Google September 2026 Spam Update: What It Means for You

Last updated 28 September 2026. Rollout in progress.

Google started rolling out the September 2026 spam update on 24 September at 9:15am Pacific time, and it applies globally across all languages. It is Google's fourth spam update this year, after March, June and August.

If your traffic has dipped this week, do not touch anything yet. This guide covers what is confirmed, what is speculation, how to work out whether you have actually been hit, and what I would do in each scenario.

What Google has confirmed

Google's announcement was brief: a spam update, global, all languages, rollout of up to two weeks. Beyond that, Google has not provided any detail on what this update targets.

The rollout window is the interesting part. Each of the three earlier 2026 spam updates was given an estimate of a few days, and none took longer than three days. This one is estimated at up to two weeks. A longer window usually means a bigger or more complex change, but it is a maximum, not a promise.

That makes 2026 the most active year for spam updates since 2021. For comparison, there were three in 2024 and only one each in 2023 and 2025.

What is reported but not confirmed

It reportedly does not target link spam. Search Engine Roundtable reported that this update does not target link spam and does not cover every spam policy. That points towards content and site level violations rather than backlinks, but it is a report, not a Google statement.

Volatility before 24 September was not this update. If your rankings moved earlier in the month, the same reporting says that shakeup was separate. Do not blame the wrong event.

The SAFE AI slop detector. You will see posts linking this update to a Google research paper on a system called SAFE, which detects mass produced AI content. Read carefully before you panic. The paper's figures and metrics relate to YouTube channels and video metadata, and it does not mention Google Search, websites or spam updates at all. It is a signal of where Google's thinking is heading on AI spam, not evidence of what this update does.

One thing that is confirmed and matters: since 15 May 2026, Google's spam policies explicitly apply to AI Overviews and AI Mode, and scaled content abuse covers generating large numbers of pages mainly to manipulate rankings, with generative AI named as one way of doing it. If you are chasing AI visibility with mass produced pages, you are now in scope in both places.

Source: Google Search spam policies.

Spam updates vs core updates vs manual actions

People mix these up constantly, and the wrong diagnosis wastes months.

The key detail: a spam update gives you no notification. If you check the Manual actions report in Search Console and it is clean, but traffic fell off a cliff during the rollout, you are likely looking at an algorithmic hit. If there is a notice in there instead, my Google penalty recovery case study covers what to do about it.

How to tell if you have been hit

1. Wait for the rollout to complete. Rankings move around a lot mid update. Diagnosing on day three leads to bad decisions. Watch Google's Search Status Dashboard for the completion notice.
2. Compare dates in Search Console. Set the Performance report to compare the period after 24 September against the equivalent period before. Look at clicks and average position.
3. Check the shape of the drop. Spam hits tend to be sharp and concentrated. A 60 percent sitewide fall over two days points to this update. A slow 10 percent slide is probably something else.
4. Check which pages dropped. If one section fell, say 400 near identical location pages or a batch of AI written posts, and the rest held, that section is your suspect.
5. Check the Manual actions report. Occasionally a manual action lands around the same time. It changes the fix completely.
6. Rule out technical causes. A broken robots.txt, a noindex left on after a site change, or a failed migration can all look exactly like a penalty. Check these before assuming Google punished you.

Who is most at risk

Google's spam policies are the rulebook every spam update enforces. Here is a self audit version, with the ways small and mid sized businesses most often break them without realising:

Hacked content deserves a special mention. Many owners have no idea their site has been compromised, because injected spam pages often only show to Google. Search site:yourdomain.com and look for pages you did not create.

If you have been hit: what to do

Step 1: do not panic edit during the rollout. Mass deleting pages or rewriting everything mid update muddies your data and can create new problems.

Step 2: identify the violation honestly. Match the pages that dropped against the policy table above. Be ruthless. If a previous agency built 300 thin pages for SEO, that is likely your problem, even if it once worked.

Step 3: remove or fix the violating content. Depending on what you find:

• Delete or noindex scaled, thin pages that serve no user purpose
• Consolidate near duplicate pages into fewer, genuinely useful ones, with 301 redirects
• Clean hacked content, patch the vulnerability and request removal of the spam URLs
• End any subfolder rental or third party hosting arrangement
• Rewrite genuinely useful pages with real expertise, data and experience

Step 4: wait. This is the part nobody likes. Google's systems need time to recrawl your site and learn that it now complies. That can take months, and some recoveries only show at the next spam or core update. If you would rather not work through that alone, this is what my Google penalty recovery service covers end to end.

Step 5: keep building in the meantime. Earn legitimate links, publish content with real firsthand expertise, and strengthen your brand signals. Waiting is not doing nothing.

I have been through this from the inside, taking a penalised site back to position one for its core commercial term. The full process is in my Google penalty recovery case study.

If you have not been hit: what to do

Good news, but three things are worth doing this week.

1. Audit your AI content workflow. If AI writes your content with no human expertise layered in, you are exposed to the next update, and 2026 has had four already. The standard that avoids spam filters is also the standard that gets you cited by AI engines. I cover it in my generative engine optimisation guide.
2. Check your location and service pages. If they are templated duplicates, consolidate or rewrite them before an update does it for you. My local SEO for small business guide explains what a location page worth ranking actually contains.
3. Watch for competitors dropping. Spam updates open gaps. If a competitor built their rankings on thin pages or bought links, their positions may now be up for grabs. Track your core terms over the next month.

What this means for AI search visibility

Because spam policies now cover AI Overviews and AI Mode, the shortcuts people have used to chase AI citations are risky: hundreds of near identical best X in Y pages, fake listicles ranking yourself first, or content written mainly for AI crawlers. The sustainable route is the same as it has always been. Build content that deserves to be cited, and earn mentions from sources AI tools already trust. My guide on how to rank in ChatGPT and AI Overviews lays out the steps.

The bigger picture

Four spam updates in nine months tells you where Google is heading. The gap between content made to rank and content made to help is being closed faster every quarter, and generative AI has made that gap Google's top priority.

For small businesses, that is good news. You have what spam cannot fake: real jobs, real customers, real expertise. Put that on your site properly and every update works in your favour. If you want a starting point, my SEO for small business playbook covers the foundations that survive every update.

If your traffic dropped this week and you cannot tell why, actual SEO's first pass audit is free and will tell you whether it is this update, something else, or nothing to worry about.

Frequently asked questions