Google's September 2026 Spam Update: What Is Confirmed and What Site Owners Should Do

On September 24, 2026, Google released a new spam update for Google Search. The company logged it on its Search Status Dashboard at 09:15 US/Pacific time and said it applies globally and to all languages, with a rollout that may take up to two weeks.

If your business depends on organic search for leads or sales, this is the kind of event that can move traffic without anything changing on your side. It is also the kind of event that produces a lot of guesswork online. This article sticks to what Google has published, and then sets out how a business with a website, and anyone paying for SEO services, can respond sensibly.

One point to hold on to from the start: when we checked the dashboard on October 4, 2026, the entry was not yet marked complete. Rankings can keep shifting until Google says the rollout has finished.

What Google has confirmed about the September 2026 spam update

The dashboard entry is short. Google states that it released the September 2026 spam update, that the update applies globally and to all languages, and that the rollout may take up to two weeks. That is the full extent of the announcement on the incident page. A two-week window from September 24 runs to about October 8, 2026, although Google only says "may take up to" and could finish sooner.

Because the update is global and covers all languages, it applies equally to sites serving the United States, the United Kingdom, or both. There is no regional carve-out mentioned in the entry.

What Google has not said

Google has not said which types of spam this update focuses on, how many sites or queries are affected, or whether it relates to any specific policy. Any article that tells you the update "targets" a particular tactic is offering an opinion, not a confirmed fact. We are not going to guess here.

What a spam update is, in Google's words

Google explains the concept in its spam updates documentation. It describes spam updates as notable improvements to its automated systems for detecting search spam. The same page names SpamBrain as its AI-based spam-prevention system and says Google improves it from time to time so it gets better at spotting spam and catching new types.

This is different from a core update. A core update is a broad change to how Google's ranking systems assess content in general. A spam update is specifically about content and behavior that breaks Google's spam policies. The Status Dashboard lists both kinds; the most recent core update on its summary page is the May 2026 core update, which began on May 21, 2026.

How this update fits into 2026 so far

The dashboard summary lists three earlier spam updates this year: one starting March 24, 2026, one starting June 24, 2026, and one starting August 18, 2026. Google's entry for the August 2026 spam update shows it was released on August 18 and complete as of August 21. The March and June updates are each listed with durations of roughly one to two days.

Against that background, the stated window for September stands out. A rollout that "may take up to two weeks" is longer than the earlier spam updates listed for 2026. Google does not explain why, and a longer rollout does not by itself tell you anything about how large the effects are. What it does mean in practice is a longer period in which your numbers may be unsettled.

Policies that have changed this year

A spam update enforces the policies that already exist, so it is worth knowing that Google has edited those policies several times in 2026. Its documentation changelog records the following:

• On April 13, 2026, Google added a section to its malicious practices policy covering "back button hijacking", where a site manipulates browser history so visitors cannot easily go back.
• On May 15, 2026, Google clarified that its spam policies also apply to generative AI responses in Google Search.
• On August 28, 2026, Google updated its site reputation policy, adjusting how it is enforced in the European Economic Area.

Google has not linked the September update to any of these changes. They are listed here because they describe the current rulebook, which also includes long-standing policies on cloaking, doorway pages, hidden text, keyword stuffing, link spam, scaled content abuse, scraping, thin affiliate content and hacked content.

What it means for your business

For most legitimate businesses, a spam update passes without incident. If your site publishes its own content, earns links naturally and does not use tricks to manipulate rankings, there is usually nothing to fix. A small change in traffic during the rollout is not evidence of a penalty.

The risk tends to sit in things an owner may not know about. Examples include links bought on your behalf by a past marketing supplier, large batches of near-identical location or product pages published to capture searches, third-party content hosted on your domain, comment or forum spam left unmoderated, or a plugin or ad script that interferes with the browser back button. Compromised sites are another common source: Google's spam policies list hacked content, and a site owner is often the last to notice it.

Google's policy page says sites that violate its spam policies may rank lower in results or not appear at all. So the commercial question is simple. If you lost visibility during this rollout, you need to find out whether any part of your site or its promotion falls under those policies.

What to do next

First, wait for the rollout to finish before drawing conclusions. Check the Status Dashboard entry for a completion note. Comparing traffic mid-rollout produces misleading answers.

Second, once it is complete, compare organic performance in Search Console for the period after September 24 with an equivalent period before it. Look at which pages and sections changed, not just the site total. Check the Manual actions and Security issues reports as well; they cover different problems from an automated spam update, but a hacked site or a manual action needs attention regardless.

Third, if there is a clear drop, read the spam policies against your own site honestly. A short checklist helps:

• Do you know where your backlinks came from, and were any paid for?
• Are there pages created mainly to rank rather than to help a visitor?
• Is any content on your domain produced or controlled by a third party?
• Does any script alter redirects, browser history or what search engines see compared with users?

How long recovery takes

Google's spam updates documentation is direct about timing. It says that making changes may help a site improve if its automated systems learn, over a period of months, that the site complies with the spam policies. There is no form to submit and no quick reset for an automated spam system.

The same page makes a specific point about link spam. When Google's systems remove the effect of spammy links, any ranking benefit those links gave the site is lost, and Google says that benefit cannot be regained. In other words, cleaning up bad links stops further harm but does not bring back positions that were built on them. That is worth knowing before anyone promises you a fast recovery.

Conclusion

Google released the September 2026 spam update on September 24, 2026. It is global, covers all languages, and may take up to two weeks to roll out; as of October 4 it was still in progress. Google has not said what it focuses on. The sound response is to wait for completion, measure the change properly, and review your site against the published spam policies instead of reacting to speculation.

If the review turns up technical causes, such as injected content, problematic scripts or large sets of thin pages, those are development tasks as much as marketing ones. Entrant Technologies builds and maintains websites and web applications, and you can contact us if you want a second opinion on what you find.