Google September 2026 Spam Update: Did It Hit Your Site?

On 24 March 2026, this site’s Google impressions went from 28 to 99 in a day. Google started the March 2026 spam update at noon Pacific that same day, so the easy reading is that the update lifted a clean site. Two days earlier I had pushed eight new posts and a batch of template changes, and three days later Google started a core update that ran through the week I compare against. I cannot separate the new posts from the spam update, and a chart of your own traffic during the Google September 2026 spam update carries the same problem if anything else changed in the same weeks.

The update began on 24 September, and Google says it may take up to two weeks, so “did it hit my site?” stays open into October. A change has to pass four checks, in order, before I would pin it on the update: it falls inside Google’s rollout window with no other update overlapping, it falls outside the site’s noise band, nothing I shipped explains it, and the pages that fell share a practice Google’s spam policies name. None of the three case studies further down gets past the second check: March overlaps a core update, June’s +16.4% sits inside this site’s noise band, and August barely moved, at -2.5%. The band is wide because this site moves a lot on its own: from January to August 2026, the median week-over-week change in its impressions was 26.5%.

What Is the Google September 2026 Spam Update?

The Google September 2026 spam update is an improvement to Google’s automated spam-detection systems that began rolling out on 24 September 2026 at 09:15 Pacific. It applies globally and to all languages, and Google says the rollout may take up to two weeks. Google has not said which spam policy or tactic it targets.

	What Google has published
Start	24 September 2026, 09:15 PDT, on the Search Status Dashboard
Scope	”applies globally and to all languages”
Rollout estimate	”may take up to two weeks to complete”
Target	Not named. Google’s spam updates documentation ties these updates to its automated detection, including SpamBrain, “our AI-based spam-prevention system”
Length	John Mueller confirmed to Search Engine Roundtable: “Yes, it’s likely to take longer than some of the previous ones.”

The rollout estimate is what changed. Google announced the March, June and August 2026 spam updates with the same line, “The rollout may take a few days to complete.” The announcement for September, the fourth spam update of 2026, says “up to two weeks” instead.

How the September Rollout Compares With 2026’s Other Updates

Google’s ranking incident history lists these rollouts since December 2025:

Update	Started	Rollout length	Type
December 2025 core update	11 Dec 2025	18 days, 2 hours	Core
February 2026 Discover update	5 Feb 2026	21 days, 17 hours	Discover
March 2026 spam update	24 Mar 2026	19 hours, 30 minutes	Spam
March 2026 core update	27 Mar 2026	12 days, 4 hours	Core
May 2026 core update	21 May 2026	11 days, 21 hours	Core
June 2026 spam update	24 Jun 2026	2 days, 1 hour	Spam
August 2026 spam update	18 Aug 2026	2 days, 16 hours	Spam
September 2026 spam update	24 Sep 2026	Up to two weeks, in progress	Spam

What the table means if you are reading your own charts this month:

• A two-week spam rollout is long by 2026 standards and short next to the only spam update of 2025. The August 2025 spam update ran for 26 days, 15 hours.
• Two weeks from 24 September is 8 October. Until Google posts a completion note, every day you compare sits inside the rollout.
• Updates stack. If another update starts while this one runs or days after it ends, as the March 2026 core update did after March’s spam update, site-level data cannot tell you which one moved you.

Spam Update vs Core Update: Which One Moved Your Traffic?

A spam update changes the systems that enforce Google’s spam policies. A core update, in the words of Google’s core updates documentation, is one of the “significant, broad changes to our search algorithms and systems” it makes several times a year.

	Spam update	Core update
What changes	Automated spam detection, including SpamBrain	Broad ranking systems
Sites that should look first	Sites using a practice named in the spam policies	Any site
Released in 2026	4: March, June, August, September	2: March, May
2026 rollout length	19 hours 30 minutes to 2 days 16 hours; September up to two weeks	11 days 21 hours to 12 days 4 hours
Google’s guidance afterwards	Review the spam policies; fixes may help “over a period of months”	Wait “at least a full week after a core update completes” before analyzing in Search Console

The spam policies are specific. Google names 16 spam policies, among them scaled content abuse, expired domain abuse, the site reputation policy, link spam, cloaking and doorway abuse, and says “Sites that violate our policies may rank lower in results or not appear in results at all.” If nothing on your site resembles one of those policies, a spam update is an unlikely explanation for a drop.

The same page says Google detects violations “both through automated systems and, as needed, human review that can result in a manual action.” A spam update changes the automated side. The Manual Actions report shows the human side, so check it, and treat an empty report as ruling out a manual action only.

Did the September 2026 Spam Update Hit Your Site?

Search Console data cannot prove that a spam update caused a change. The most it can do is leave the update as the strongest remaining suspect, and only after Google marks the rollout complete and the change passes four checks. Run them in order and stop at the first one a change fails.

