Google Spam Update: What It Is and What to Do Next
A Google spam update is a ranking change that targets pages breaking Google's published spam policies. If your traffic moved during the last two weeks, that may be why. The September 2026 spam update began in late September and finished rolling out on October 8, 2026, taking about two weeks, which is much longer than recent spam updates that wrapped up in a couple of days.
Here is the short answer for site owners: check your traffic dates against the rollout window, read Google's spam policies once, fix anything that genuinely breaks them, and keep publishing useful pages. Do not rewrite your whole site in a panic. The rest of this guide explains what a spam update is, what Google has said about this one, and a practical checklist you can work through this week.
What is a Google spam update?
Google ranks pages with automated systems. Some of those systems are built to spot spam, meaning tactics designed to manipulate search results instead of helping people. A spam update is Google improving or refreshing those systems. Pages caught by them can rank lower or stop appearing in results.
It is different from a core update. A core update re-evaluates how helpful and relevant pages are overall. A spam update is narrower: it is about policy violations. In practice the two can feel similar, because both can move traffic up or down within days.
| Update type | What it targets | Typical scope |
|---|---|---|
| Spam update | Pages that break spam policies | Specific tactics |
| Core update | Overall relevance and helpfulness | Broad ranking systems |
| Manual action | A violation reviewed by a human | One site, with a notice |
What we know about the September 2026 spam update
Based on reporting from Search Engine Roundtable and Google's own statements, these are the confirmed points:
- It rolled out globally and in all languages.
- It began in late September and finished on October 8, 2026, after about two weeks.
- Google described it as a normal spam update and did not announce any policy changes alongside it.
- It does not target link spam, and it does not cover every spam policy.
- Google did not say how many searches were affected or which tactics it focused on.
That last point matters. When Google does not name the tactics, nobody outside Google can say for certain what was hit. Be cautious with anyone who claims to know exactly. Treat early theories as theories until Google or solid data says otherwise.
How to tell if the update affected your site
Do not judge from one day of data. Compare a full period before the rollout with a full period after it.
- Open the Performance report in Google Search Console and compare clicks and impressions for the two weeks before the rollout against the two weeks after it finished.
- Look at which pages changed, not only the site total. A drop on a handful of pages points to a page-level issue. A sitewide drop points to something broader.
- Check the Manual actions report. If a human reviewer found a problem, it is listed there with details.
- Rule out other causes: seasonality, a site migration, broken tracking, or a slow or unavailable site.
One practical warning: Search Console reports have recently been running behind at times, and some third-party rank trackers are struggling to collect data. If numbers look strange, wait a day or two and re-check before drawing conclusions. Our Google Analytics beginner's guide shows how to confirm traffic changes from a second source.
The spam policies, in plain English
Google publishes its spam policies in its Search documentation. The main categories are below. Most legitimate small business sites are nowhere near these lines, but a few can be crossed by accident.
| Policy | What it means | Accidental risk |
|---|---|---|
| Keyword stuffing | Repeating terms unnaturally | Medium |
| Scaled content abuse | Mass pages adding little value | High with AI tools |
| Thin affiliation | Copying merchant descriptions | Medium |
| Doorway pages | Many near-identical pages for similar searches | Medium |
| Hidden text or links | Content people cannot see | Low |
| Cloaking and sneaky redirects | Showing Google something different | Low |
| Hacked content | Pages injected without permission | Medium |
| User-generated spam | Spam in comments or forms | Medium |
| Site reputation abuse | Third-party content riding on your site's strength | Low |
| Expired domain abuse | Reusing old domains to rank thin content | Low |
Google's list also includes link spam, scraping, misleading functionality, malicious practices and machine-generated traffic. The accidental-risk column above is our own rough judgment for small business sites, not a Google rating.
The most common accidental problems
Mass-produced pages
Scaled content abuse is about creating many pages mainly to rank, with little value for readers. Google has said it applies no matter how the pages are made, so using AI is not the issue by itself. Publishing hundreds of thin pages is. If you use AI to draft, add real experience, examples and checking before you publish.
Near-duplicate location or service pages
A page for every town with only the town name swapped is a classic doorway pattern. If you serve several areas, write each page around something specific and true about that area, or combine them into one stronger page.
Hacked or injected content
Hacked sites often carry hidden pages selling unrelated products. Search your own domain in Google with the site: operator and scan for pages you did not create. Keep your CMS, plugins and themes updated; WordPress, for example, regularly ships security patches.
Spam in comments and forms
Open comment sections and forms attract spammers. Moderate comments, use a spam filter, and mark user-submitted links appropriately.
A 10-point checklist after a spam update
- Confirm the traffic change against the rollout dates.
- Check Search Console for manual actions and security issues.
- Search site:yourdomain.com for pages you do not recognize.
- List your thinnest pages and decide to improve, merge or remove each one.
- Review any pages that repeat the same phrase unnaturally.
- Check that mobile and desktop visitors see the same content.
- Review affiliate or partner pages for original value beyond supplier text.
- Clean up spam comments and fake form submissions.
- Update software and change weak passwords.
- Write down what you changed and when, so you can judge results later.
How long does recovery take?
Google has said recovery from a spam-related drop can take many months, because its systems learn over time whether a site follows the policies. It also said it will run periodic refreshes of this update. So fixes are not rewarded overnight, and one good week does not prove a recovery.
Use the waiting time well. Improve your best pages, answer real questions, and make sure each page has a clear purpose. That is also what helps you appear in AI-powered results; our guide on ranking in Google AI Overviews covers that side.
What not to do
- Do not delete everything. Removing good pages hurts you twice.
- Do not buy a quick fix. Services promising guaranteed recovery cannot control Google.
- Do not chase every rumor. Wait for confirmed information.
- Do not change ten things at once. You will not know what helped.
Frequently asked questions
Is a spam update the same as a penalty?
Not exactly. A spam update is an automated change to ranking systems. A manual action is a penalty applied after human review, and you are notified in Search Console.
Can a site that did nothing wrong lose traffic?
Yes. Rankings shift for many reasons, and competitors can rise or fall during an update. That is why comparing before-and-after data page by page is worth the effort.
Does using AI to write content cause a spam problem?
Not by itself. Google's concern is low-value content published at scale. Reviewed, original, genuinely useful pages are fine however they were drafted.
Should I disavow links after a spam update?
This update does not target link spam, according to Google, so that is rarely the first thing to check.
When should I check my rankings again?
Give it a few weeks after the rollout ended, then review monthly. If you are new to the basics, start with what SEO is, or see why a website might not show on Google.
The bottom line
The September 2026 spam update was long, but Google called it routine and announced no new rules. The best response is calm: check your data, review your pages against the published policies, fix what is truly weak, and keep making pages people find useful. If you would like a second pair of eyes on your site, you are welcome to get in touch.