Google's September 2026 spam update has a two-week window. Here's how to tell if it hit you

Google started rolling out the September 2026 spam update on 24 September and said it may take up to two weeks. That is a longer window than any of the three spam updates before it this year, and it has one practical consequence that matters more than the update itself: for the next fortnight, most of the ways people check whether they were affected will give the wrong answer.

What Google announced, and the one detail that changes how you read your data

Google confirmed the September 2026 spam update on its Search Status Dashboard, with a start time of 24 September 2026 at 09:15 US/Pacific. It applies globally and in all languages, and Google said the rollout may take up to two weeks. As with every spam update, Google did not say which behaviour or which detection system changed.

The detail worth pausing on is the two-week window, because it is a break from the pattern set by the other three spam updates this year. Each of those was given a window of a few days, and each finished inside it.

A longer stated window does not mean a bigger impact, and it is a mistake to read it that way. Google does not publish why a rollout is scheduled the way it is. What a fourteen-day window does change is the reliability of your own measurement, because for up to two weeks you are looking at a search index that is partly updated. Every conclusion you draw before the rollout completes is drawn from a moving baseline.

Why a fourteen-day rollout breaks the usual way of checking

The habitual response to a confirmed update is to open Search Console, set the date range to the last seven days, compare it with the previous period, and decide whether something happened. That comparison is unsound during a long rollout, for three separate reasons that compound.

1. The baseline is mid-change. A partial rollout means some queries have been reprocessed and some have not. A drop measured on day three may reverse on day nine, not because you recovered, but because the part of the index you happened to be watching had not been reached yet.
2. Search Console data is lagged. Performance data is typically incomplete for the most recent two to three days, so a "last 7 days" view during a rollout is really four or five usable days, two of which sit before the update started.
3. Day-of-week effects dominate small samples. For most B2B and service sites, weekday-to-weekend variation is larger than the effect of an average algorithm update. Comparing a Tuesday-to-Thursday slice against a Friday-to-Sunday slice produces a signal that has nothing to do with Google.

The fix is not to stop looking. It is to decide in advance what each window can and cannot tell you, and to hold off on the decisions that require the full picture.

Write the "after complete" date in your calendar when Google updates the dashboard, then compare a clean fourteen days after against the fourteen days before 24 September, on the same weekday boundaries. That single discipline prevents most of the bad decisions that follow an update.

Five causes that look identical in a traffic graph

A sudden drop in organic traffic has at least five plausible causes, and a spam update is only one of them. Each has a different fix, and three of them have nothing to do with content quality at all. This is the differential diagnosis, and it is worth running in this order because the cheap checks rule out the expensive mistakes.

The two most useful rows are the first and the last. Checking the Manual Actions report takes thirty seconds and definitively rules in or out the one category that has a formal appeal route. Separating impressions from clicks takes about the same time and rules out the case where your rankings never moved and the result page simply changed shape around you, which is increasingly common and completely unaffected by any spam update.

The self-audit: which spam policy could plausibly apply to you

Spam updates enforce published rules rather than re-scoring quality in general, so the diagnosis has a finite question set. In March 2024 Google named three categories explicitly in its web search spam policies, and site reputation abuse received its own dedicated policy section on 25 September 2024. Work through these honestly. A legitimate business site will answer no to all of them, and that answer is itself diagnostically useful, because it moves you to a different row of the table above.

1. Scaled content abuse. Have you published a large number of pages whose primary purpose is to rank rather than to help someone? The policy is deliberately method-agnostic: AI-written, human-written and scraped content are treated the same if the intent is manipulation. The disqualifying question is not "did a person write it" but "would this page exist if search did not".
2. Site reputation abuse. Does your domain host third-party content that sits there mainly because your domain ranks — coupon sections, sponsored review hubs, guest-post directories — with little to no first-party oversight? The test is editorial: does this content belong on this domain for a reason other than its ranking power?
3. Expired domain abuse. Did you acquire a domain with existing authority and repurpose it for something unrelated to what earned that authority? This catches redirects from bought domains as well as content hosted on them.
4. Link spam. Have you paid for links, exchanged them at scale, or run guest posting primarily for links in the last twelve months? Include anything an agency did on your behalf, which is where most site owners find their surprise.
5. Thin affiliate and doorway pages. Do you have near-duplicate location or service pages that differ only by a swapped city name, or affiliate pages that add nothing to the merchant description? Programmatic page sets are legitimate when each page carries genuinely distinct information, and a liability when they do not.

If one of these lands, you have both your diagnosis and your remediation plan. If none lands and your traffic still dropped in the window, the probability mass has moved to the core-update, technical or SERP-layout rows, and the correct response is very different: improve what you have rather than remove it.

What not to do while the rollout is running

The expensive errors after an update are almost all errors of haste, and they share a structure: a change made on incomplete data that then makes the next measurement uninterpretable.

