Google's September 2026 Spam Update: What a Publisher Checks This Week, Screen by Screen

If your Google traffic moved at the end of September and you are trying to work out whether the September 2026 spam update caused it, you are asking the right question at the right time. This update did not land in one day like the three before it. Google said it could take up to two weeks, and tracking tools picked up separate waves of movement on different days, so a drop you saw on one date and a recovery you saw on another may both belong to it, or neither may.

This guide is the procedural version. It covers what Google has actually said, how to tell a spam-update effect from the ordinary volatility every publisher lives with, three checks you can run in Search Console today, and what Google says the path back looks like if you were affected. It is deliberately calm, because the most expensive mistakes during a rollout are the fast ones.

What has Google actually said about the September 2026 spam update?

Less than the headlines suggest, so start with the exact words. Google's Search Status Dashboard says it "Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete." The entry is dated September 24 at 9:15 a.m. Pacific, and a second entry on October 8 reads "The rollout was complete as of October 8, 2026," with the end time recorded as 1:00 a.m. Pacific. That makes the September update roughly 13 and a half days long, the longest of the year's four.

Google has not said what this update targets. It is the fourth spam update of 2026, after March, June and August, and Search Engine Journal recorded that those three finished in 19 hours 30 minutes, 2 days 1 hour, and 2 days 16 hours. When asked whether the two-week estimate for September was a typo, Google's John Mueller replied that it was likely to take longer than some of the previous ones.

That longer window changed what the movement looked like. Search Engine Roundtable's Barry Schwartz tracked a first wave of impact from September 25 to 27, a second around September 30 and October 1, and what he called a likely final phase between October 4 and 6. Those dates are your map when you open Search Console.

One more thing worth separating out. The same week, Search Engine Journal reported on SAFE, a Google research system that uses AI agents to investigate synthetic content and coordinated spam networks. Google has not said SAFE powers this search update, so treat any article that connects the two as speculation.

How do you tell a spam-update hit from ordinary volatility?

Most traffic swings in a given fortnight are not a spam update, which is the first thing to hold onto. Publisher search traffic is already falling for structural reasons. Chartbeat's 2026 Publisher Playbook, reported by Search Engine Journal, found Google Search referrals to publishers down 40.2 percent year over year from July 2025 to July 2026, after a 21.9 percent fall the year before. A slow decline that started months ago is a different problem with a different fix.

A spam-update effect tends to have three fingerprints. It lines up with the wave dates rather than drifting across the month. It concentrates on particular pages or page types rather than spreading evenly across the site. And it shows up as lost positions and impressions, not only as fewer clicks, because a spam action changes whether and where your pages appear.

That last point matters more in 2026 than it used to. Clicks can fall while your position holds, because AI answers on the results page absorb the question. A University of Pennsylvania and Northeastern University study, reported by Search Engine Journal, found that people using AI Mode clicked through to other websites 18.8 percentage points less often than people using regular Google Search. If your positions are steady and only clicks dropped, the spam update is probably not your story.

A spam update changes whether and where your pages appear. If your positions held and only clicks fell, look at AI answers before you blame the update.

The three Search Console checks to run today

You need about thirty minutes and owner access to the site in Google Search Console. Run them in this order, because the first one can end the investigation.

Check 1: Security and Manual Actions, then Manual actions

Open Search Console, go to Security and Manual Actions in the left menu, and open Manual actions. If the report says no issues detected, a human reviewer has not penalized your site, and whatever you are seeing comes from automated systems, which is what a spam update is. If there is a manual action listed, that is a different situation with a formal process, covered in the recovery section below.

Check 2: Performance, Search results, with a date comparison

Open Performance, then Search results, and use the date filter's Compare tab. Set the two periods side by side: September 10 to 23, the two weeks before the release, against September 24 to October 7, the two weeks of the rollout. Once you have that read, add a third look at the days after October 8 to see where your pages settled. Turn on all four metrics, clicks, impressions, average CTR and average position, then switch the chart to daily and look at whether the changes land on the wave dates, September 25 to 27, September 30 to October 1, and October 4 to 6.

