On Thursday, September 24, around noon US Eastern time, Google posted a short notice on its Search Status Dashboard: the September 2026 spam update is out, it applies globally and to all languages, and the rollout may take up to two weeks. Three fairly dry sentences for an announcement that, if your site landed on the wrong side of it, can ruin your quarter. Here is what we know so far, what to check over the coming days, and what to do (and not do) while the update finishes rolling out.
What exactly did Google announce?
The official announcement says very little: "Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete". In other words, a spam-focused update, for every country and every language, with a rollout that could stretch into the first week of October.
This is the fourth spam update Google has shipped so far in 2026, so the move itself is no surprise. These updates refresh the automated systems that detect violations of Google's spam policies, the same family of systems its documentation groups under the name SpamBrain. When the system gets retrained and deployed, sites that were cheating (or that look like they were, which is an important nuance we get back to below) lose visibility, and the results that held that space get reshuffled.
One detail worth noting: Google clarified that this update does not specifically target link spam. It is a general refresh of the detection systems, so a questionable backlink profile can still get you caught, but purchased links are not the declared focus this time.
Why does a two-week rollout matter?
Because it is quite a bit longer than usual for this family of updates. The August spam update, the previous one in the series, rolled out in about three days: it started on August 18 and was complete by the 21st. For this one, Google warned upfront that it may take up to two weeks, and John Mueller confirmed on social media that yes, it will probably take longer than some of the previous ones.
What does that mean in practice? That between September 24 and roughly October 8, rankings will keep moving, and what you see one day can reverse the next. During a long rollout it is normal to watch positions drop and recover, or the other way around. Drawing conclusions from three days of data is like judging a home renovation while the house is still full of rubble.
There is a second calendar nuance. On September 23 and 24, before the announcement, the tools that monitor ranking volatility were already showing heavy movement. Google did not confirm that this was part of the update, so if your traffic moved on those days, the cause might be this spam update or some other adjustment Google will never confirm. That is why the recommendation below is to write down dates and wait, rather than guess.
What does a spam update punish?
Google's spam policies are public and fairly specific. The full list is in the documentation, but these are the fronts I see most often on real sites in Chile and Peru:
Scaled content with no value
Producing hundreds or thousands of nearly identical pages, built to capture search variations, that nobody reviewed and that add nothing of their own. Since 2024 Google calls this "scaled content abuse", and it does not care whether you did it with AI, with templates or with an army of underpaid writers: what gets punished is the pattern of scale without value. Pay attention to this one if your team ramped up AI content production this year, because the line between "we produce more" and "we produce filler at scale" is easier to cross than it looks. If that is your case, here is my guide on how to use AI for content without hurting your rankings.
Site reputation abuse
Renting out sections or subdomains of an authoritative site to publish third-party content that has nothing to do with the host site (coupons, casino reviews, loans). The industry calls it parasite SEO, and several large publishers have already lost entire sections to it in previous updates.
Recycled expired domains
Buying a domain with history and authority to build a site on top of it that has no relation to what that domain used to be, riding on the accumulated signal.
The usual classics
Cloaking (showing Google one thing and users another), sneaky redirects, keyword stuffing, hacked content and doorway pages that exist only to redirect. It sounds like SEO archaeology, but every spam update catches sites doing some of these things, sometimes without the owner knowing, because a hack that injects spam pages is exactly this.
How do I know if it hit me?
The first step is putting dates on the analysis. Mark September 24 as the start of the rollout and review Search Console comparing the period after it against the previous weeks. Three cuts that help isolate the signal:
By page: a spam update rarely punishes evenly. If the drop concentrates on a specific group of URLs (say, the bulk content section you launched this year), that is half your answer right there.
By country: the update is global, but your exposure is not. A site that ranks in Chile and Peru can drop in one market and hold in the other, depending on which competitors get reshuffled in each SERP.
By query: if you lose visibility on searches where your content was honestly weak and keep it where your content is solid, the pattern is telling you what to clean up.
And a warning I repeat with every update: do not compare against last week only. Compare against the same period of the previous month and check for seasonality (in Chile, the September 18 holidays move the traffic of half the local internet). More than once I have seen a "penalty" diagnosis that was, in reality, a long weekend.
What do I do if my traffic dropped?
First, do not touch anything structural until the rollout is complete. Changing half your site mid-rollout is the best way to never know what caused what. Document, observe, and prepare the list of changes to execute once Google confirms the update is done.
Second, when it finishes, review your last 12 months of content decisions against the list in the previous section, honestly. Asking "did we spam?" gets you nowhere, because nobody believes they spammed. A more specific question works better: did we publish anything at scale that no human reviewed and that adds nothing for the person searching? If the answer is yes, that is where the cleanup starts: delete, consolidate or improve. The process is the same one I described in my content pruning guide, with a stricter bar than usual.
Third, adjust your recovery expectations. Google was explicit that recovering from a spam update can take many months, because the system needs to relearn your site's signal, and in some cases full recovery only comes with the next refresh. That is bad news if you dropped, and it is also a useful number for sizing the real cost of strategies that flirt with these policies before someone approves them in the next planning meeting.
And if you reviewed everything and your site is clean, consider the possibility of collateral damage. Google itself acknowledges that "there may be collateral damage" on sites that do not spam. In that scenario the recommendation is even more boring: document the case, keep improving what you were already improving, and wait for the readjustment. A full SEO audit helps rule out something technical polluting the signal.
And if nothing happened to me?
Then this update is free for you, and it is a good moment for a preventive review that costs one afternoon: how much of your content from the last 12 months would pass the filter of "a human reviewed this and it helps the person searching for it", whether you have third-party sections living under your domain, and whether your monitoring would catch a hack with injected content before Google does.
The underlying takeaway is the same one I have been repeating for a while: Google is refreshing its spam systems every two or three months, and each refresh gets more aggressive with content produced at scale without quality control. If your content strategy survives the question "does this help anyone?" page by page, these updates become background noise. And if it does not, you are better off starting that cleanup yourself, this quarter, because doing it voluntarily costs a few weeks of work and doing it after a penalty costs the same plus the months of traffic it takes to recover.