Short answer: Google's September 2026 spam update started on 24 September and finished on 8 October 2026, after about 13 days and 16 hours. If your traffic fell sharply in that window, compare Search Console data before and after, check for a manual action, and review your site against Google's spam policies. Recovery means removing the cause (spammy links, thin or scaled content, hacked pages) — and it can take months.

Last updated: 27 October 2026.

Google updates in 2026 at a glance

  • March 2026 spam update — about 19.5 hours
  • March 2026 core update — completed on 8 April 2026
  • May 2026 core update — started on 21 May 2026
  • June 2026 spam update — about 2 days
  • August 2026 spam update — about 2.5 days
  • September 2026 spam update — 24 September to 8 October 2026, the longest spam update this year

Google has not announced an October 2026 core update as of today. Check the Google Search Status Dashboard for the latest.

Spam update vs core update — what's the difference?

  • A core update re-evaluates how helpful and relevant pages are. A drop does not mean you did something wrong; other pages may simply be judged more useful.
  • A spam update improves Google's automated spam detection. A drop usually means Google found something that breaks its spam policies.

Google did not say exactly what the September 2026 spam update targeted. Its spam policies cover things like:

  • Link spam — buying links, link exchanges, private blog networks (PBNs)
  • Scaled content abuse — mass-produced pages (AI or human) made mainly to rank
  • Site reputation abuse — third-party content hosted to exploit a strong domain
  • Expired domain abuse — buying old domains to rank unrelated content
  • Hacked content, cloaking, sneaky redirects and doorway pages

How to check if your site was hit

1. Compare dates in Search Console

Open Performance in Google Search Console and compare 24 September – 8 October (and the two weeks after) with the two weeks before 24 September. A sharp, site-wide drop that starts during the rollout points to the spam update.

2. Check for a manual action

Go to Security & Manual actions → Manual actions. A manual action is a penalty from a human reviewer, separate from the automated update — and it tells you exactly what the problem is.

3. Check security issues

Under Security issues, look for hacked content or malware. Hacked sites often get spam pages injected — common on outdated WordPress or PHP sites.

4. Rule out other causes

  • Technical changes: a redesign, new URLs, robots.txt or noindex mistakes
  • Seasonality: compare with the same period last year
  • AI Overviews taking clicks — impressions stay but clicks fall. See AI Overviews & website traffic
  • Competitors improving their pages

5. Look at which pages dropped

If only certain sections fell — for example, hundreds of near-identical city pages or a guest-post section — those are likely the problem.

How to recover from a spam update

  • Stop buying links and leave link networks.
  • Export your backlinks from Search Console and look for paid, spammy or irrelevant links.
  • Remove what you can; use Google's disavow tool only for clearly harmful links you cannot remove.
  • Build links the right way — real mentions from relevant sites. See our link building service.

Step 2: Fix thin and scaled content

  • Merge or delete pages that say the same thing with a different keyword or city name.
  • Improve important pages with real experience, prices, photos and examples.
  • AI-written content is not banned — but unreviewed, mass-produced pages are a risk.

Step 3: Remove abuse and hacked pages

  • Remove third-party sections that have nothing to do with your business.
  • Scan for malware, delete injected pages, and update your CMS, plugins and PHP. Our PHP2Shell guide shows how to update PHP safely.

Step 4: Request a review (only for manual actions)

If you have a manual action, fix the issue and submit a reconsideration request explaining what you changed. For algorithmic drops there is no request — Google re-evaluates your site over time.

Step 5: Be patient and keep improving

Google has said recovery from spam updates can take many months, because its systems need to see that the improvements hold. Keep publishing helpful content and strengthening your site meanwhile.

How to recover from a core update instead

If the drop lines up with a core update rather than a spam update:

  1. Honestly compare the pages that lost rankings with competitor pages that gained.
  2. Make content more useful, original and up to date.
  3. Show who is behind the site — author details, business information, reviews.
  4. Improve page experience: speed, mobile layout, fewer intrusive pop-ups.

Read how to rank number 1 on Google for the full playbook.

Frequently asked questions

When did the Google September 2026 spam update finish?

It started on 24 September 2026 and completed on 8 October 2026, after about 13 days and 16 hours.

What did the September 2026 spam update target?

Google did not say. It is a global update, for all languages, that improves automated spam detection against its spam policies.

How do I know if a spam update hit my site?

Look for a sharp drop in Search Console that starts during the rollout window, rule out technical issues, seasonality and manual actions, and check which pages or sections lost the most.

How long does it take to recover from a Google spam update?

Usually months. Google needs time to see that the problems are fixed and stay fixed.

Only if harmful links are the cause, and it is rarely enough on its own. Google already ignores many spammy links; focus on stopping link schemes and improving content.

Can you audit my site after a ranking drop?

Yes. Our SEO services include a full audit of content, links and technical issues with a recovery plan. See also our SEO cost in India guide. Contact us for a free check.

Sources and further reading

Share this article