Then read the four metrics together rather than clicks alone. Impressions and position falling together on wave dates is the spam-update fingerprint. Clicks and CTR falling while position holds points to AI answers or changing search behavior. Everything drifting down gently since summer points to the structural decline, not this update.

Check 3: Which pages moved, and what they have in common

Stay in the same comparison and open the Pages tab, then sort by the difference in clicks. Look at the twenty pages that lost the most and ask what they share. A spam-update effect usually clusters on a pattern, so you are looking for a template or a content type, not a single unlucky article.

Hold that pattern up against Google's spam policies, especially scaled content abuse, which Google defines as "when many pages are generated for the primary purpose of manipulating search rankings and not helping users." Its examples include "Using generative AI tools or other similar tools to generate many pages without adding value for users" and "Stitching or combining content from different web pages without adding value." If the pages that fell are mass-produced rewrites of trending stories, programmatic location or keyword pages, or thin AI drafts that never got an editor, you have found the likely cause. Our breakdown of the scaled content trap explains why that pattern can pull down a whole site, and the August 2026 spam update guide walks through the full list of practices Google calls spam.

While you are there, open the Discover report separately. Discover traffic swings on its own schedule and publishers reported a volatile Discover during the second wave, so check its dates against the waves before you assume both channels moved for the same reason. Our Google Discover monetization guide covers how to read that report.

What does Google say to do if the update affected you?

Google's own guidance is short. Its spam updates documentation says, "Sites that see a change after a spam update should review our spam policies to ensure they are complying with those." It adds that "Making changes may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies."

Two consequences follow, and both are uncomfortable. There is no reconsideration request for an algorithmic spam effect. Google defines a reconsideration request as "a request to have Google review your site after you fix problems identified in a manual action or security issues notification," so if Check 1 came back empty, there is nothing to file. And the path back is measured in months, because Google's systems have to see sustained compliance, not a burst of edits.

If Check 1 did find a manual action, the process is different and more direct. You fix the specific issue the report names, then select Request Review on the Manual actions report and wait for Google's response in Search Console.

What to do now that the rollout has finished

The rollout is over, which changes the advice. While it was running, the instinct to act fast cost money, and it still does if you act on the wrong evidence. Do not delete or noindex large parts of the site on the strength of a few days of movement, because a page that dipped during the rollout may have settled back since, and deleted pages do not come back with their history. Do not rush out a burst of new pages to make up the traffic, which can look like exactly the scaled pattern this update targets. And do not read one tool's volatility chart as a verdict on your site.

Now you can see where your pages settled. Note the dates and the pages from the three checks, compare the post-October 8 numbers with the pre-update baseline, and make cleanup decisions only for the pages that stayed down and match a pattern in Google's spam policies. Keep publishing at your normal pace and standard while you do.

The system that makes the next update a non-event

Every publisher who got through this update calmly did the same thing before it arrived. They knew their baseline. The operator version of that is not complicated. Pull Search Console data every day through the Search Analytics API by date and page, store it, and compare each page against its own trailing weeks, so a page that drops well below its normal range gets flagged the morning it happens rather than three weeks later. You can wire that in n8n with an HTTP node on a schedule, build it as a Make scenario, or run a small scheduled script against the API directly. The tool is a preference. The point is that continuous analysis turns an algorithm update from a mystery into a dated, page-level fact you can act on.

The second half is not being a single-channel business. A publisher whose revenue depends entirely on Google search inherits every update Google ships. One that also earns through Facebook, content syndication and AI search can watch a rollout finish before reacting, because no single channel decides the month. Our piece on publisher diversification when a platform drops you covers why that matters, and this guide is the how for the Google half of it.

Where to go from here

Being found is now a two-part job. Ranking in Google search is one part, and being the source AI answers cite is the other, the discipline called Generative Engine Optimization, or GEO, often referred to as AI search optimization. The GEO Authority System at $499 runs an LLM Visibility Evaluation on your site and gives you the playbook and distribution flow to build authority that both Google and AI answers recognize. It does not promise rankings or a recovery from any update, and nobody honest can. What it gives you is a clear read of where your site stands and a system for building the kind of authority that spam updates are designed to protect.