Check 1: The Change Falls Inside the Rollout Window

Search Console and the dashboard both count days in Pacific time. The Search Console API reference defines its dates “in PT time (UTC - 7:00/8:00)”, and the dashboard posts times in US Pacific, so 24 September in one is 24 September in the other.

• Start the window on 24 September and end it on the date in Google’s completion note.
• Check that no other confirmed update ran at any point from 17 September, the first day of the week before, to the last day of the week after the rollout. If one did, the change fails this check.
• Treat 23 September as outside the window. Search Engine Roundtable reported ranking volatility “starting around September 23rd (maybe the 22nd)”, before Google started the update, so a drop on the 23rd needs another explanation.
• Wait a full week after completion, then compare that week with the week before 24 September. Google gives that advice for core updates, and I use the same wait here for the same reason: the comparison needs seven days from after the rollout to set against seven days from before it.

Check 2: The Change Falls Outside Your Noise Band

Every site moves from week to week with no update running, and on a site that is growing or shrinking, weeks further apart usually differ more than adjacent weeks do. So build the band from past weeks the same distance apart as the two you will compare:

1. In the Search Console Performance report, set a custom date range of 4 June to 23 September, sixteen seven-day weeks ending the day before the rollout began. To test one section, add a Page filter for its path, such as /blog/, first. Click Export and open the Chart sheet, which has one row per day.
2. Average the daily impressions for each seven-day week. You can do this part now.
3. When Google posts its completion note, count the days from 17 September, the first day of the week before, to the first day of the week after the rollout, divide by seven and ignore the remainder. A finish on 8 October puts the week after at 9 to 15 October, 22 days on, which makes three weeks; a finish on 3 October makes two. Then work out how much each of your sixteen weeks rose or fell against the week that many weeks earlier. With three, that is week 4 against week 1, week 5 against week 2 and so on up to week 16 against week 13; with two, week 3 against week 1 up to week 16 against week 14.
4. Cross out every pair of weeks that spans a spam or core update, meaning any day of that update falls between the first day of the earlier week and the last day of the later one. Your sixteen weeks include the June spam update (24 to 26 June) and the August one (18 to 21 August), and any reaction your site had to them belongs in checks 3 and 4, not in the band. The lowest and highest of the changes you have left are your noise band. With a three-week gap, only four of the thirteen pairs in this range survive, so treat that band as rough.
5. Compare the week after the rollout with the week before 24 September. A change inside the band is too small to tell apart from normal movement at the level you measured.

The distance matters on this site. Across the 33 week-over-week changes from January to August 2026, the median move was 26.5% up or down. Between weeks three apart, the median was 61.1%.

The band is a filter, and a two-week rollout weakens it. On a small site that grew fast, like this one, weeks far apart differ for ordinary reasons. I took every comparison in 2026 with no spam or core update running during either week or between them and built its band this way from the sixteen weeks before it: between adjacent weeks, 3 of 21 changes still fell outside the band, and between weeks three apart, 10 of 14 did. The band can also be wide enough to hide a real hit: before the March window it ran from -61.4% to +181.7% even with the update-spanning pairs dropped. So a change inside the band is not evidence, and a change outside it only earns checks 3 and 4. If part of your site uses a practice the spam policies name, run the test on that section as well as the site total, because a whole-site number can hide one section falling.

Use impressions unless your clicks run into the dozens a day. Across the first 243 days of 2026 this site earned 163,673 impressions and 180 clicks, about five clicks a week, which is too few to read one week at a time. Keyword positions in rank trackers move from day to day as well, which is why I read SEO rankings as a trend over weeks rather than a single day’s number.

Check 3: Nothing You Shipped Explains It

List everything that changed on your site from a week before the window to a week after it: new posts, a redesign, URL or redirect changes, template edits, a migration, robots or noindex changes. My list comes from the push history of the git repository this site deploys from, which dates each change to the minute. A CMS revision log or a release calendar does the same job.

Each item on that list is a rival explanation. Google’s guide to debugging traffic drops lists “Technical issues” and “Site moves and migrations” as causes alongside “Algorithmic update”. If you changed URLs that week, check what your redirects actually return: the redirects my host sends on this site come back as 308, not 301, and I only found that out by testing.

Check 4: The Pages That Fell Share a Spam-Policy Practice

A change that survives the first three checks still needs a pattern. In the Performance report, use the Compare option in the date filter to set the week after the rollout against the week before it, open the Pages tab, and put the pages that lost the most impressions at the top. Read what those URLs have in common, then hold it against the policy definitions:

• many pages generated mainly to rank rather than to help anyone (scaled content abuse)
• an expired domain bought and repurposed mainly to rank on its old reputation, filled with content of little or no value to users (expired domain abuse)
• third-party pages published to borrow your site’s ranking signals (site reputation policy)
• different content shown to Googlebot than to people, meant to manipulate rankings and mislead users (cloaking)

If the losing pages were drafted with AI at volume, the line that matters is Google’s position on automation, which I quote in my AI SEO strategy. A loss you cannot tie to any named practice sends you back to the other causes on Google’s list.

