Quick answer: Google started rolling out the September 2026 spam update on September 24, 2026 at 9:15 a.m. Pacific time. It applies to all languages worldwide and may take up to two weeks to finish. It is Google’s fourth spam update of 2026. Google has not said which types of spam it targets, so if your traffic drops in the next two weeks, check it against Google’s spam policies before changing anything else.
Below we cover what Google has confirmed, how it compares with the earlier 2026 spam updates, how to tell whether your site was affected and what to do next. We manage SEO for small and mid-sized businesses from our offices in Denver and London, and this is the checklist we run for our own clients during a spam update.
What Google has confirmed
| Detail | What we know |
|---|---|
| Start | September 24, 2026, 9:15 a.m. PDT |
| Rollout time | Up to two weeks |
| Scope | Global, all languages |
| What it targets | Not disclosed by Google |
| Where it is tracked | Google Search Status Dashboard |
Google’s announcement was short: “Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete.” Until the dashboard shows the rollout as complete, rankings can keep moving.
How it compares with earlier 2026 spam updates
| Update | Rollout time |
|---|---|
| March 2026 spam update | 19 hours 30 minutes |
| June 2026 spam update | 2 days 1 hour |
| August 2026 spam update | 2 days 16 hours |
| September 2026 spam update | Up to two weeks (in progress) |
The earlier 2026 spam updates finished in hours or days. This one has a two-week window. Google hasn’t said why. A longer rollout means you should wait for it to finish before drawing conclusions from your data.
What spam updates look for
Spam updates improve Google’s automated systems that enforce its spam policies. These are the policies small business sites most often run into:
| Spam policy | What it means | How small businesses get caught |
|---|---|---|
| Scaled content abuse | Many pages made mainly to manipulate rankings, including pages mass-produced with AI “without adding value for users” | Hundreds of near-identical AI “service in [city]” pages |
| Doorway abuse | Pages built to rank for specific searches that funnel visitors elsewhere | Thin location pages with only the town name swapped |
| Link spam | Buying, selling or exchanging links to manipulate rankings | Cheap link packages, private blog networks, paid guest posts without disclosure |
| Hacked content | Content or redirects injected through a security hole | Outdated WordPress plugins that let attackers add spam pages |
| Keyword stuffing | Unnatural repetition of keywords or lists of place names | Footers listing every suburb you serve |
| Site reputation abuse | Third-party content published mainly to use a site’s ranking signals | Selling “sponsored” pages on your site that have nothing to do with your business |
Hacked content is the one we see most often on legitimate small business sites. The owner often doesn’t know it is there. Spam pages injected through an old plugin can pull down a whole site, which is why keeping WordPress and its plugins updated is an SEO task, not just an IT one.
How to tell if your site was affected
- Wait for the rollout to finish. Check the Search Status Dashboard before judging your numbers.
- Compare dates in Search Console. In the Performance report, compare clicks and impressions for the weeks after September 24 with the weeks before. Look for a sharp drop that lines up with the rollout, not a slow slide.
- Check the Security issues report. If Google has found hacked content, it appears here.
- Check the Manual actions report. A manual action is a separate penalty applied by a Google reviewer. An algorithmic spam update does not appear there.
- Search your own site. Try
site:yourdomain.comwith words like “casino”, “loan” or “viagra”. Pages you did not create are a sign of a hack.
What to do if you were hit
Google’s advice is to review its spam policies and fix anything that breaks them. It says sites that make changes “may” improve once its automated systems “learn over a period of months” that the site complies. There is no quick reversal.
- Clean up hacked content first. Remove injected pages and redirects, update or remove vulnerable plugins, change passwords and request a review in Search Console.
- Merge or improve thin pages. Combine near-duplicate location or service pages into fewer, genuinely useful pages.
- Stop paid link schemes. Google says that when its systems neutralize spammy links, “any ranking benefit the links may have previously generated for your site is lost” and cannot be regained. Put that budget into content and genuine local links instead.
- Don’t panic-edit during the rollout. Large changes mid-rollout make it harder to see what actually moved your rankings.
What this means for local businesses
If you run a normal business website and don’t buy links or mass-produce pages, a spam update is unlikely to hurt you. It may even help if competitors relied on spam. The businesses at risk are those that took shortcuts: bulk AI location pages, cheap link packages or neglected WordPress sites.
The same habits that protect you from spam updates also help in AI search. Clear, first-hand content, accurate business details and a secure site make you easier for Google’s AI Overviews and AI Mode to trust and cite. Read more in our guide to getting cited by AI search.
Not sure where your site stands? Run a page through our free SEO checker, or ask our team for a free SEO audit. We check for hacked content, thin pages and risky links as part of every audit.
Frequently Asked Questions
When did the September 2026 spam update start?
Google started rolling it out on September 24, 2026 at 9:15 a.m. PDT. Google said the rollout may take up to two weeks to complete.
What does the September 2026 spam update target?
Google has not said. Spam updates improve the automated systems that enforce Google’s spam policies, such as scaled content abuse, link spam, hacked content and doorway pages.
Does the spam update penalize AI content?
Not AI content as such. Google’s policy targets using generative AI to create many pages without adding value for users. Helpful content that people review and improve is not spam because a tool helped write it.
How long does it take to recover from a spam update?
Google says sites that fix policy problems may improve as its systems learn over a period of months that the site complies. Ranking gains from spammy links that Google has neutralized do not come back.
Will a spam update show up as a manual action?
No. Spam updates are algorithmic. Manual actions are separate penalties applied by Google reviewers and are listed in the Manual actions report in Search Console.
Sources
- Google Search Status Dashboard: September 2026 spam update
- Google Search Central: Spam policies for Google web search
- Google Search Central: Google Search spam updates
- Search Engine Journal: Google rolls out September 2026 spam update
- Search Engine Land: Google releases September 2026 spam update
Written by the SEO District team in Denver and London. Last reviewed September 29, 2026. We will update this post when Google confirms the rollout is complete.