1. Do not bulk-delete or noindex pages on day three. Pruning is a reasonable tactic against a confirmed scaled-content problem and a terrible reflex response. Deleting pages that were losing for demand reasons removes impressions you would have kept.
2. Do not rewrite everything at once. If you change fifty pages during a rollout you have permanently destroyed your ability to attribute the outcome to either the update or the rewrite.
3. Do not disavow links reflexively. The disavow file is for links you cannot get removed and that you believe are genuinely harmful, not for anything in a third-party toxicity score.
4. Do not stop publishing. There is no evidence that pausing publication helps during a rollout, and a gap in your schedule costs you the compounding you were building.
5. Do fix technical faults immediately. This is the one exception. Broken canonicals, accidental noindex tags, server errors and blocked resources should be repaired the moment you find them, update or no update.

If it did hit you: the recovery sequence

Recovery from an algorithmic spam demotion is mechanically different from recovery from a manual action, and knowing which one you have determines everything about the timeline.

1. Confirm which one you have. Manual actions are named in Search Console and can be appealed through a reconsideration request. Algorithmic demotions produce no notice and have no appeal; the only route is to fix the violation and wait for reprocessing.
2. Fix the cause, not the symptom. If the problem is a section of the site hosting third-party content for ranking reasons, removing that section is the fix. Improving its writing is not.
3. Remove rather than rework, where the page has no legitimate purpose. A page that exists only because search exists should be deleted or consolidated, with a redirect only where there is a genuinely relevant destination.
4. Document the date you finished. You will need it, because the gap between fixing and recovering is measured in months rather than weeks, and can require a subsequent update cycle before the demotion lifts.
5. Rebuild demand elsewhere in the meantime. A recovery timeline of several months is a business problem as well as an SEO one. This is the point at which paid acquisition earns its place, as a bridge rather than a replacement.

If your traffic is flat, this is still your window

Every enforcement cycle moves rankings in both directions. Positions vacated by demoted pages are filled by whatever ranks next, and for most sites the realistic opportunity is not a first-place win but a move from position eleven to position seven on queries where they already have relevance.

The queries worth checking are the ones where you sit between positions four and twenty with reasonable impressions, and where at least one page above you looks like it could be caught by one of the five policies above. Those are the pages where a genuine content improvement has the shortest path to a ranking change, because the competitive set is unstable this fortnight in a way it will not be in November. That work also compounds into AI answer surfaces, where the selection pool starts from pages that are indexed and eligible for a snippet, which is the same pool an ordinary well-built site competes in.

Frequently asked questions

When did the September 2026 spam update start, and how long will it take?

It started on 24 September 2026 at 09:15 US/Pacific according to Google's Search Status Dashboard, and applies globally in all languages. Google said the rollout may take up to two weeks. That is a longer stated window than the March 2026 update (19 hours 30 minutes), the June 2026 update (2 days 1 hour) or the August 2026 update (2 days 16 hours), each of which was given a window of a few days.

What does the September 2026 spam update target?

Google has not said. It did not name a behaviour, a system change or a detection improvement. Spam updates in general enforce Google's published web search spam policies rather than re-scoring quality broadly, and the categories Google has named explicitly include scaled content abuse, site reputation abuse, expired domain abuse and link spam. In the absence of a stated target, audit against those published policies rather than guessing at the update.

Will a spam update show up in Google Search Console?

Not as a notification. An algorithmic spam demotion produces no message and no entry in the Manual Actions report; you can only infer it from ranking and traffic changes. A manual action is different: it is named explicitly in the Security and Manual Actions report and is the only case with a formal appeal route, the reconsideration request. Checking that report takes seconds and is the first thing worth doing.

How do I tell a spam update from a core update?

By the shape of the change and by whether a violation exists. A spam demotion usually concentrates sharply in one set of pages or one content type, and traces back to a specific practice that breaks a published policy. A core update redistributes rankings broadly across many queries, with pages going both up and down and no violation to find. If you cannot identify a policy you breached, a core update, a technical fault or a change in the result page layout is the more likely explanation.

How long does recovery from a spam update take?

Longer than most people expect. For an algorithmic demotion there is no appeal and no reconsideration request; you fix the violation and wait for Google to reprocess, which is measured in months rather than weeks and can require a later update cycle before the demotion lifts. A manual action can be appealed as soon as the issue is genuinely fixed, which is why identifying which of the two you have is the first step.

Should I change my site during the rollout?

Fix technical faults immediately: broken canonicals, accidental noindex tags, server errors, blocked resources. Hold everything else. Bulk deletions, mass rewrites and reflexive link disavows made on day three are based on a partially updated index, and they destroy your ability to attribute what happens next to either the update or your own changes.

The takeaway

Two weeks is a long time to look at a moving baseline, and the temptation is to act on day three. Resist it. Check the Manual Actions report, rule out the technical and tracking causes, separate impressions from clicks so you know whether your rankings moved at all, and run the five-policy audit honestly. If nothing lands, you probably are not looking at a spam demotion, and the correct response is to improve pages rather than remove them. If something does land, fix the cause rather than the wording, note the date, and plan for a recovery measured in months. Then spend the rest of the fortnight on the queries where you already sit just outside the top ten, because that is where an unstable SERP is genuinely worth something.