Google started rolling out the September 2026 spam update on September 24 at 9:15 a.m. Pacific time. It applies globally, in every language, and Google says the rollout can take up to two weeks. Spam updates improve the automated systems that catch sites violating Google's published spam policies, so if your site follows those policies, the most likely outcome is that nothing happens to you at all. If your rankings or traffic did move this week, do not rebuild anything yet. This post explains what Google announced, what the spam policies cover in plain English, how to confirm whether the update caused a drop, and what recovery honestly takes. Egochi tracks every confirmed Google update for its clients, and this page reflects what is known as of September 25.
The short version
- Started September 24, 2026 at 9:15 a.m. PDT; global, all languages; up to two weeks to finish.
- Fourth spam update of 2026, after March, June, and August.
- Google named no specific targets. The update enforces the existing spam policies through its automated detection systems.
- It is not a penalty. There is no reconsideration request for an algorithmic update.
- Most legitimate sites will see no change, and some gain as spammy competitors drop.
- If you were hit, recovery means removing the violating pattern and waiting months, not days.
What Google announced on September 24
The announcement itself is short. Google posted the update to its Search Status Dashboard, named it the September 2026 spam update, and gave the standard guidance: the rollout may take up to two weeks, it applies worldwide in all languages, and sites that see changes should review the spam policies. Google did not say which spam techniques this release focuses on, and it announced no new policies alongside it. That silence is normal. Spam updates are enforcement improvements, not rule changes: the rules were already published, and the update makes the systems that police them better at their job.
What a spam update actually does
Google's spam detection runs on automated systems it has described publicly under the name SpamBrain, in use since 2018 and behind every confirmed spam update since 2022. These systems learn patterns associated with policy violations. When an update ships, the improved systems re-evaluate the web, and pages or sites caught violating the policies rank lower or stop appearing in results.
Two properties matter for anyone reading their own traffic chart. First, this is algorithmic, not manual: no human reviewed your site, nothing appears in Search Console's manual actions report because of it, and there is no appeal form. Second, it cuts both ways. When spam loses visibility, the pages that replace it are the ones that were playing by the rules, which is why clean sites sometimes record small gains in the same window.
What counts as spam in Google's policies
The authoritative list is Google's own spam policies documentation. In plain English, the policies most relevant to business sites in 2026:
- Scaled content abuse. Publishing many pages that exist to rank rather than to help anyone, whatever produced them: AI tools, scraped feeds, translation spinners, or cheap outsourced writing. Volume without value is the violation, not the tool.
- Site reputation abuse. Renting out a trusted domain's authority to third-party content the host does not closely oversee, often called parasite SEO. Coupon sections and sponsored content farms on news domains are the famous examples.
- Expired domain abuse. Buying a domain with history and repurposing its old authority for unrelated low-value content.
- Link spam. Buying or selling links that pass ranking credit, private blog networks, and large-scale link exchanges.
- Cloaking and sneaky redirects. Showing Google different content than visitors see, or redirecting visitors somewhere they did not ask to go.
- Hacked content. Spam injected into a legitimate site through a security hole. The site owner is a victim here, but the rankings still suffer until it is cleaned.
- Keyword stuffing, doorway pages, and thin scraped content. The classics. Pages written for the crawler instead of the reader.
If you want the deeper background on where these lines sit, our breakdown of white hat versus black hat SEO walks through the tactics on each side.
How to tell if the update hit your site
Work through this in order before changing anything:
- Anchor the dates. The window opened September 24. A drop that began September 20 is not this update, whatever a dashboard vendor tweets.
- Open Search Console. Compare clicks and impressions for the days after September 24 against the prior period and the same days last month. Look for a step change, not normal daily wobble.
- Check manual actions and security issues. The update itself will not appear there, but a hacked-content problem or an existing manual action changes your whole diagnosis.
- Segment before concluding. Break the drop down by page group and query. Spam enforcement tends to hit the offending section, a scaled directory, a third-party subfolder, a doorway cluster, rather than shaving every page evenly.
- Wait for the completion notice. Rankings swing in both directions mid-rollout and some swings reverse. Judge the damage after the dashboard marks the update complete.
What to do if your traffic dropped
Read the spam policies with the site open next to them and ask the uncomfortable question: which pattern could an automated system see here? The honest answers are usually one of a few: a programmatic page set that got too thin, a guest-post or link-buying habit, a third-party section monetizing your domain, an old hacked corner nobody noticed, or aggressive templated pages that read like doorways.
Then remove the pattern, properly. Delete or consolidate the scaled pages instead of trimming ten percent of them. End the arrangement behind the parasite section. Clean the hack and close the hole. After that, the timeline is the part nobody likes hearing: Google's systems need to recrawl and reassess, sustained compliance is what they look for, and documented recoveries from spam hits are measured in months. Some sites see the next spam update, rather than the current one, restore them.
