Google's September 2026 spam update has a 14-day window. How to tell whether it hit you

Google started the September 2026 spam update at 09:15 Pacific on Wednesday 24 September, and the Search Status Dashboard entry carried a line the previous three did not: the rollout may take up to two weeks. As of today, 29 September, it is still running. That single detail changes how you should read your own traffic data this week, and it is the part most of the coverage has skipped past.

What Google actually said, and what it did not

The confirmed facts are short. The update started on 24 September 2026 at 09:15 Pacific. It is global and applies to all languages. Google said the rollout may take up to two weeks. It is a spam update, which means it is enforcement of the spam policies for Google web search rather than a change to how quality is assessed generally. No new spam policy was announced alongside it, so the list of things you can be penalised for is the same list that was published before 24 September.

What Google did not say is why this one needs two weeks. The dashboard entry gives the window without a reason. Plenty of commentary has filled that gap with theories about a deeper index sweep or a more complex enforcement pass. Those are guesses. The useful thing to take from the two-week window is not a theory about SpamBrain's internals, it is a practical constraint on your own measurement, which is what the rest of this piece is about.

2026's four spam updates, and why the rollout length matters

This is the fourth spam update of 2026, and each one has taken longer than the one before it. Laid out together, the pattern is the story:

Read that last row as a measurement problem rather than a severity signal. A 19-hour rollout gives you a clean break: traffic before, traffic after, and a narrow window of ambiguity in between. A 14-day rollout gives you a fortnight in which ranking movement could come from the spam update, from ordinary index churn, from a competitor's changes, from seasonality, or from something Google has not announced. Nothing that happens inside that window can be attributed confidently to one cause.

That has a direct consequence. The instinct after a drop is to change something immediately. During a two-week rollout that instinct is actively harmful, because you lose the ability to tell whether a later recovery came from your fix or from the rollout finishing. If you must act now, act on things that are correct regardless of the update, and log the date you did it.

Is it the spam update, or something else? A differential diagnosis

Most sites that lose traffic in a two-week window did not lose it to the spam update. The four causes get confused constantly because the symptom, "rankings dropped", is identical. The distinguishing signals are not.

The fastest way to separate the first three from the fourth is to check whether impressions fell alongside clicks. A clicks-only fall with flat impressions is almost never an algorithm story, it is a tracking, title or snippet story. Start in Search Console rather than in your analytics, because Search Console is measuring what Google did rather than what your tags recorded.

The second check is concentration. Spam enforcement is targeted at a pattern. If your drop is confined to one directory, one template, one content type or one set of pages produced the same way, that is consistent with spam enforcement. If it is spread thinly across everything, that looks more like a core update or a broad relevance shift.

The audit most business sites actually need: your third-party surface

Coverage of spam updates is written for people running spam. That is not most businesses, and it means the genuinely useful audit rarely gets described. If you run a legitimate site, the spam policy most likely to catch you is site reputation abuse, and you can breach it without ever intending to, because it concerns content published on your domain by somebody else.

Site reputation abuse covers third-party sections hosted on a trusted domain that have little to do with the main site, and it was one of three policies Google introduced in March 2024 alongside expired domain abuse and scaled content abuse. The canonical examples are coupon, casino and loan directories bolted onto an established domain. The versions we see on ordinary business sites are quieter:

1. A coupon or deals subfolder run by a third party. Often signed years ago as a revenue share, often still live, often nobody internally remembers who owns it.
2. Syndicated or "partner" content published under your domain. Especially press-release style pages or supplier-written product guides sitting on your subfolder rather than theirs.
3. An unmoderated forum, comments section or profile directory. User-generated spam is its own named policy, and a dormant forum from a previous site version is a common source.
4. A guest post section with no editorial control. If anyone can publish, someone is publishing links for a client.
5. A legacy blog with pages produced at volume. Scaled content abuse is method-agnostic. Google's policy turns on whether pages exist primarily to manipulate rankings rather than on whether a human or a model wrote them, so a large archive of thin, templated location or keyword pages qualifies whatever produced it.

Run this as an inventory, not as a judgement. List every directory on your domain, name the owner of each, and flag anything where the answer to "who decides what gets published here" is not someone at your company. That list is your exposure. It is also, usefully, the same list a technical SEO audit should already contain and usually does not.

The one thing worth checking on the content side is intent rather than authorship. Independent analysis of the August 2026 spam update found hits concentrated on scaled content abuse, programmatic pages and thin affiliate content. Pages written to answer a real question, whatever tool helped write them, were not the pattern. If you have an archive you are unsure about, our notes on updating old posts and on demonstrating experience and expertise are the more useful lenses than a word count.

What recovery actually looks like, and how long it takes

There is no reconsideration request for an algorithmic spam update. That mechanism exists only for manual actions. For everything else, you change the thing, and Google's automated systems re-assess on their own schedule. Google's own guidance on this is unusually blunt: changes may help only after its systems observe, over a period of months, that the site now complies.

