Google began rolling out its September 2026 spam update on 24 September 2026 at 9:15am PT, and says the rollout may take up to two weeks. It applies globally and to all languages, and Google has not named a specific spam policy or type of site it targets. In the first 48 hours your job is not to rewrite anything; it is to record what happened, confirm the cause is plausibly this update, and check your site against Google's published spam policies.
Key Takeaways
- The update started 24 September 2026 (9:15am PT) and, per Google's Search Status Dashboard, may take up to two weeks to finish. Do not judge results until it is marked complete.
- Google has not said which policy it targeted. Search Engine Land reports this is the fourth spam update Google has announced in 2026.
- Your first 48 hours are for documentation and diagnosis, not edits. Changing pages mid-rollout muddies your evidence.
- Compare like-for-like windows in Search Console, segmented by page type and query group, not just sitewide clicks.
- Google's own documentation says sites may improve if its automated systems "learn over a period of months" that the site complies, so recovery is slow.
- If your traffic did not move, Google's guidance as reported is that no action is needed.
What Google has actually said (as of 30 September 2026)
The primary source is the Google Search Status Dashboard incident for the September 2026 spam update. It gives the start time (24 September 2026, 9:15am PDT), states the update "applies globally and to all languages," and says the rollout "may take up to two weeks to complete." That is the whole announcement. There is no list of affected behaviours.
Search Engine Land, Search Engine Journal and Search Engine Roundtable all carried the news. Search Engine Land describes it as the fourth announced spam update of 2026, following the August update. I could not independently confirm counts for the earlier ones beyond August, so treat "fourth" as reported.
Two things stand out. First, the two-week window is a long rollout for a spam update; the August 2026 update, per the Search Status Dashboard as summarised by SEO Kreativ, ran two days and 16 hours (18 to 21 August). Second, Google gave no hint about focus. Post 333 in this series goes through the categories Google's spam policies cover, but no one outside Google can say which one moved.
Hour 0 to 4: freeze and snapshot
Freeze site changes
If you are mid-migration or mid-refresh, pause what you can. A ranking change that lands the same week as a template change is nearly impossible to attribute. I tell clients: unless it is broken or a security issue, nothing ships until the rollout ends.
Export the baseline
In Search Console, export Performance data by page and by query for the last 28 days versus the previous 28 days, plus the same dates a year earlier if seasonality matters. Save these as files. Search Console data can be sampled or revised, and you want your own copy.
Record annotations
Write down every site change from the last 60 days: new content batches, plugin updates, link-building campaigns, new subdomains, guest post programmes. This is your suspect list.
Hour 4 to 24: is this update even the cause?
A traffic dip does not equal a spam-update hit. Check these before you panic.
| Check | What you are looking for | Where |
|---|---|---|
| Timing | Drop begins on or after 24 Sep, not before | Search Console, daily view |
| Breadth | Many pages/queries fall together, not one URL | Pages report |
| Position vs impressions | Average position worsened, not just clicks | Performance |
| Tracking | Analytics tagging still works | GA and server logs |
| Seasonality | Same dip last year | Year-on-year compare |
| Manual action | Any notice | Manual Actions report |
| Indexing | Coverage or crawl problems | Page indexing report |
If the drop started before 24 September, look elsewhere. Google's August update ran 18 to 21 August and other changes were live in that period. If your dip matches August rather than September, note it, because SE Ranking's data (covered in post 334) showed that update moved a lot of top-10 URLs.
Rule out measurement noise
One item worth knowing from the news list: Google has been rolling out google.com/goto redirects, which as reported can affect rank trackers and scrapers. If your only evidence is a rank-tracker dashboard, confirm with Search Console impressions and average position before concluding anything.
Hour 24 to 48: audit against the policies
Google's spam policies page lists 16 categories: cloaking, doorway abuse, expired domain abuse, hacked content, hidden text and link abuse, keyword stuffing, link spam, machine-generated traffic, malicious practices, misleading functionality, scaled content abuse, scraping, site reputation abuse, sneaky redirects, thin affiliation, and user-generated spam. For a typical small business or content site, five deserve a hard look.