What not to do while the rollout runs
- Do not redesign or relaunch mid-rollout. You will never know whether the update or your change moved the numbers.
- Do not mass-delete content in a panic. Removal is for pages that violate a policy, not for everything that lost a position this week.
- Do not buy a recovery service that promises speed. Algorithmic reassessment has no fast lane, and link-heavy recovery schemes are themselves the violation.
- Do not noindex your way out. Hiding weak pages from the index does not remove the pattern from the site Google evaluates.
- Do annotate your analytics. Mark September 24 and the completion date in GA4 now; every future traffic conversation will reference this window.
How a spam update differs from a core update
| Question | Spam update | Core update |
|---|---|---|
| What is it judging? | Violations of written spam policies | Overall quality, relevance, and usefulness |
| Did you break a rule? | Yes, in Google's assessment | Not necessarily; others may simply score better |
| Is there a fix list? | Yes: find and remove the violating pattern | No single fix; quality work across the site |
| Recovery timeline | Months of sustained compliance | Often waits for a future core update |
| Appeal path | None (unless a separate manual action exists) | None |
If your losses trace back to a core update instead, the playbook is different, and we keep a separate core update recovery walkthrough for exactly that case. The distinction matters because the helpful content system that once ran as its own update now lives inside core updates, a change we covered in our helpful content update retrospective.
The 2026 spam update timeline so far
This is the fourth spam update of the year, and the completed rollouts have been getting longer:
| Update | Started | Rollout time |
|---|---|---|
| March 2026 spam update | March 2026 | 19 hours 30 minutes |
| June 2026 spam update | June 2026 | 2 days 1 hour |
| August 2026 spam update | August 2026 | 2 days 16 hours |
| September 2026 spam update | September 24, 2026 | In progress, up to two weeks |
Four spam updates in seven months is a faster cadence than any recent year, and the practical reading is simple: Google is enforcing its spam policies on a rhythm now, so a tactic that survives one update is not safe, it is waiting. Sites betting on scaled pages, rented authority, or purchased links are betting against a system that re-checks its work roughly every other month.
Why clean sites can treat this as good news
Every position a spam page loses is a position something else gains. During spam rollouts we watch client categories for exactly this: competitors whose rankings were built on techniques the policies name tend to slide, and the sites that earned their visibility inherit the space. If your traffic ticked up this week, that is worth documenting too, because it tells you which competitors were borrowing their positions.
How Egochi handles Google updates for clients
Egochi is a US search engine optimization company with offices in New York, Miami, Milwaukee, and Madison, and confirmed-update weeks follow the same routine for every client: we annotate the rollout dates in GA4 and Search Console, hold structural changes until the completion notice, segment any movement by page group and query, and report what changed with the data source named. Because our seo services are built on the policies Google publishes rather than around them, spam updates have historically been quiet weeks for our clients, and that is the point. If your site dropped this week and you want a second set of eyes on the diagnosis, request an audit and we will tell you which case you are in, including the case where nothing is wrong and the right move is patience.
Questions people are asking about this update
Is the September 2026 spam update finished rolling out?
Not yet as of publication. It started September 24, 2026 and Google says the rollout can take up to two weeks, which points to completion around October 8. The Google Search Status Dashboard posts the completion notice, and no ranking change should be treated as final before it appears.
Is a spam update a penalty?
No. A penalty in the strict sense is a manual action, issued by a human reviewer and listed in Search Console with a reconsideration path. A spam update is automated: Google improves its detection systems, and sites that violate spam policies rank lower or stop appearing. There is nothing to appeal, only patterns to fix.
Does the spam update target AI content?
Not as a category. Google evaluates whether content helps people, not how it was produced. What the policies do name is scaled content abuse: publishing many pages that add little value for users, whatever tool made them. A small number of genuinely useful AI-assisted pages is a different situation from thousands of thin ones.
How long does recovery from a spam update take?
Months, in most documented cases. After you remove the violating pattern, Google’s systems need to recrawl the site and rebuild trust over time, and meaningful movement often waits for a later update. Anyone promising a quick recovery from an algorithmic spam hit is selling something the system does not offer.
Should I submit a reconsideration request?
Only if Search Console shows a manual action. Algorithmic updates have no request path and no reviewer to write to. If the manual actions report is empty and your visibility fell during the rollout window, the work is diagnostic: find which spam policy the site brushes against, remove the pattern, and let the systems reassess.
How is a spam update different from a core update?
A spam update enforces specific written policies, so a hit means Google thinks your site crossed a defined line. A core update reassesses quality and relevance broadly, and losses there often happen with nothing technically wrong. The response differs too: spam hits have a concrete pattern to remove, core hits need overall quality work.
