Google's September 2026 spam update finished rolling out on 8 October 2026, after roughly 13 days and 16 hours, according to the Google Search Status Dashboard. Google called it "a normal spam update" covering all languages and locations, named no specific policy, and said link spam was not the target. If your traffic moved between 24 September and 8 October, you can now measure the change properly, and the work this week is diagnosis, not panic. (As of 9 October 2026.)
Key Takeaways
- The rollout started on 24 September 2026 and Google's dashboard marks it complete on 8 October 2026; it was the longest spam update since August 2025.
- Google named no policy, gave no share-of-queries figure, and said periodic refreshes will follow, so treat this as the start of a monitoring window, not a closed case.
- Algorithmic demotions arrive with no notice. Manual actions appear in Search Console. Check both before you change anything.
- Recovery from a spam demotion can take months, according to Google's own repeated guidance, so plan a quarter, not a weekend.
- The useful comparison is 24 Sep to 8 Oct against a clean baseline, split by page type, not a single site-wide line.
What actually happened
The timeline, and a discrepancy worth flagging
Google's Search Status Dashboard lists the September 2026 spam update as a ranking incident that began on 24 September 2026 at 09:15 PDT and was completed on 8 October at 01:37 PDT, a duration the dashboard summary gives as 13 days, 16 hours. You can read the incident itself on the Search Status Dashboard and the summary view.
One thing to be honest about: the sources do not agree on every detail. Search Engine Roundtable's launch article puts the start at about 12:00 pm ET on 24 September (the original report), which matches the dashboard (09:15 PDT is 12:15 pm ET). But Roundtable's daily recap of 8 October says the update "began September 28," which conflicts with its own article and the dashboard (recap, 8 October). I would go with the dashboard, which is Google's own record, and treat 28 September as a slip. PPC Land's completion report also notes that the dashboard header reads 01:00 while the completion note is stamped 01:37 PDT, and that Roundtable logged the finish at 4:37 am ET (PPC Land). None of that changes your analysis window by more than hours.
What Google said, and what it did not
According to the reporting, Google Search Central described it as a "normal spam update" on LinkedIn, rolling out "for all languages and locations." Google named no targeted policy, did not announce new policies with it, and did not say what share of queries it affected. John Mueller, as quoted by Search Engine Roundtable, said it was "likely to take longer than some of the previous ones." Google's documentation line is the one that matters for your risk: "Sites that violate our policies may rank lower in results or not appear in results at all."
PPC Land adds useful context: the March 2026 spam update finished in about 19.5 hours, June in about 48 hours, and August in around three days, so a two-week run is unusual for 2026 (PPC Land's rollout report). Length is not a reliable predictor of impact, though. PPC Land notes that SISTRIX measured small changes during the 27-day August 2025 cycle, so a long rollout does not automatically mean a bigger blast radius.
What it means for a marketer
The spam policies are the checklist
Because Google named no policy, your reference document is the full spam policies page. It lists cloaking, doorway abuse, expired domain abuse, hacked content, hidden text and link abuse, keyword stuffing, link spam, machine-generated traffic, malicious practices, misleading functionality, scaled content abuse, scraping, the site reputation policy, sneaky redirects, thin affiliation and user-generated spam. The page also states that Google uses automated systems and, where needed, human review, and that human review can lead to a manual action.
If you need the plain-English basics first, I wrote a primer on what a Google spam update is and a definition of scaled content abuse with examples. For what the first half of this rollout looked like, see the phase two note from 30 September.
Spam update versus manual action
These are two different mechanisms and they are easy to confuse.
| Algorithmic spam update | Manual action | |
|---|---|---|
| Notice | None | Shown in Search Console, Manual actions report |
| Scope | Whole site or sections, automatically | Whole site or URL patterns, set by a human reviewer |
| Fix path | Fix the cause, wait for systems to reassess | Fix everything listed, then file a reconsideration request |
| Typical timing | Google says recovery can take months | Reviews usually take days to weeks, per Google's help page |
The manual-action row comes from Google's Manual actions report help page. I cover the evidence for rising manual actions in a separate post this week.
What to do this week
Step 1: Pull a clean before-and-after
Take the window 24 September to 8 October and compare it with the two weeks before 24 September, same weekdays, in Search Console Performance. PPC Land observed elevated volatility from around 22 September, which Barry Schwartz said was not the update, so I would use 10 to 23 September as the baseline to be safe. Segment by page type (blog, category, product, programmatic or templated pages, author pages), by country, and by query type (brand versus non-brand). A site-wide line hides the pattern. A spam demotion usually concentrates on one template or one folder.
