Google finished the September 2026 spam update rollout on 8 October, after 13 days and 16 hours, making it the longest spam update in 2026 so far. If you saw changes to your enquiries or rankings during that time, here is what went on and what to do about it.

What happened

Google released the update on 24 September 2026 and finished it on 8 October. Google’s Search Status Dashboard logs it from 09:15 PDT on 24 September to 01:00 PDT on 8 October, a total of 13 days and 16 hours. It was global and in every language.

Google called it a ‘normal spam update’ and didn’t say what tactics it was aiming at, or whether it affected more searches than other updates. Third-party rank trackers saw the biggest shifts on 25–27 September, 30 September and 4–6 October. Google hasn’t said those periods are connected.

Why this one felt different

It is Google’s fourth spam update of 2026, after March, June, and August. Those three each finished in less than three days, and March took 19 hours. September required almost Google’s two-week window that was hinted at.

Per some SEOs, the results felt more like a core update. That is how they perceived it, and Google has not made an official statement calling it that. Since the impacts arrived in waves, a report of one day won’t tell you very much.

What Google is watching

The spam policies Google has set for itself enumerate the tactics that can cause a page to rank lower or not appear at all. Google hasn’t revealed, which ones this update targeted, but a few commonly referenced for local business sites are:

Keyword stuffing. Google’s own evidence uses blocks of text listing the cities and regions a page hopes to rank for.
Doorway pages. Multiple pages or sites claiming to target distinct towns but actually sending visitors to the same page.
Scaled content abuse. Pages that serve no real purpose other than to generate rankings; AI machine-writing that gives no value would be an example.
Link spam. Paid links that pass ranking credit, automated link building and low-quality directory links.
Hacked content and user generated spam. Spam injected through security holes or comment forms, often without the site owner realizing.
Thin affiliate and scraped content. Pages copied from merchants or other sites with no added value.

Simply put: a page about a service you truly offer in a town is OK. 10 near identical pages that just change the town name is not. Google says these policies also include attempts to manipulate AI responses in Search.

What you can do now

The roll-out has concluded so your numbers are now a safe baseline. Do these in order:

Compare your figures. In Google Search Console, compare clicks and impressions from the weeks before September 24, with those after October 8.
Audit your location pages. Each town or service page should contain unique and informative content. Combine or create new ones for any that only.
Evaluate AI-generated material. Maintain what would be useful to a genuine customer, reword, or eliminate sites that were created in large quantities.
Audit your backlinks. Identify paid links, link exchanges and the low quality directories you have submitted to and be sure to avoid them.
Secure your site. Refresh WordPress core and plugins, search for pages or links you don’t recognise, and ensure comment and form spam filtering are enabled.
Be on the lookout for tricks. Text on a page that is invisible, links to pages that look different but contain the same content, and pages that only Google can see are all against the rules.

If your traffic dropped

First, verify the timing matches. If the selloff started 25–27 September, 30 September or 4–6 October then it agrees with the update but it isn’t a smoking gun. Seasonality and tracking issues appear identical.

Since a spam update is algorithmic, there won’t be any message from Google. To be sure that it isn’t a manual review, check the Manual actions report in Search Console.

The official spam update article by Google states any site that violates their guidelines may be demoted in search rankings or removed entirely. Anything you can do to fix the issue may help, mostly if Google’s algorithms recognize it over the next months, but it’ll be a slow process. Link spam though is an exception– Google will drop the negative effects of the spam links but you can’t get the boost that they had given you back.

What’s next

Google says it will be conducting intermittent refreshes of the update, so the story may not be over. There’s speculation in the industry that a core update is not far behind, but that’s just speculation: spam updates are not a good indicator of one, and I haven’t seen one announced yet [as of 13 October 2026].

The practical lesson is that spam updates have become a regular fixture, with four in 2026 alone. A site built on genuinely useful pages is far less exposed than one relying on shortcuts.

How Codex can help

Codex Web Development create bespoke WordPress websites and provide SEO and lead generative services for businesses in Kent and throughout the rest of the UK.

A website shouldn’t stop for a small update, but if your traffic moved after that update and you’d like another pair of eyes on your site, contact us through the contact page. We’ll review your Search Console data and your pages and tell you what we see.

Google September 2026 Spam Update: What happened to your website