Google's September 2026 spam update: what you need to know

Since September 24, 2026, Google has been rolling out its fourth spam update of the year. It applies to every country and every language, and the rollout may take up to two weeks. Two waves of movement have been seen so far: September 25 to 27, then September 30. Google has not said what it targets, so a traffic drop seen in the next few days is not enough to draw a conclusion.

How the rollout unfolded, day by day

We add to this timeline as the rollout moves forward. Times are Montreal time.

• Around September 13: on the WebmasterWorld forum, publishers report drops of 48 to 80% and Discover traffic down 70%. Those drops started before the announcement: nothing ties them to the update.
• September 24, 12:15 p.m.: Google announces the update on its status dashboard. It applies to every country and every language, and the rollout may take up to two weeks. John Mueller confirms it is likely to take longer than the previous ones. The same day, Search Engine Roundtable writes that it does not target link spam: that is its reading, not a statement from Google.
• September 25: a theory starts circulating. SAFE is a Google system described in a short research paper dated May 2026, which spots networks of AI-generated content. The paper only covers YouTube, and Google has not linked it to any search update. So far, it does not explain the September update.
• September 25 to 27: first wave. Tools that track ranking volatility (Semrush Sensor, Mozcast, Sistrix and AccuRanker, among others) all show a sharp rise, peaking on Saturday the 26th (Search Engine Roundtable sums it up on the 28th).
• September 28 and 29: movement calms down. Google still lists the update as ongoing.
• September 30: second wave. The trackers whose charts Search Engine Roundtable gathered (Mozcast, Semrush, AccuRanker and Sistrix, among others) again show a sharp rise. On WebmasterWorld, several publishers say their Discover and Google News traffic vanished again that day. Google has not confirmed this second phase: it is the reading of Search Engine Roundtable and consultant Glenn Gabe. It does fit a two-week rollout, which can act in several waves.
• October 1: Google still lists the update as ongoing. More movement may come before October 8.

Read tracking tools with caution

Ranking trackers call for caution right now. Google does not hand them its data: they query the search engine themselves, at very large scale, to record rankings. Google has been making that harder since the summer. Since late August, every link in the results goes through a google.com/goto redirect, which Google describes as a measure against abuse. To know which page holds which position, a tool now has to follow each link one by one.

The effects show in the data. On September 16, Sistrix announced that its collection was running at a reduced rate after further changes by Google. Around the same time, Nozzle (another tracking tool) said it had lost about 80% of the data it used to get from Google. Consultant Glenn Gabe compared the same site's recovery in three tools: Ahrefs showed it, Semrush showed it late and Sistrix did not show it yet (Search Engine Roundtable reports both). On September 26, in the middle of the rollout, Sistrix added that Google sometimes returns incomplete or distorted results: the tool is updating fewer keywords each day, and its charts move less than usual.

Both waves are still real, since every tool saw them. Their exact size should be read with caution, however. For your own site, Search Console remains the reference: its figures come from Google itself and do not depend on any outside collection.

What Google announced

The announcement is two sentences long, posted on September 24 at 9:15 a.m. Pacific time on the Google Search Status Dashboard. The update applies globally and to all languages. The rollout may take up to two weeks.

The Google Search Central team added on LinkedIn that this is a "normal" spam update. No new policy came with it, and Google named no target and no type of content. John Mueller, Google's search advocate, only confirmed on Bluesky that it is likely to take longer than the previous ones.

Two weeks, against under three days this year

The length is the only clue Google has left. The three earlier spam updates of 2026 were quick:

• March: 19 hours and 30 minutes;
• June: 2 days and 1 hour;
• August: 2 days and 16 hours.

For those three, Google announced "a few days." September is the first update this year to get a two-week window. The announced length is a maximum: the rollout may finish sooner.

A longer rollout suggests Google is changing its detection system more deeply. That is a hypothesis: Google has not confirmed it.

How Google spots spam

Google does not publish its signals, so that nobody can work around them. It does explain its method. Most of the work falls to SpamBrain, an artificial intelligence system in use since 2018: it learns from known examples of spam, then recognizes sites no human has flagged yet. In Google's vocabulary, a spam update is an improvement to that system.

Scale explains the choice. Google says it finds 40 billion spammy pages every day. In its report on 2022, it wrote that SpamBrain detected five times more spam sites than in 2021 and 200 times more than at launch.

People are involved too. When a Google reviewer decides a site breaks the rules, they issue a manual action. That is the only case where the owner is told, in the Manual Actions report in Search Console. A drop caused by SpamBrain sends no message.

What Google's policies target in 2026

Google's spam policies range from hidden text to sneaky redirects. Four of them matter most to businesses that publish a lot or hand their content and links to vendors:

• Scaled content abuse: many pages made mainly to manipulate rankings without helping the reader. The tool does not matter: a person, an AI or both.
• Site reputation: third-party content published on an established site, mainly to ride on its rankings.
• Expired domains: an old domain bought to host low-value content on the strength of its past.
• Back button hijacking: added to malicious practices in April 2026 and enforced since June 15. A third-party script or ad code can cause it without the site owner knowing.

After the August update, American consultant Glenn Gabe published an analysis of four affected sites: AI content at scale on health and money topics, a nearly empty Amazon affiliate site, a site with more than 1.5 million programmatic pages, and mass-produced pages with malicious redirects. These are his observations, not a confirmation from Google. They still show what recent spam updates have hit: volume without value.

Why the writing tool is not the issue is explained in Does Google penalize AI-generated content?

The full method for diagnosing a drop is in Google updates: how to diagnose a drop in SEO traffic. Paid links are covered in buying backlinks.

Frequently asked questions about the spam update