What Google confirmed about the September 2026 spam update
The primary record is short and unusually clear: Google lists a ranking incident called the September 2026 spam update, beginning September 24 at 9:15 a.m. Pacific. It says the change applies globally and to all languages. The rollout may take up to two weeks. That is an estimate, not a scheduled completion date.
| Question | Status on September 28 |
|---|---|
| Start | September 24, 9:15 a.m. PDT |
| Geographic and language reach | Global, all languages |
| Completion | Not announced; rollout may take up to two weeks |
| Specific targets or affected queries | Not disclosed |
| Impact size | No official percentage of sites or queries |
The dashboard names it a spam update, rather than a core update. Google's spam-update guidance explains that these releases improve its automated spam detection systems. It cites SpamBrain as one example of an AI-based spam prevention system, but the September notice does not say which system or classifier changed.
A statement that September specifically targets AI-written articles, paid links, affiliate sites, or a particular CMS goes beyond what Google has disclosed. Any such pattern should be presented as a hypothesis with data, not as the update's confirmed purpose.
Why another spam update matters now
This is the fourth confirmed spam update in 2026. Google's ranking update history lists earlier releases in March, June, and August. The August update ended August 21, so the September release began 34 days later. That close spacing makes a precise baseline especially important: a site that declined in August may still be recovering, while a new drop may have a separate cause.
Our August spam update guide covers the last rollout. Its most useful lesson carries forward: a matching date is an investigation lead, not a diagnosis. In our 12-property August case study, some apparent losses were already underway before that update started. September analysis should separate old declines from new breaks.
A fourth release does not mean each one penalizes more sites, or that Google has introduced four new rules. The official history records deployment dates and durations, not severity or the number of affected domains. It does mean that “Google updated” is now too broad an explanation for a chart: annotate each named rollout and test where the line actually changes.
The practical angle
For a September decline, first ask whether the affected URLs were stable after August 21. Then compare the September 24 onward pattern against those same URLs' earlier trend. That simple separation can prevent an expensive cleanup aimed at the wrong event.
How to diagnose a traffic drop during the rollout
Google's own traffic drop guide recommends comparing periods and drilling into queries, pages, countries, devices, and search appearances. Use that framework before assuming a spam classifier caused the movement. Save an export now so the original pattern remains visible after edits and later ranking changes.
1. Verify the loss in two datasets
In Search Console, check web Search clicks and impressions for September 24 onward, then compare with analytics organic landing-page sessions. A clicks-only fall with stable impressions can have a different explanation from a broad impressions collapse. Exclude partial recent days before drawing conclusions. If both sources disagree, investigate measurement and attribution first.
2. Find the first real break
Mark September 24 at the rollout start, then look back through August and early September. Did the same URLs begin falling before the update? Are you seeing the usual weekly pattern or a seasonal query decline? Compare like weekdays and, where relevant, the previous year. A site-wide chart can hide one high-traffic page or brand term driving the entire change.
3. Group the affected URLs
Export the pages with the largest click and impression losses. Group them by directory, template, publishing method, and purpose. Compare each affected group with a similar stable group. A decline concentrated in thousands of near-identical city pages suggests a different investigation from a decline across a handful of original guides. Check queries and countries before labeling either one spam.
4. Rule out technical and security causes
Check server availability, robots.txt, accidental noindex tags, canonicals, redirects, and page indexing. Inspect representative URLs rather than every URL at once. Google also recommends its Security Issues and Manual Actions reports. A visible manual action requires direct remediation, but an empty report does not rule out automated spam detection. Our Technical SEO Audit can help catch page-level problems; Search Console remains the source for Google's own indexing and action reports.
5. Match evidence to a written policy
Only after the pattern is clear should you compare the affected URLs with Google's spam policies. Record the exact policy and examples that fit, the URLs inspected, and the evidence. “Thin” or “AI” is not a sufficiently precise diagnosis. If no policy match exists, keep monitoring and investigate other causes rather than forcing an update story onto the data.
Spam policies worth checking, without guessing what Google changed
The September announcement does not prioritize a particular abuse category. The following are existing Google policies that a site owner can inspect when the affected page group gives a reason to do so. They are an audit menu, not a claim about this rollout's target.
Scaled content abuse
Many pages created mainly to manipulate rankings, with little original value. Check whether large batches answer distinct user needs with verifiable information, or simply swap locations, products, or phrases.
Doorway abuse
Similar pages built to capture close query variants and funnel people to the same destination. Inspect regional, service, and comparison templates for genuine differences and useful final answers.
Site reputation abuse
Third-party pages placed on an established host mainly to gain that host's ranking advantage. Review ownership, editorial input, purpose, and whether the section serves the host's audience.
Link spam and deceptive pages
Paid or automated links created for ranking credit, cloaking, misleading functionality, and hidden content each have specific policy definitions. Investigate them when a link campaign or page behavior supplies evidence.
Google's generative AI content guidance explicitly allows AI to help research and structure original work. It flags using AI to produce many pages without added value as a possible scaled content abuse violation. The same standard applies to human-written bulk pages. If a page gives readers an original, accurate answer, the mere presence of AI in the workflow is not a diagnosis.
What to do now and after the update finishes
During the rollout: Capture a clean baseline, check the dashboard for completion, and fix obvious outages or confirmed policy violations. Keep a change log with dates and affected URL groups. Avoid rewriting a whole site because of a few volatile days. If the loss is real, sample the pages people actually reached and evaluate what they delivered.
After completion: Compare stable post-rollout data with a comparable pre-update period. Focus on persistent page-group patterns, not isolated keyword positions. Review the Page indexing and URL Inspection reports for crawl and index problems. If you find policy violations, remove the underlying production pattern: stop generating low-value variants, improve or remove affected pages, fix deceptive functionality, and document the changes.
A Helpful Content Checker can organize an editorial review of surviving pages. It cannot identify a Google penalty or prove that an automated spam system acted. Use human review to verify first-hand evidence, accuracy, distinct value, and whether the page fulfills its search promise.
Google's spam-update guidance says changes may help after its systems learn over months that a site complies with policy. There is no guaranteed quick recovery date. Google also notes a specific exception for link spam: when it removes the ranking benefit of spammy links, cleaning those links does not restore the lost artificial benefit.
A simple September update log
- Record the September 24 start and the eventual completion date from the dashboard.
- Export clicks, impressions, queries, and URLs for each affected page group.
- Note technical releases, migrations, content launches, and tracking changes in the same window.
- For each suspected policy issue, save example URLs, the policy language, the fix, and its deployment date.
- Recheck the same cohorts after the rollout and again as Google recrawls the site.
Frequently asked questions
Primary sources and related reading
- Google Search Status Dashboard: September 2026 spam update — official start, reach, and rollout status.
- Google Search spam updates and your site — what spam updates mean and what recovery can involve.
- Google Search spam policies — the actual policy definitions.
- Google's traffic drop guide — how to segment and compare performance data.
- Google's generative AI content guidance — the distinction between AI assistance and scaled abuse.
- June 2026 spam update and August 2026 spam update — context for the year's earlier releases.