1. Scaled content
Did you publish many pages quickly, especially AI-assisted, with little added value? Pull every URL published in the last 12 months, group by template, and ask the policy's own question: are these pages made mainly to rank, or to help someone? I use a simple test. If I removed the page, would any user notice?
2. Link spam
Review any paid links, exchange schemes, or sponsored posts without proper rel attributes. Google's documentation warns that for link spam, "making changes might not generate an improvement," because once its systems neutralise spammy links the ranking benefit is simply gone. So a drop can be a loss of benefit you never legitimately had.
3. Site reputation abuse
Do you host third-party content, coupons, or "partner" sections on your domain that exist mainly to borrow your authority? This is the category most likely to bite established sites.
4. Hacked content and user-generated spam
Search your site for injected pages: site:yourdomain.com plus terms like casino, pills or loans. Check forum, comments and profile pages for spam. These are the cheapest problems to fix.
5. Thin affiliation and scraping
Are product pages copies of merchant descriptions? Are you republishing other sites' content with light rewrites?
What not to do
- Do not mass-delete pages on day two. Deleting good content to appease an unnamed policy is a common overreaction.
- Do not file a reconsideration request unless you have a manual action. Google's spam-update page does not describe reconsideration for algorithmic changes.
- Do not disavow blindly. Disavowing links only matters if you have a real link-spam problem.
- Do not buy a "spam update recovery" package from anyone claiming certainty about the trigger. Nobody outside Google has it.
If you were not affected
Search Engine Land reports that sites unaffected need no immediate action. I would still use the moment: the audit above is worth doing once a year regardless, and it is much cheaper when you are not in a panic.
How I would report this to a client
I send a two-line summary: what Google said, what our data shows. Then a table of page groups with the change in clicks, impressions and average position, and a note on which policy each could plausibly relate to. When I worked on organic growth at Masai School, the discipline that mattered most was separating what we could measure from what we were guessing; the same applies here.
When to check again
The status dashboard will mark the rollout complete. Only then compare a full post-rollout window against your baseline. Google's documentation says improvement can take months, so schedule a review at 30 days, then again at 90.
FAQ
When did the September 2026 spam update start?
It started on 24 September 2026 at 9:15am PDT, according to the Google Search Status Dashboard. Google said it applies globally and to all languages.
How long will the rollout take?
Google says it may take up to two weeks. As of 30 September 2026 it had not been marked complete when I last checked, so avoid concluding anything yet.
Which spam policy did Google target?
Google has not said. Its announcement names no policy, so any claim about the specific trigger is speculation. You can review all 16 policy categories in Google's spam policies documentation.
Is this a core update?
No. It is a spam update, a separate type of change to Google's spam detection systems. Post 332 explains how to tell which one hit you.
Should I change my site while it is rolling out?
Only for genuine bugs or security problems. Otherwise wait, so you can attribute changes cleanly.
How do I know if I was hit?
Look for a sitewide or template-wide drop in average position beginning on or after 24 September, confirmed in Search Console rather than a third-party tracker alone.
How long does recovery take?
Google's documentation says sites may improve if its systems learn "over a period of months" that they comply. Do not expect a bounce at the next update.
Do I need a reconsideration request?
Only if you have a manual action listed in Search Console. Algorithmic spam updates do not use that process according to Google's documentation as I read it.
Can AI-written content trigger this?
Google's scaled content abuse policy targets pages produced mainly to manipulate rankings, however they are made. The method is not the test; helpfulness and intent are.
CTA
If you want a second pair of eyes on a traffic change, I would be glad to help. I have 4+ years of marketing experience across organic growth, SEO and content strategy, including work with edtech and startup teams. You can see my work and reach me through the contact form at https://younusfardeen.in.
Verified as of 30 September 2026 against Google's Search Status Dashboard and Google's spam policies. This is general information, not legal or professional advice.