Google September 2026 Spam Update: What Small Business Websites Should Check Now

Short answer: Google started rolling out the September 2026 spam update on 24 September 2026. Google said the rollout would take around two weeks, much longer than the usual one- or two-day spam update, and the Google Search Status Dashboard now shows it as complete, with a rollout of 13 days and 16 hours (finishing around 8 October 2026). If your Google traffic changed sharply since late September, this guide shows how to check whether the update is the cause and what to fix.

What We Know So Far

The phase dates come from monitoring tools and site owners, not from Google. Google has not said which specific kind of spam this update targets. Spam updates enforce Google’s published spam policies, so those policies are the best guide to what is at risk.

Who Is Most Likely to Be Affected

Spam updates are not a quality review of your whole business. They target specific practices. For small business and agency-built websites, these are the ones we most often find in audits:

• Scaled content abuse. Large numbers of pages produced mainly to rank, with little original value: mass AI-written blog posts, the same article reworded many times, or pages generated from a keyword list.
• Doorway pages. Near-identical “service in [city]” pages where only the city name changes, created for places the business does not really serve.
• Link spam. Bought links, link packages (“50 high-DA backlinks”), large-scale guest-post swaps and private blog networks.
• Site reputation abuse. Third-party content published on a trusted site mainly to borrow its rankings, such as unrelated sponsored “guides” or coupon sections.
• Expired domain abuse. Buying an old domain and filling it with unrelated content to use its history.
• Keyword stuffing and hidden text. Long lists of keywords or city names in footers, white text, or text hidden behind tabs only for search engines.
• Thin affiliate pages. Product or hosting “reviews” copied from the merchant with nothing added.

Some of these problems are often created by accident. In audits we have run this year, the most common ones were blog posts whose body had been pasted two or three times on the same page, dozens of near-duplicate posts on one topic, and keyword-swapped location pages. None of them were deliberate, but they look the same to an automated system.

How to Check Whether the Update Hit Your Site

1. Open Search Console → Performance → Search results. Compare 10–23 September with the days since 24 September. Then do the same for Discover if you have that report.
2. Look at the shape of the change. A sudden drop that begins during the rollout and hits many pages at once points to the update. A slow slide that started earlier usually has another cause, such as competition, seasonality or a technical problem.
3. Break it down by page. Use the Pages tab. If the losses are concentrated in one type of page (all city pages, all AI-written posts, all affiliate reviews), that page type is your likely problem.
4. Check Security & Manual actions. Spam updates are automated and do not appear there, but a manual action is a separate and more urgent issue.
5. Rule out technical causes. Check Pages (indexing), robots.txt and any recent site changes. Plenty of “update drops” turn out to be a broken redirect or an accidental noindex.

Our SEO audit checklist walks through these checks in more detail.

What to Do If You Were Hit

• Fix or remove the problem pages properly. Merge near-duplicate posts into one strong page and 301-redirect the rest. Rewrite or remove mass-produced content. Combine keyword-swapped city pages into one genuinely useful page unless you really serve each place.
• Clean up your own link building. Stop any paid link packages. Ask for removal of links you bought. Use the disavow tool only for links you created or paid for and cannot remove.
• Don’t panic-delete good content. Pages that genuinely help visitors are not the target. Mass deletion can make things worse.
• Be patient. Google says it can take months for improvements to be reflected, because its systems need time to see that a site now follows the policies. Recovery rarely happens the next week.

What Not to Do Now

• Don’t buy “recovery” link packages. More bought links make a link-spam problem worse.
• Don’t respond by publishing dozens of new AI-written posts to “replace” lost traffic.
• Don’t create new city pages to recover local rankings. For real local visibility, work on your Google Business Profile and local SEO instead.
• Don’t change URLs, titles and templates across the whole site at once. You won’t be able to tell what helped.

If You Weren’t Affected

Use the update as a reason to check your site anyway. The same policies apply after every update, and problems are cheaper to fix before a drop than after one. A good starting point is our technical SEO guide, and our link building guide covers links that are safe to earn.

Sources

• Google Search Status Dashboard: ranking incidents history
• Google Search Central: spam policies for Google web search
• Search Engine Roundtable: September 2026 spam update phase three (6 Oct 2026)

Frequently Asked Questions

When did the Google September 2026 spam update start?

Google’s Search Status Dashboard lists the September 2026 spam update as starting on 24 September 2026. Google told Search Engine Roundtable the rollout would take about two weeks, longer than the usual two-day spam update.

Is the September 2026 spam update finished?

Yes. The Search Status Dashboard lists a rollout duration of 13 days and 16 hours, so it finished around 8 October 2026. Compare your data from after that date with the weeks before 24 September.

How do I know if the spam update hit my site?

Compare Search Console performance for the two weeks before 24 September with the period after it, page by page. A sharp drop that starts during the rollout and affects many pages at once points to the update; a slow decline or a drop in only one page usually has another cause.

Will disavowing links fix a spam update drop?

Usually not. Spam updates mostly target how a site’s own content and links are produced. Google’s systems already ignore most spammy links pointing at you. Fix what is on your site first; use the disavow tool only if you built or bought links yourself and cannot remove them.

How long does recovery take after a spam update?

Google says improvements may take months to be reflected, because its systems need time to learn that a site now complies with the spam policies. Remove or fix the problem pages properly rather than waiting for the next update.