Months is the honest number, and it is worth saying plainly because the gap between that and the timelines in most recovery pitches is where a lot of money gets wasted. Two implications follow:

1. Remove rather than rewrite, where the pattern is the problem. If a section exists primarily to rank rather than to serve a customer, editing it keeps the pattern alive. Removing it, or moving it off your domain entirely, is a cleaner signal and a faster one to evaluate.
2. Do not stack changes. If you fix six things across three weeks, you will never learn which one mattered, and you will be in the same position at the next spam update. Date every change and group them.

The broader point is that spam enforcement is not a ranking setback you can out-optimise. It is a pattern Google has decided it does not want in its index. The recovery work is removing the pattern, and the timeline is set by Google's re-assessment cycle rather than by how fast you work. Our piece on how long SEO takes sets the same expectation for growth generally, and the arithmetic is unforgiving in the same way.

What to do this week

Concretely, in order, while the rollout is still running:

1. Export the pre-update baseline. Search Console performance data at page and query level for the 28 days ending 23 September 2026.
2. Check the Manual actions report. Thirty seconds, and it is the only check that can give you a definitive answer rather than an inference.
3. Confirm whether impressions moved with clicks. If not, stop reading about the spam update and go looking for a technical or snippet cause.
4. Inventory your third-party surface. Every directory, every owner, flagged where control sits outside your company.
5. Wait for the completion note before diagnosing. Then compare a clean 14 days after completion against your exported baseline, skipping the rollout window entirely rather than averaging across it.

If you are hit and the cause turns out to be a section of your own site that exists for search engines rather than customers, the fix is a content and architecture decision rather than an SEO tactic, which is the point at which it becomes a website question rather than a rankings one. The sites that come out of spam updates cleanly tend to be the ones with nothing on the domain they would struggle to justify to a customer.

Frequently asked questions

When did the September 2026 Google spam update start?

Google started the September 2026 spam update on 24 September 2026 at 09:15 Pacific time. It applies globally and to all languages. Google's Search Status Dashboard entry said the rollout may take up to two weeks to complete, which makes it the longest window given to any spam update so far. As of 29 September 2026 no completion note had been posted.

How long do Google spam updates usually take to roll out?

Much less than two weeks. The three earlier spam updates of 2026 all finished in under three days: the March 2026 update took about 19 hours and 30 minutes, the June 2026 update about 2 days and 1 hour, and the August 2026 update 2 days and 16 hours. The September 2026 update's up-to-14-day window is a material step up from any of them.

Will Google tell me in Search Console if a spam update hit my site?

No. Spam updates are algorithmic and generate no notification. The only search enforcement that produces an explicit Search Console notice is a manual action, which appears in the Manual actions report with the violation named and has a reconsideration process. If that report is clean, any impact you are seeing is algorithmic and has to be diagnosed from your traffic data instead.

What does the September 2026 spam update target?

It is algorithmic enforcement of Google's existing published spam policies rather than a new rule. No new policy was announced alongside it. That list includes cloaking, doorway pages, expired domain abuse, hidden text and links, keyword stuffing, link spam, machine-generated traffic, misleading functionality, scaled content abuse, site reputation abuse, thin affiliate pages and user-generated spam. Independent analysis of the August 2026 update found impact concentrated on scaled content abuse, programmatic pages and thin affiliate content.

Can a legitimate business site be hit by a spam update?

Yes, most often through site reputation abuse, which concerns third-party content hosted on your domain. The common cases are a coupon or deals subfolder run by an outside partner, syndicated or supplier-written pages published under your domain, an unmoderated forum or comments section, an uncontrolled guest post section, and a legacy archive of thin templated pages. The audit is an inventory: list every directory and name who decides what gets published there.

How long does recovery from a spam update take?

Months rather than weeks, and there is no way to accelerate it through an appeal. Reconsideration requests apply only to manual actions. For algorithmic spam enforcement you remove the violating pattern and wait for Google's systems to re-assess, which Google says happens over a period of months. Removing a section that exists primarily to rank is usually a faster and cleaner signal than rewriting it.

Should I make changes while the update is still rolling out?

Only changes that are correct regardless of the update, and log the date of each one. During a rollout of up to two weeks you cannot attribute movement to any single cause, so changes made mid-rollout leave you unable to tell whether a later recovery came from your fix or from the rollout finishing. Export a pre-update Search Console baseline now, then compare a clean period after the completion note against it.

The takeaway

The headline fact about the September 2026 spam update is not its severity, which nobody can assess yet, it is its length. Fourteen days is a fortnight in which no ranking movement can be cleanly attributed to anything. So do the two things that are useful during a rollout and skip the rest: export your pre-update Search Console baseline before the comparison windows get contaminated, and inventory every part of your domain where somebody outside your company decides what gets published. Check the Manual actions report, because it is the only report that answers the question definitively. Then wait for the completion note before you diagnose, and accept that if the cause is a section of your site that exists for search engines rather than customers, the fix is removal and the timeline is months.