Google started the September 2026 spam update on Thursday, September 24, at 9:15 a.m. Pacific. The Search Status Dashboard entry is two sentences long: “Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete.” As of Monday, September 28, there’s no completion post, so the update is still rolling out.
Two things set this one apart from the three spam updates Google has already run this year. It arrived 37 days after the August update started, the shortest gap between spam updates on Google’s dashboard. And Google gave it a rollout window of up to two weeks, where March, June, and August were each announced as “a few days.” We covered the August 2026 spam update in detail, including what spam updates are and how they differ from core updates, so this post sticks to what’s new.
If your site publishes its own content, doesn’t rent out sections of your domain, and hasn’t bought links or generated pages in bulk to catch searches, this update is unlikely to be about you. Expect it to run until around October 8, and Google’s past estimates suggest it could go a day or so longer. Save a baseline from your Search Console reports now, check Manual Actions and Security Issues, and hold off on changes until the dashboard says the rollout is complete.
What Google said about the September 2026 spam update
The official record is short. Beyond the dashboard, Google’s LinkedIn announcement, as quoted by Search Engine Roundtable, called it “a normal spam update, and it will roll out for all languages and locations.” When Barry Schwartz checked with John Mueller that the two-week window wasn’t a typo, Mueller confirmed it: “Yes, it’s likely to take longer than some of the previous ones.”
Schwartz added that the update “does not target link spam” and that Google “would not tell me what percentage of queries or searches were impacted.” Search Engine Journal put it plainly: “Google hasn’t said whether this update targets a specific spam policy or tactic.” There’s no Search Central blog post about it, and Google’s spam updates documentation still shows a last-updated date of December 10, 2025.
One policy page has changed since our August post, though not because of this update. On August 28, Google revised its spam policies to rename the site reputation section “Site reputation policy” and change how it’s enforced in the European Economic Area (EEA). Per Google’s Search Central announcement, “Beginning August 30, manual actions applied under our site reputation policy will have a different effect for those searching in the EEA than outside of it.” Inside the EEA, affected sections may be treated as separate from the main site instead of getting a manual action. Everywhere else, the manual action still applies to the affected part of the site.
Four spam updates in six months
The 2026 record, from Google’s ranking release history, all times Pacific:
| Update | Started | Finished | Google’s estimate | Rollout time | Days since previous spam update started |
|---|---|---|---|---|---|
| March 2026 spam update | March 24 | March 25 | “a few days” | 19 hours, 30 minutes | 210 |
| June 2026 spam update | June 24 | June 26 | “a few days” | 2 days, 1 hour | 92 |
| August 2026 spam update | August 18 | August 21 | “a few days” | 2 days, 16 hours | 55 |
| September 2026 spam update | September 24 | In progress | “up to two weeks” | Not yet known | 37 |
In August I noted that the 55 days between June and August was the shortest start-to-start gap on a dashboard that goes back to November 2021. September beat it by 18 days. Counting from the end of the August rollout, the gap was only 34 days. For context, 2025 had one spam update all year.
Nothing else is rolling out alongside it. The September spam update is the only open incident on the ranking dashboard, and the last core update, May’s, finished on June 2. With no confirmed update overlapping it, a drop is easier to date.
What “up to two weeks” has meant before
Google doesn’t explain its rollout estimates, and Mueller’s answer only confirms the window is real. The dashboard’s history shows how Google’s “up to” estimates have played out:
| Update | Google’s estimate | Actual rollout |
|---|---|---|
| March 2024 spam update | “up 2 weeks” (sic) | 14 days, 21 hours |
| June 2024 spam update | “up to 1 week” | 7 days, 1 hour |
| December 2024 spam update | “up to 1 week” | 7 days, 2 hours |
| March 2026 core update | “up to 2 weeks” | 12 days, 4 hours |
| May 2026 core update | “up to 2 weeks” | 11 days, 21 hours |
In practice, “up to” has meant close to the ceiling, and the spam updates on this list ran slightly past it. Two weeks from the September 24 start is October 8. I’d plan around that date and not be surprised by October 9 or 10.
This isn’t the longest spam rollout on record. The August 2025 spam update was announced as taking “a few weeks” and ran 26 days, 15 hours. What’s new is that September’s is the longest estimate Google has given for a spam update in 2026, and the first two-week estimate since March 2024.
Don’t read a target into the duration. A longer rollout could mean a bigger change, a slower deployment, or something else. Google hasn’t said which.
Early signs, and why to hold them loosely
Rank trackers moved hard after the announcement. Schwartz wrote on Monday that the first stage “seems to have been felt in a big way starting Friday, September 25th, with even more movement on Saturday, September 26th,” with that first stage ending Sunday. Glenn Gabe, quoted in the same piece, said: “I’m seeing big drops across a number of sites.” According to that report, he saw the drops across verticals and countries, including among sites heavy on AI-generated or programmatic pages. That’s one analyst’s early read, not a Google statement about targets.
Three things make this month’s early reads harder to trust than usual.
The tools are seeing less. Since around September 13, Google appears to have been blocking scrapers and rank trackers more aggressively, per Search Engine Roundtable. Nozzle reported being able to retrieve about 80% less data, and Sistrix confirmed slower collection. Volatility charts from this period rest on thinner samples.
September was already noisy. Search Engine Roundtable logged an unconfirmed ranking shift around September 4 that reversed for some sites on September 13, more movement around September 15, and volatility on September 23 and 24, before the announcement. Schwartz’s write-up says that pre-announcement movement was not the spam update. A drop that started before 9:15 a.m. Pacific on September 24 most likely has some other cause.
