Google’s September 2026 spam update: What it targets and how to check if you’re affected

If your rankings moved this week, you are probably wondering whether Google’s latest spam update is the reason. On September 24, 2026, Google released the September 2026 spam update, its fourth spam-related release of the year, and said the rollout could take up to two weeks. That is a longer window than the March, June, or August updates gave.

This guide covers what the update actually does, how it stacks up against Google’s earlier 2026 spam updates, and the specific steps to check your own Search Console data before you assume the worst. You will also get a plain language rundown of the spam policies Google enforces, so you can rule issues in or out with confidence.

What Google’s September 2026 spam update actually changed

Google’s September 2026 spam update began rolling out globally on September 24 at 9:15 a.m. Pacific time, according to Google’s Search Status Dashboard. Google called it a normal spam update, meaning no new spam policies came with it. The one unusual detail is timing. Google said the rollout may take up to two weeks, far longer than its three previous 2026 spam updates.

That two-week window matters because it changes how you should read your own data. A one-day ranking swing does not tell you much when the rollout itself is still active for up to fourteen days.

How the September update compares to Google’s other 2026 spam updates

This is the fourth spam update Google has confirmed in 2026, and it is far slower than the other three.

Search Engine Journal confirmed that “Google hasn’t provided additional details about what this update targets.” Treat the longer timeline as a scheduling detail, not proof of severity.

Spam update or core update: the difference that matters

A spam update enforces specific policy violations, things like cloaking or link schemes. A core update reassesses content quality and relevance across the entire web, with no single fixable cause. If your site drops during a spam update, the fix is usually narrower and faster to identify than a core update dip.

“When a client’s rankings move, the first question we ask is whether the cause is systemic or isolated. A spam update usually points to one policy. A core update means rethinking the whole page.” Derick Do, Co-Founder and Chief Product Officer

What Google’s spam policies actually cover

Google’s spam policies list sixteen named categories of manipulation, from cloaking and link spam to scaled content abuse and site reputation abuse. Google has not said which category this update targets, so the more useful move is checking your own site against the full list rather than guessing at one cause.

The sixteen categories Google enforces

Google’s own spam policies cover:

• Cloaking, showing different content to users and to Google
• Doorway abuse, funneling visitors through near-duplicate pages
• Expired domain abuse, repurposing a lapsed domain to borrow its old rankings
• Hacked content, spam placed on a site through a security flaw
• Hidden text and link abuse, content built to be read by Google but not by people
• Keyword stuffing, unnatural repetition meant to game rankings
• Link spam, buying, exchanging, or automating links to manipulate rankings
• Machine-generated traffic, automated queries sent to Google
• Malicious practices, including malware and unwanted software
• Misleading functionality, promising a tool or service that never delivers
• Scaled content abuse, publishing large volumes of low-value pages, including through generative AI tools
• Scraping, republishing other sites’ content with no original value added
• Site reputation abuse, hosting third-party content mainly to borrow a domain’s ranking strength
• Sneaky redirects, sending users somewhere different than what Google indexed
• Thin affiliation, copying product data and reviews with no original input
• User-generated spam, spammy content added through comments, forums, or file uploads

Where AI-generated content fits in

Scaled content abuse is the category worth watching if your team uses AI in content production. The policy does not ban AI-assisted writing. It targets pages published in bulk with no editorial value, whether a person or a tool created them.

“A two-step editorial and fact-check pass on every AI-assisted draft is what keeps content out of the scaled content abuse category, not the tool used to draft it.” Derick Do, Co-Founder and Chief Product Officer

How to check if your site was affected

The fastest way to know if the September 2026 spam update touched your site is to open Search Console, compare clicks and impressions from before and after September 24, and break the numbers down by page and query instead of looking at one overall total. A same-day dip during an active two-week rollout is not proof of anything on its own.

“Sitewide averages hide the real story. Look at query clusters first, then decide whether to act or wait out the two-week window.” Tanner Medina, Co-Founder and Chief Growth Officer

A five-step Search Console check

1. Set the Performance report date range to cover before and after September 24.
2. Compare clicks and impressions by query, not just the site total.
3. Segment by page type. Check whether drops cluster on thin, templated, or heavily AI-assisted pages versus original ones.
4. Check the Pages report for a rise in Crawled, not indexed or Discovered, not indexed.
5. Hold off on major conclusions until the two-week rollout window closes.

A common mistake to avoid

Search Engine Roundtable noted unusual ranking volatility on September 23 and 24, just before Google announced the update, and cautioned that timing alone does not prove a connection. Barry Schwartz, the site’s editor, put it simply: “This only impacts sites that spam, but there may be collateral damage.” Do not assume every visible ranking change traces back to this specific update.

What to do if you find a real drop

If your Search Console data shows a genuine, sustained decline tied to specific pages or query types, match what you find to one of Google’s named spam policies before making changes. Fixing the wrong thing wastes time. Google’s own documentation says recovery is not immediate, even after you fix the underlying issue.

A simple four-step recovery framework

1. Identify the specific policy your findings match, using the list above rather than a guess.
2. Fix the pattern across the whole site, not just a handful of example pages.
3. Document what changed and when, so you can measure the effect later.
4. Expect a multi-month window before Google’s systems recognize the fix, according to Google’s spam update documentation.

When a drop probably is not this update

If the affected pages were already thin or templated before September 24, or the decline started well before the rollout, look at other causes first. A core update or a technical issue is more likely the source than a spam update that just began.

Turning this update into a stronger SEO habit, not a one-time scare

Spam updates like this one are becoming a regular part of Google’s calendar, with four confirmed in 2026 alone. Treating each rollout as an emergency wastes time you could spend on real optimization work. Building a standing habit, a quick Search Console check whenever Google announces a rollout, tells you fast whether to act or wait.

“A two-week rollout only feels risky if you are not already checking Search Console on a set schedule. Teams that treat this as routine monitoring catch real problems in days, not weeks.” Tanner Medina, Co-Founder and Chief Growth Officer

Launchcodex reviews client Search Console data against every announced Google update as a standard part of ongoing SEO work, so a two-week rollout window does not turn into two weeks of guessing.

FAQ

Is the September 2026 spam update the same as a core update?

No. A spam update enforces specific policy violations. A core update reassesses content quality and relevance broadly, with no single fixable cause.

How long will the rollout take?

Google says up to two weeks from the September 24 start, longer than any of the year’s three earlier spam updates.

Will a compliant site see any ranking changes during this update?

It is possible. Some fluctuation during an active rollout does not automatically mean a policy violation. Confirm with your own page and query-level data before reacting.

What should I do if my traffic dropped this week?

Check Search Console by page and query first. If the decline predates September 24, treat it as a separate issue. If it lines up with the rollout and matches a real policy pattern, fix the underlying cause and expect a multi-month recovery window.