Three 2026 Spam Updates Run Through the Four Checks

I ran the checks on this site’s own Search Console export for the three 2026 spam updates that have finished. The export runs to 31 August 2026. “Before” is the seven days before each start date and “after” is the seven days after each completion date. Each after week began 9 to 11 days after its before week, which the step 3 rule rounds down to one week, so each band compares adjacent weeks across the sixteen weeks before the window. Averages are rounded to whole impressions and the percentages come from the unrounded averages, so March’s 107 over 38 works out at +181.6% if you redo it from the table.

Spam update	Avg daily impressions, before / during / after	Before to after	Noise band, all pairs	Noise band, pairs spanning a spam or core update dropped	Avg position, before to after
March 2026 (24 to 25 Mar)	38 / 99 / 107	+181.3%	-61.4% to +837.8%	-61.4% to +181.7%	37.1 to 31.2
June 2026 (24 to 26 Jun)	574 / 543 / 668	+16.4%	-47.3% to +296.8%	-47.3% to +117.6%	24.2 to 25.8
August 2026 (18 to 21 Aug)	1,620 / 1,746 / 1,579	-2.5%	-49.1% to +98.5%	-49.1% to +69.3%	22.8 to 24.1

What I shipped from a week before each window to a week after it, from the push history:

Spam update	Week before	During	Week after
March 2026	22 Mar: 8 new posts, edits to 22 posts, blog template and site header changes, a new reading-list page	Nothing	Nothing
June 2026	20 to 22 Jun: 13 new posts and a site redesign	25 Jun: 13 noindex demo pages, then 5 new posts plus internal links in 72 posts	27 Jun to 3 Jul: 11 new posts, edits to 18 posts, a blog template change, new demo pages and redirects for moved ones
August 2026	16 Aug: 5 new posts and edits to 10 posts	Nothing	26 to 27 Aug: 10 new posts, SEO edits to 105 posts, a site-wide redesign, a new logo

Read against the checks:

• March fails check 1: the March core update began on 27 March, so six of the seven days in my week after sat inside a second rollout. It would have failed check 2 as well, since +181.3% sits inside a band that runs to +181.7% even with the pairs spanning a spam or core update dropped, and check 3, because eight new posts and a template change went live two days before the start.
• June fails check 2, at +16.4% against a band of -47.3% to +117.6%. It would have failed check 3 anyway: I pushed five posts and internal-link edits to 72 existing posts in the middle of the rollout.
• August had nothing shipped during the rollout, and it fails check 2: -2.5% against a band of -49.1% to +69.3%. It would have failed check 3 too, because on 26 August, inside the week after, I pushed 10 new posts, SEO edits to 105 posts and a site-wide redesign. Cut the week after at 25 August, before those pushes, and the change is -10.2%, still inside the band.

Measured in impressions, the largest moves of the year sat outside every spam window. In percentage terms the 24 March jump ranks second among one-day rises, because it started from 28. Daily impressions went from 254 to 948 on 12 April, the day after a push that added three posts and the site’s category pages, and four days after the March core update finished. They went from 591 to 1,421 on 4 July, the day after a push of five posts, with no confirmed update running between 26 June and 18 August. The biggest fall since the site moved to its current build began after a peak on 25 April, the day I pushed five posts, with new tool pages live the next morning. No update was on the dashboard between 8 April and 21 May, and the fall’s steepest step came on 5 May, when daily impressions dropped from 1,129 to 746. The seven days from 5 May averaged 673 a day, against 1,323 for the seven days before.

I put new posts live 22 times between 12 March and 31 August, counting the first push of this build, and on 75 of the 173 days in that stretch new posts had gone live that day or in the three days before it. A push just before a jump is a candidate cause to rule out, and so is an update window next to one.

This is one site at an Ahrefs Domain Rating of 14, tested at site level on impressions only, and on my own reading of the spam policies it uses none of the practices they name, so a null result was the likely outcome.

What to Do If the September 2026 Spam Update Hit You

If a change passes all four checks:

• Fix or remove the practice on the pages that fell, starting with the group that lost the most. Google says changes “may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies”, so plan in months.
• If the practice was buying or trading links, expect less back. After a link spam update, which Google describes as “an update that specifically deals with link spam”, it warns that “making changes might not generate an improvement”. Google has not described the September update that way.
• Check the Security issues report as well. Hacked content is one of the practices the spam policies name, and Search Console reports hacks there along with malware and social engineering.
• Run a trigger-based SEO audit scoped to the pages that fell.

Hold changes that are not urgent until the week after the rollout is over, because anything you ship before then joins your check 3 list. If the change from the week before 24 September to that week lands inside your noise band, the September 2026 spam update did nothing you can see at site level. The sixteen weekly averages can be done today: export 4 June to 23 September before you open a single rollout day.