The AI-spam research isn’t confirmed as part of this. Search Engine Journal reported on a Google research paper describing SAFE, short for Scaled Abuse Forensics Examiner, a system for detecting AI-generated spam at scale, and suggested it might be part of the September update. Google hasn’t connected SAFE to Search or to this update. Treat it as background reading.
Two Search Console changes that aren’t the update
A new search type filter arrived the same day. On September 24, Google announced multimodal reporting in Search Console, covering searches with Lens, Circle to Search, image uploads, and Chrome’s “Search this image.” It’s reached through “the new multimodal search type filter in the performance reports.” If you compare periods on either side of September 24, make sure the same search type is selected for both, or you may be comparing different sets of searches.
August’s logging bug is fixed. Our August post said a logging error in the Generative AI performance report was ongoing. Google’s data anomalies page now dates it to August 13 through 17 and says: “Missing data for this period has been restored. The Performance report now shows complete metrics.” The same page lists a separate Discover logging error on August 13 and no September anomalies as of today. If your Generative AI report for mid-August looks different than it did a month ago, that’s why.
Where small businesses get caught
The full policy breakdown is in our August post. In short, these are the policies legitimate small businesses and startups tend to run into, usually because a vendor sold them the practice:
- Scaled content abuse: hundreds of near-identical service or blog pages, whether written by people or generated with AI. Google’s policy covers “using generative AI tools or other similar tools to generate many pages without adding value for users.” Our guide to building an AI content system that doesn’t read like one covers the version that holds up.
- Doorway pages: templated “[service] in [town]” pages that say the same thing with the town name swapped. We covered city and service-area pages in our local SEO guide for contractors.
- Site reputation: a partner’s coupon section, sponsored blog, or unrelated subfolder living on your domain to borrow its rankings.
- Link spam: paid links that pass ranking credit, and keyword-rich links placed in guest posts or press releases. Schwartz reports September isn’t aimed at link spam, but it’s still a policy.
- User-generated spam and hacked content: spam added through comment forms, forums, or an unpatched plugin, often without the owner knowing.
- Expired domain abuse: buying an aged domain for its authority and pointing thin content at it.
A calendar for the next three weeks
Now through about October 8: save a baseline and leave the site alone. Export your Performance report data so you have a baseline. Because of the unconfirmed movement since September 4, a stretch from late August is a cleaner “before” than mid-September. Open the Manual Actions and Security Issues reports now. A spam update doesn’t produce a manual action, but a clean Manual Actions report rules one out, and a security flag can mean someone else put content on your site.
When the dashboard posts completion: wait a week. Google’s advice after core updates is to wait “at least a full week” after a rollout completes before analyzing Search Console, and the same logic applies here. Rankings move during a rollout, and where a page sits in the first few days isn’t necessarily where it settles.
Mid-October onward: look for concentration. Google’s traffic-drop debugging guide is still the checklist: compare like periods and look for “patterns in the pages affected.” For a spam update, the pattern that matters is concentration: the city pages, a third-party section, or a batch of generated posts, while the rest of the site holds.
If a pattern points at a policy, fix the practice and expect to wait. Google’s documentation says changes “may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies.” Don’t disavow links in a panic. Google’s disavow guidance reserves it for sites with “a considerable number of spammy, artificial, or low-quality links” that have caused or likely will cause a manual action. And don’t delete pages that are still earning traffic.
Questions site owners keep asking
When will the September 2026 spam update finish? Google says the rollout “may take up to two weeks,” which points to around October 8. Its past “up to” estimates have landed close to the limit and sometimes a little past it. The dashboard’s completion post is the only confirmation that counts.
Why is the September 2026 spam update taking two weeks? Google hasn’t said. John Mueller confirmed the longer window wasn’t a typo and said it’s “likely to take longer than some of the previous ones.” Any claim about what the duration reveals about the update’s targets goes beyond what Google has said.
What does the September 2026 spam update target? Google hasn’t named a policy. It called this “a normal spam update,” and Search Engine Roundtable reports it doesn’t target link spam. Treat claims that it targets AI content or a specific policy as speculation until Google says otherwise.
Is the September spam update a core update? No. A spam update improves Google’s automated spam detection against its published spam policies. A core update is a broad reassessment of content. No core update is running right now; the last one finished June 2.
My traffic dropped before September 24. Is that the spam update? Probably not. The update started at 9:15 a.m. Pacific on September 24. Trackers showed unconfirmed movement around September 4, September 15, and September 23 to 24, and Search Engine Roundtable says the pre-announcement volatility wasn’t the spam update.
How long does recovery from a spam update take? Months. Google says changes may help once its systems “learn over a period of months” that a site complies with its spam policies. If Google’s systems have discounted bought links, the ranking benefit those links gave doesn’t come back.
Should I disavow links after this update? Usually not. Google recommends disavowing only when you have a considerable number of spammy links that have caused, or are likely to cause, a manual action. It says it can usually work out which links to trust on its own.
What to do this week
If your site is clean, save a baseline, check the two Search Console reports above, and put October 8 on the calendar. If you’ve been sold any of the practices listed above, use the next two weeks to find out how much of your traffic depends on them, before the numbers show you.
Four spam updates in six months is a fast pace, but the audit that holds up hasn’t changed: pages written for a real reader, links nobody paid for, and a domain that only carries content you’d put your name on. Our SEO service starts with that audit, and if generated pages are part of your content process, our AI content systems work keeps a person in the loop.
