Google's September spam update is still rolling out. Here is what your website should check this week

On 24 September 2026, Google began rolling out its fourth spam update of the year, and it broke the pattern of the previous three in one important way: instead of finishing inside two or three days, Google said this one would take up to two weeks. That window runs into this week, which means rankings are still moving as you read this. Here is what happened, day by day, what the update does and does not target, and a practical checklist for business owners who woke up to a different Search Console graph.

What happened, with dates

Google announced the update through its Search Status Dashboard on 24 September 2026, with the rollout starting at 9:15am Pacific. The dashboard entry is short: the update applies globally and to all languages, and the rollout may take up to two weeks to complete.

The two-week figure is the headline. The March, June and August 2026 spam updates each wrapped in under three days; the June release finished in roughly 48 hours. When Search Engine Roundtable's Barry Schwartz queried the number, Google's John Mueller confirmed it was not a typo, saying the rollout was "likely to take longer than some of the previous ones." That makes this the slowest spam rollout of the year by a wide margin, and the fourth spam update in 2026, Google's most active year for spam enforcement since 2021.

The impact has arrived in waves rather than as one event:

• 25 to 27 September: the first wave. Rank tracking tools lit up and webmaster forums filled with reports of sharp drops, with volatility peaking over that weekend.
• 28 to 29 September: a brief cooling-off, which led some to assume the update had mostly landed.
• 30 September: a second, distinct spike in movement that Search Engine Roundtable characterised as phase two of the rollout.
• Early October: the dashboard still shows the rollout as ongoing, so further waves before completion are possible.

In the same stretch, Google also shipped a useful, unrelated change: Search Console gained a multimodal search type filter, rolled out globally from 24 September with data back to 10 September. It separates traffic from image-based searches, including Google Lens and Circle to Search, from typed queries. More on why that matters below, because it complicates how you read your own traffic graphs this fortnight.

What this update targets, and what it does not

Google was unusually specific about the exclusions. This update does not target link spam, and it does not target the site reputation abuse policy (the "parasite SEO" rule aimed at third-party content published on high-authority domains). It enforces "some" of the remaining spam policies, without saying which.

The remaining policy list is worth rereading, because several entries describe things ordinary businesses do without thinking of them as spam:

• Scaled content abuse: generating large numbers of pages primarily to capture search traffic rather than to help anyone. The policy is method-agnostic, so this covers mass AI-generated pages and mass human-written filler equally. Hundreds of near-identical "service + city" location pages are the classic small-business version.
• Doorway pages: clusters of pages targeting slight keyword variations that all funnel to the same destination.
• Thin affiliate pages: product content copied from the merchant with nothing added.
• Cloaking, hidden text and sneaky redirects: showing Google something different from what visitors see.
• Hacked and expired domain abuse: content injected into compromised sites, or old domains repurposed to ride their history.

The two-week rollout and the visible second wave suggest Google is applying changes in stages rather than flipping one switch. Practically, that means a site untouched on 27 September was not necessarily safe on 28 September, and a drop that appeared on 30 September is just as likely to be this update as one that appeared on day one.

Why business websites should care, even clean ones

Most of our clients' first question with any spam update is "are we at risk?" For a site with real pages describing real services, the honest answer is: almost certainly not directly. Google repeated its standard line that spam updates only impact sites violating spam policies, while acknowledging that collateral damage happens with any update.

But there are three indirect effects worth understanding.

First, the scaled content line has moved closer to normal practice. The cheap tactic of 2025 and 2026 has been bulk-publishing AI pages, and four spam updates in one year is Google saying it intends to keep catching up. If a website development company or SEO vendor has ever pitched you "300 location pages by Friday" or a thousand AI articles a month, this is the enforcement mechanism that eventually finds that work. The output might be fine for months, which is what makes it tempting; algorithmic spam classifications then take months of demonstrated compliance to lift. The build-cheap-rank-fast math only works if you ignore the recovery timeline.

Second, when spammy pages fall, someone fills the space. Spam updates are one of the few genuinely zero-sum moments in SEO where clean sites gain without doing anything. If your rankings ticked up since 25 September, that is likely competitors' scaled content being filtered out around you. The gain is only durable if your pages deserve the position, which is an argument for spending this quarter on substance rather than volume.

Third, your traffic reports need more care this fortnight than usual. With the new multimodal filter, Search Console now splits out image-driven searches that were previously blended into your totals. If you are diagnosing a late-September dip, make sure you are comparing like with like across search types before concluding the spam update hit you. A drop in one segment with stable totals is a reporting artefact, not a penalty.

The checklist: what to do this week

Whether you build in WordPress, on a custom stack, or run a storefront built by a shopify development agency, the audit is the same. Set aside an hour and work through it.

