch: every unattributed change you ship inside the window makes it harder to tell afterward what actually moved.

There is a quieter mistake too: changing strategy on impressions alone. Impressions deep in the results are noise, and they shift for causes unrelated to this update. Track clicks, average position on the queries you care about, and page-one placements, and leave the rest until the rollout closes.

How long will the September 2026 spam update take, and what happens next?

There is no published end date, so any specific duration you see is someone's guess. Google lists a start of 24 September 2026 on the Search Status Dashboard and, as of publication, no completion. The three earlier 2026 spam updates each ran for a matter of days once they closed, but past durations do not predict this one, and Google does not commit to a length in advance.

Two things are worth doing while it runs. Keep a dated log of what you observe, so that when the dashboard marks the rollout complete you can line your own history against the window instead of reconstructing it from memory. And watch the dashboard, not the commentary, for that completion, because it is the point at which post-rollout analysis becomes worth doing at all.

When it does close, the sequence is the one that fits any confirmed update: give the results about a week to settle, confirm the drop against your baseline, rule out the causes that are not the update, and only then decide whether a spam pattern is genuinely what moved you.

The habit worth building is the one that makes every future update easier: keep a dated change log of deploys, migrations, and content changes, and export your Search Console performance on a regular cadence, so the next rollout is something you measure against your own record rather than guess about. This week, open the Search Status Dashboard and note whether the September 2026 spam update still shows as rolling out, then open your three highest-traffic pages and read them honestly against the spam-policy questions above. If they are clean, that is your answer, and you can stop refreshing the graph.