Step 2: Check Search Console for notices
Open the Manual actions report and the message center. A green check mark means no manual action applies. If there is one, the report lists the affected URL patterns, and Google's guidance is blunt that fixing "just some pages will not earn you a partial return to search results." Do not file a reconsideration request until every issue is fixed on every affected page.
Step 3: Do not react to a dip on day one
Rollouts end, then things settle. Wait several days before deciding that a drop is permanent, and avoid mass deletions that are driven by anxiety. If you see a clear fall on a specific template, audit that template against the policy list. My post-update content audit method walks through the sorting I use: keep, improve, merge, or remove.
Step 4: Tag your own risk honestly
Ask these questions about each section of your site:
- Was it produced at volume with little human review or original input?
- Does it exist mainly to capture search traffic rather than help a reader?
- Does it host third-party content you do not supervise (guest posts, user comments, coupon or directory sections)?
- Does any page use author names, headshots or credentials that are not real?
- Are there old pages with expired-domain or doorway-style patterns?
If you answer yes to any, that section is your first audit target. Note that Google's people-first content page was updated on 5 October 2026 and now carries warnings on deceptive authorship; I cover that in a separate post on fake author bios.
What comes next
Expect refreshes
PPC Land's completion report says Google stated that periodic refreshes will follow, and that recovery can take many months. Practically, that means a site hit now may not see movement until a later refresh, and that a site cleaned up now should keep a record of what was changed and when. I would keep a change log: date, URL group, action taken, reason.
Watch for a core update, but do not assume one
Some commentators speculate that a core update may follow. That is speculation: Google has not announced one in the material I reviewed, and I would not plan around it. Plan around what you can control, which is policy compliance and page quality.
What not to do
- Do not disavow links by reflex. Google said link spam was not the target of this update.
- Do not publish a flood of new AI-written pages to "make up" lost traffic. That is the exact pattern the scaled content policy is aimed at.
- Do not rewrite author bios or page copy mid-diagnosis without logging it, or you will never know what worked.
What I would tell a client
I have spent 4+ years in organic growth and SEO, and the pattern after every spam update is the same: the sites that recover fastest are the ones that already knew which of their pages were low-value and had a written plan to deal with them. The ones that suffer most are those who find out from a screenshot in a Slack thread. Build the habit of a monthly template-level review, and a spam update becomes a weather report rather than an emergency.
Sources used and what I could not verify
I read the Search Status Dashboard incident and summary pages, Search Engine Roundtable's launch article and daily recap, two PPC Land reports, Google's spam policies and Manual actions help page. I did not independently measure ranking volatility, and I have not seen Google state a share of affected queries. The claim that manual actions are rising is anecdotal and is covered in the next post.
FAQ
When did the September 2026 spam update finish?
Google's Search Status Dashboard lists it as complete on 8 October 2026, with the completion note stamped 01:37 PDT. The run started on 24 September at 09:15 PDT, about 13 days and 16 hours earlier.
Was this a link spam update?
Google said the update was not aimed at link spam and named no particular policy. It described it as a normal spam update that applies to all languages and locations.
How do I know if I was hit?
An algorithmic demotion gives no notice, so you detect it in data: a sustained drop concentrated on certain page types between 24 September and 8 October. A manual action, by contrast, appears in the Manual actions report in Search Console.
Should I delete low-quality pages now?
Not in a panic. First identify which template or folder lost visibility, then decide per section whether to improve, merge or remove. Log every change so you can attribute any recovery.
How long does recovery take?
Google has repeatedly said recovery can take months. Do not expect movement the week after the rollout ends, and expect that later refreshes are when improvements are most likely to be reassessed.
Why did this update take two weeks when others took a couple of days?
Google has not explained it. Reports note that March, June and August 2026 spam updates ran for hours to a few days. Gary Illyes reportedly described typical spam rollouts as one to two days, though I could not verify that directly.
Does Google's AI Overviews spam policy apply too?
PPC Land reports that spam policies were extended to AI Overviews and AI Mode on 15 May 2026. I did not verify this against a Google primary page, so check Google's own documentation before relying on it.
Can I request reconsideration after an algorithmic demotion?
No. Reconsideration requests apply to manual actions. For algorithmic changes you fix the underlying issues and wait for systems to reassess.
Did the people-first content page change?
Google's page shows a last-updated date of 5 October 2026 and includes language on deceptive authorship and four quality attributes. Marie Haynes first reported on the change on 2 October.
Let's work on your organic growth
If you want a second pair of eyes on your Search Console data after this update, take a look at my work at younusfardeen.in and send me a note through the contact form. I bring 4+ years of marketing experience across SEO, AEO and content strategy, and I will tell you plainly whether what you are seeing is a spam demotion, a seasonal dip or something else entirely.