1. Establish your dates. In Search Console, open Performance and compare 24 September to today against the preceding three weeks. Daily clicks, not weekly averages. A fall starting 25 to 27 September or 30 September aligns with the two waves.
2. Segment before you conclude. Filter by page and by country. Spam classifications are usually pattern-level: if losses concentrate on one template or one content cluster while core pages hold, you have found the suspect.
3. Audit your scaled content honestly. List every batch of pages produced from a template or a prompt: location pages, programmatic comparisons, AI blog backfills. For each, ask whether a human visitor would find it more useful than the page ranking next to it. If the answer is no, consolidate or delete the batch, properly, rather than trimming ten percent of it. Google has been explicit that token cleanups do not lift the classification.
4. Check for compromise. Hacked content is on the policy list, and early-October security reporting described WordPress backdoors that rebuild themselves after cleanup. Run a scan, check Search Console's Security Issues report, and look for pages in Google's index you never published (search site:yourdomain.com and scan for anything unfamiliar).
5. Review what your vendors are doing in your name. If an agency handles your content or link acquisition, ask them directly what was published in the last six months and how. Clean html web development and honest content give Google nothing to classify; the risk usually arrives via a vendor's shortcuts, and it is your domain that carries the consequence.
6. If you gained, bank it. Pages that inherited better positions this week will get more clicks; whether those clicks become customers is a separate problem. Tightening the pages that just moved up is the highest-leverage conversion optimization work you can do in October, because the extra traffic is already paid for.

The bigger pattern: four spam updates in one year

Zoom out and 2026 looks like a policy statement. March, June, August, and now September: Google has not run spam enforcement at this cadence since 2021, and the timing tracks the flood of machine-generated pages competing for the same results. Each update has been described the same way, enforcing existing policies rather than introducing new ones, which means the rules have not changed; the detection has.

For business owners the strategic read is simple. The gap between "content that ranks" and "content worth reading" is closing from both directions, with spam updates removing the former and AI Overviews increasingly summarising the latter. The durable position is a smaller number of genuinely substantive pages: service pages that answer real buying questions, case studies with numbers in them, posts a customer would forward to a colleague. That is slower and more expensive per page than bulk generation, and it is also the only approach that has survived every update this year without flinching.

Frequently asked questions

When did the September 2026 spam update start and when will it finish?

Google began the rollout on 24 September 2026 at 9:15am Pacific and said it may take up to two weeks to complete, which puts the expected finish in the first full week of October. As of early October the Search Status Dashboard still lists it as ongoing, so rankings can continue to move until Google marks the rollout complete.

Why is this spam update taking two weeks instead of two days?

The three earlier 2026 spam updates in March, June and August each completed in under three days. Google told Search Engine Roundtable this one would run around two weeks, and John Mueller confirmed that was not a typo. Google has not explained why, but a longer rollout usually means changes are being applied in stages, which matches the two distinct waves of volatility observed on 25 to 27 September and again on 30 September.

My traffic dropped around 30 September. Was that the spam update?

Quite possibly. Tracking tools and webmaster reports recorded a second surge of ranking movement on 30 September, which observers are calling the second wave of this update. Check Search Console for the exact date your clicks fell, compare it against 24 to 27 September and 30 September, and check whether the losses are concentrated in pages that could plausibly trip a spam policy, such as scaled or thin AI-generated content. A drop on an unrelated date is more likely normal fluctuation or a different issue.

Does the September 2026 spam update target link spam?

No. Google said this update does not target link spam and does not target the site reputation abuse policy. It enforces a subset of the other spam policies, which include scaled content abuse, cloaking, doorway pages, hidden text, hacked content and expired domain abuse. Google did not disclose which specific policies this release focuses on.

What should I do if my site was hit by this spam update?

Review Google's spam policies honestly and fix the pattern at the source rather than trimming a few pages. If the problem is scaled low-value content, delete or consolidate it properly. There is no reconsideration request for algorithmic spam actions; recovery happens when Google's automated systems observe sustained compliance, and Google says that can take months. If you cannot find any violation, document your traffic dates and wait for the rollout to finish before making drastic changes, since positions often settle.

The takeaway

The September 2026 spam update is Google's slowest and fourth spam enforcement action of the year, still rolling out as of this week, with confirmed impact waves on 25 to 27 and 30 September. It does not target link spam; it targets manufactured content at scale. If that is not your site, your job this week is one hour of verification: confirm your dates, segment your Search Console data with the new multimodal filter in mind, scan for compromise, and ask your vendors what they shipped in your name. And if your rankings quietly improved, spend the windfall on converting the traffic, because the next update will decide whether you keep it.