Frequently asked questions

When did the Google September 2026 spam update start and finish?

Google released it on September 24, 2026 at 9:15 a.m. Pacific and said the rollout may take up to two weeks. Google marked the rollout complete on October 8, 2026, about 13 and a half days after release. Search Engine Roundtable tracked waves of movement around September 25 to 27, September 30 to October 1, and October 4 to 6.

What did the September 2026 spam update target?

Google has not said. Its announcement states only that the update applies globally and to all languages. Treat any claim that it targeted a specific tactic, or that it is powered by Google's SAFE research system, as unconfirmed.

How do I know if the spam update hit my site?

Check Search Console's Manual actions report first. Then compare Performance data for September 10 to 23 against September 24 to October 7, look for impression and position drops that land on the wave dates, and see whether the losses cluster on a type of page. Fewer clicks with steady positions usually points to AI answers, not the spam update.

Can I file a reconsideration request after a spam update?

Only if Search Console shows a manual action or security issue. Google defines a reconsideration request as a review after fixing problems identified in a manual action or security issues notification. For an algorithmic effect, Google's guidance is to review its spam policies and comply, and says systems may recognize the improvement over a period of months.

Should I delete pages that lost traffic during the rollout?

Not on the strength of a few days of movement. The rollout finished on October 8, so first compare the weeks after it with your pre-update baseline. Pages that recovered need nothing. For pages that stayed down, check them against Google's spam policies before deciding, because deleted pages lose their history.

Key takeaways

• Google released the September 2026 spam update on September 24 with a rollout window of up to two weeks, against under three days for each of the three earlier 2026 spam updates.
• Google has not said what it targets, and has not linked it to its SAFE research system.
• Movement came in waves, around September 25 to 27, September 30 to October 1, and October 4 to 6, so date your changes against those windows.
• Run three checks: Manual actions, a Performance date comparison across all four metrics, and a page-level look for a shared pattern measured against Google's spam policies.
• There is no reconsideration request for an algorithmic spam effect. Google says compliance can help over a period of months.
• The rollout finished October 8. Judge cleanup on where pages settled afterward, never mass-delete, and build a daily page-level baseline so the next update is a dated fact, not a mystery.

Sources

• Google Search Status Dashboard, September 2026 spam update: https://status.search.google.com/incidents/XhUDXP7A67iHCD2kmbVu
• Google Search Central, Google Search spam updates (updated December 2025): https://developers.google.com/search/docs/appearance/spam-updates
• Google Search Central, Spam policies for Google web search: https://developers.google.com/search/docs/essentials/spam-policies
• Google Search Console Help, Reconsideration requests: https://support.google.com/webmasters/answer/35843
• Google Search Console Help, Manual actions report: https://support.google.com/webmasters/answer/9044175
• Search Engine Journal, Google Rolls Out September 2026 Spam Update Globally: https://www.searchenginejournal.com/google-september-2026-spam-update/590828/
• Semrush, Google releases September 2026 spam update, September 29, 2026: https://www.semrush.com/blog/google-spam-update-september-2026/
• Search Engine Roundtable, Phase Two Of The Google September 2026 Spam Update Hits On 9/30: https://www.seroundtable.com/google-september-2026-spam-update-two-42209.html
• Search Engine Roundtable, Final Phase Of Google September 2026 Spam Update Rollout Oct 4 to 6: https://www.seroundtable.com/google-september-2026-spam-update-phase-3-42239.html
• Search Engine Journal, SEO Pulse, September 26, 2026 (Chartbeat figures and the AI Mode click-through study): https://www.searchenginejournal.com/seo-pulse-google-spam-update-image-search-data/590882/
• Search Engine Journal, Google has deployed a new AI spam detector called SAFE, September 25, 2026: https://www.searchenginejournal.com/google-has-deployed-a-new-ai-spam-detector-called-safe/590918/