Google Updates

September 2026 Spam Update Begins Rolling Out, With a Two-Week Window

By Paul Lovell · September 24, 2026 · 6 min read

Google released the September 2026 spam update on September 24, 2026 at 16:15 UTC. The rollout is in progress, and Google says it "may take up to two weeks to complete". It is the fourth spam update of 2026, following March, June and August.

This post covers what Google has confirmed so far, how the update compares with earlier ones, and how to monitor your own data without misreading a rollout that hasn't finished. It will be updated when Google marks the rollout complete.

What Google has confirmed

Per the incident entry on Google's Search Status Dashboard:

  • Started: September 24, 2026, 16:15 UTC
  • Scope: "applies globally and to all languages"
  • Expected duration: "may take up to two weeks to complete"
  • Classification: Ranking, severity low
  • Status: Rolling out. No completion entry yet.

The dashboard entry links to Google's spam updates documentation. At the time of writing, that dashboard entry is the only public detail. The Search Central blog feed carries no post about the update, and Google has not described what it targets beyond calling it a spam update. This post therefore makes no claims about what the update is aimed at, or how sites are being affected.

A longer window than the previous three

The wording is the notable change. Each of the 2026 spam updates before this one carried the same estimate on the dashboard: "may take a few days to complete". This one says two weeks.

UpdateGoogle's estimateActual duration
March 2026 spam updatea few days19 hours, 30 minutes
June 2026 spam updatea few days2 days, 1 hour
August 2026 spam updatea few days2 days, 16 hours
September 2026 spam updateup to two weeksin progress

"Up to two weeks" is the same phrase Google used for the March 2026 and May 2026 core updates, which ran 12 days and 11 days respectively. An estimate is a ceiling, not a forecast, and Google's three earlier 2026 spam updates all finished well inside their estimate. So it would be a mistake to assume this one will take 14 days. It would equally be a mistake to assume it will finish in a weekend.

A two-week spam rollout would not be unprecedented, either. The confirmed timeline shows the March 2024 spam update ran 14 days, 21 hours, the October 2023 spam update ran 15 days, 12 hours, and the August 2025 spam update ran 26 days, 15 hours. What would be different is the pattern: the June and August 2026 updates finished in under three days each, and this one arrives 37 days after the August update began.

How spam updates differ from core updates

Google's documentation draws a clear line between the two, and it matters for how you read your data.

Core updates, in Google's words, are "significant, broad changes" to its systems that don't "target specific sites or individual web pages". A page that moves down after one isn't necessarily a bad page. A spam update is different. Google's spam updates page describes them as notable improvements to the automated systems that detect spam, such as SpamBrain, its AI-based spam-prevention system. It says sites that see a change after a spam update "should review our spam policies", and that "sites that violate our policies may rank lower in results or not appear in results at all".

Two other points from that page are worth keeping in mind:

  • Recovery is slow by design. Google says making changes "may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies". Nothing on that page suggests a quick reversal.
  • Link spam is a special case. For an update that specifically deals with link spam, Google says changes "might not generate an improvement", because the ranking benefit from spammy links is lost rather than suspended. Google has not said this update is a link spam update, so that caveat is background context, not a diagnosis.

The spam policies themselves are unchanged by an update. They are listed on Google's spam policies page, and include cloaking, expired domain abuse, hidden text and link abuse, keyword stuffing, link spam, scaled content abuse and scraping, among others. The page also notes that "Google may act against any type of spam practices we detect". For a recent example of a policy change that sat alongside an update, see our write-up of the site reputation policy and EEA enforcement.

How to monitor your own data during the rollout

  1. Record the start time, not just the date. The rollout began at 16:15 UTC on September 24. Search Console reports dates in Pacific Time, so a UTC timestamp can land on a different calendar day. Convert before you compare.
  2. Don't judge the rollout until it is marked complete. Google's core update guidance recommends waiting at least a full week after completion before analysing Search Console data, then comparing that week with the week before the rollout began. That advice is written for core updates and the spam updates page gives no equivalent window. But the logic carries over: while the rollout is running, your data is a mixture of before and after.
  3. Check for a manual action. Spam updates are algorithmic, but the Manual actions report in Search Console is the one place Google tells you about a penalty directly. Rule it out early so you're not diagnosing an algorithm for something a human reviewer did.
  4. Segment before you conclude anything. In the Performance report, compare by page, query and search type rather than the site total. A sitewide dip that is really three page templates is a very different problem from a sitewide dip that isn't.
  5. Watch the dashboard entry. Google has ended earlier incidents with a line reading "The rollout was complete as of" plus a date. That is the signal to start your post-rollout comparison.

What not to do mid-rollout

  • Don't make sweeping changes on a guess. With no published detail about targeting, mass-deleting pages or rewriting templates is as likely to hurt as help. Fix content that is weak on its own merits, and leave the rest alone.
  • Don't treat third-party volatility chatter as confirmation. Ranking trackers and forum threads record that something moved. Only Google's dashboard confirms that an update is running, and nothing outside Google confirms what it targets.
  • Don't expect a fast reversal. Google's own documentation frames improvement as something the automated systems confirm "over a period of months".

Sources