Google announced its September 2026 spam update on September 24, 2026, and said the rollout could take up to two weeks. Google has not named which spam policies it emphasized. For a small-business website, the practical response is to check your site against Google's published spam policies, fix real problems, and wait for the rollout to finish before judging results.
What is a Google spam update, and why does it matter to a small business?
A spam update is a change to the automated systems Google uses to find and demote pages that break its spam policies. It is different from a core update, which reassesses overall quality. Most small-business websites that follow the policies will not notice one, but a few legitimate sites get caught, and the fastest way to know which group you are in is to look at your own data.
What did Google actually say about the September 2026 update?
Google announced the update on September 24, 2026, said it applies globally across all languages, and said the rollout may take up to two weeks. It did not say which spam policies it emphasized and gave no site-specific advice beyond its general documentation.
Outside observers reported large ranking swings from September 25 through September 27, with some analysts pointing to sites publishing large volumes of AI-generated or programmatically generated pages. Treat that as early observation, not confirmed fact. It is consistent with Google's own policy on scaled content abuse, which describes generating many pages without adding value for users, no matter how they are created.
Because the rollout can last two weeks, rankings may keep moving until early October. We recommend waiting about a week after it finishes before judging any change in your traffic.
What Are the Key Takeaways From the September 2026 Spam Update?
- Announced: September 24, 2026, global, up to two weeks to complete.
- Confirmed by Google: the dates and scope only, not the specific targets.
- Your job now: check your site against the spam policies, fix real problems, and hold off on sweeping changes until it settles.
- Recovery: Google says improvement can take months and is not guaranteed.
How do you check whether your website was affected?
- Open Search Console and go to Performance. Set the date range to compare the 14 days before September 24 with the 14 days after, using the same days of the week.
- Look at the pattern. A drop across many pages that starts September 25 or 26 fits an update. One page falling, or a drop that began earlier, usually has a different cause.
- Check the Pages report under Indexing to see whether pages left the index or were never indexed.
- Check Security issues and Manual actions. A manual action is separate from an algorithmic update and comes with a message in Search Console.
- Write down the numbers now. You need a clear before picture to judge what changes later.
What Is the 10-Point Spam Check for Your Own Website?
These map to Google's published spam policies. Most small sites will pass most of them. The ones you fail are your to-do list.
- Pages that only swap the town name. If you have separate pages for several cities that share nearly identical text, Google may treat them as doorway or scaled content. Each page needs facts that are true only for that place, or the pages should be combined.
- Thin pages with no real answer. A page a customer cannot act on, with a few sentences and no price, process, photos or contact path, adds nothing. Improve it, merge it into a stronger page, or remove it.
- Text published without review. Generated text that nobody with real knowledge checked tends to be generic and sometimes wrong. Have someone who knows the service confirm every claim, price and detail.
- Keyword stuffing. Repeating the same phrase awkwardly in headings, footers or alt text reads as manipulation. Write for the customer and use the phrase where it fits naturally.
- Bought or artificial links. Paid link packages, link swaps at scale and comment links are spam link patterns. Do not add more, and consider whether old ones are still helping you.
- Hidden text or links. Text matched to the background color, or links tucked out of sight, break the policy. Old themes and plugins sometimes leave these behind, so check your footer and page source.
- Hacked or injected content. Look in Search Console under Security issues and Manual actions, and search Google for site:yourdomain.com with words like pharmacy or casino. Unfamiliar pages are a sign of a break-in.
- Spam in comments, reviews and forms. Unmoderated comments or profile pages full of links count against you. Turn on moderation, or turn the feature off if you do not use it.
- Redirect tricks and old domains. Redirects should send people where they expect to go. If you bought an old domain and repurposed it, review that history carefully.
- Content you cannot defend. For every page, ask what a customer learns there that they could not learn elsewhere. If the honest answer is nothing, that page is your biggest risk.
What should you fix now, and what should you leave alone?
| Situation | Do now | Wait until the rollout ends |
|---|---|---|
| Hacked or injected pages | Clean up and secure the site immediately | Nothing to wait for |
| Spam comments and forms | Turn on moderation and remove spam | Nothing to wait for |
| Near-duplicate location pages | List them and plan what to merge or improve | Carry out large merges and removals |
| Thin pages | Improve the ones a customer would actually use | Decide on removals after checking indexing and clicks |
| Traffic drop of unknown cause | Record the numbers and dates | Judge the result about a week after it finishes |
Small, careful fixes beat a panic rewrite. Useful, specific pages and honest updates are safer than bulk output.
Where does a professional check help?
If you would rather not read Search Console yourself, our free AI Visibility Report shows how your business appears in local and AI search today, and our local search plans include ongoing monitoring and fixes. We cannot promise rankings, and nobody honestly can, but we can tell you what is wrong and what is worth fixing first.
Sources
- Google Search spam policies
- Google: recovering from spam updates
- Search Engine Land: Google releases September 2026 spam update
Questions people ask about the spam update
What did Google confirm about the September 2026 spam update?
Google announced it on September 24, 2026, said it applies globally across languages, and said the rollout may take up to two weeks. It pointed site owners to its general spam-update documentation and did not name the specific policies it emphasized. Anything beyond that, including who gained or lost, comes from outside observers and is unconfirmed.
Was my small-business website hit by the spam update?
Open Google Search Console, choose Performance, and compare clicks and impressions before and after September 24 with the same day-of-week range. A sharp drop beginning September 25 or 26 that hits many pages at once is consistent with an update. A drop on one page, or one that started earlier, usually has another cause such as a page change, seasonality, or a lost listing. Wait until the rollout finishes before drawing conclusions.
Do I need to remove AI-written content?
Google's policy does not ban AI-assisted writing. It targets producing many pages without adding value for users, however they are made. Pages that are accurate, specific to your business, reviewed by a person who knows the subject, and genuinely useful can stay. Pages that repeat the same text with a town name swapped, or that say nothing a customer can act on, are the ones to rewrite, merge or remove.
How long does recovery take after a spam update?
Google says sites may improve over a period of months after they fix problems, and that recovery is not guaranteed. The automated systems need time to recognize changes. If a drop came from spammy links, Google says any ranking benefit those links gave is lost and cannot be regained, so the goal there is to stop relying on them, not to win them back.
Should I make big changes to my site right now?
Fix clear problems you find, such as hacked content, spam comments or an obviously thin page, because those are worth fixing at any time. Avoid sweeping rewrites, mass deletions or URL changes while the rollout is still running. Changing many things at once makes it hard to tell what helped, and rankings can keep moving until the rollout ends.
Does this affect my Google Business Profile in the map pack?
A web spam update changes how web pages rank in Google Search, not the map pack directly. Profile rankings depend on relevance, distance and prominence, and profile performance numbers also lag by a few days. Your website still matters to the map pack indirectly, because it is the page your profile links to and part of how Google judges you. Judge maps and web results separately.
