Google shipped its fourth spam update of 2026 on 24 September, more spam updates in six months than in the previous two years combined. Here’s what’s confirmed, what it’s not (yet), and a genuine self-check against the specific policies Google actually enforces, rather than another “wait and see” post.
What Happened, Exactly
Google logged the update on its Search Status Dashboard, starting 9:15 am Pacific time on 24 September 2026 – 2:15 am AEST on Friday 25 September, for Queensland businesses tracking against local time. The release note:
“Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete.”
That’s the entire official statement. No new spam policy named, no companion blog post, no confirmation of what specifically triggered it.
Fourth Spam Update in Six Months – Here’s the Actual Pattern
| Update | Started | Rollout Length |
|---|---|---|
| March 2026 | 24 March | 19 hours, 30 minutes |
| June 2026 | 24 June | 2 days, 1 hour |
| August 2026 | 18 August | 2 days, 16 hours |
| September 2026 | 24 September | Up to 2 weeks (estimated) |
Two things stand out here that are worth sitting with, not just reporting. First, the cadence: March, June, August, September – Google ran a single spam update across all of 2025, and has now run four in the first nine months of 2026. Second, the estimated window: every prior 2026 update finished in under three days. Google’s own estimate for September is up to two weeks – six to sixteen times longer than anything else this year.
A longer estimated window doesn’t guarantee a bigger or more consequential update – Google’s own guidance is explicit that the estimate is a maximum, not a promise. But a website is dealing with two months of higher-stakes silence: if a Search Console dip does show up in October, it’s genuinely harder to attribute it confidently to this specific update versus something else, precisely because the window is so wide.
Spam Update vs. Core Update – Why the Distinction Actually Changes Your Response
A core update reassesses how well your content answers a query relative to everything else Google has indexed – the fix, if you’re affected, is genuinely improving the content itself and waiting for the next core update to reflect that.
A spam update is different: it’s an improvement to the automated systems (commonly referred to as SpamBrain) that detect sites breaching Google’s specific, named spam policies. If a spam update affects you, the fix isn’t “write better content” – it’s identifying the specific policy violation, genuinely correcting it, and then waiting, because Google’s own documentation states its systems need to observe compliance over a period of months, not weeks, before recovery.
Getting this distinction wrong is the single most common mistake we see – a business assumes a ranking drop means their content quality declined, spends months on a content refresh, and never touches the actual spam policy issue causing it.
The Actual Spam Policies — A Real Self-Check, Not Just a Mention
Google’s spam policies documentation names several specific categories of behaviour its systems are built to detect. Here’s what each one actually means in practice, and how to genuinely check yourself against it:
- Scaled content abuse: publishing large volumes of content (AI-generated or otherwise) primarily to manipulate rankings rather than genuinely help readers. Self-check: has your publishing volume increased sharply in the last 6–12 months without a matching increase in genuine editorial oversight, fact-checking, or original insight per piece?
- Site reputation abuse — a well-established, trusted site hosting third-party content (paid or otherwise) purely to exploit that site’s existing ranking authority, with little genuine editorial involvement from the host site itself. Self-check: does your site host any guest content, sponsored sections, or third-party-run subfolders that your own team doesn’t genuinely oversee?
- Expired domain abuse — repurposing an expired domain’s existing authority and backlink profile for unrelated, low-value content. Self-check: if you’ve acquired an existing domain rather than building on a fresh one, does its current content genuinely relate to what that domain was previously known for?
- Link schemes — buying, selling, or otherwise manipulating links to influence rankings, rather than earning them naturally. Self-check: can you account for how every meaningfully authoritative backlink to your site was actually earned?
- Cloaking — showing search engines different content than what actual visitors see. Self-check: rare for most legitimate small businesses, but worth confirming your site doesn’t serve different content based on user-agent detection, even inadvertently through a plugin or CDN configuration.
- Doorway pages — multiple near-identical pages targeting slightly different keyword variations, all funnelling to the same underlying offer. Self-check: do you have several location or service pages with largely templated, thinly-differentiated content? (This is a genuine, common trap — see our note on avoiding this exact issue on multi-location pages.)
- Hacked content — content that’s been added to your site without authorisation, often invisible to a casual site owner. Self-check: when did you last actually check Search Console’s Security Issues report, rather than just assuming there’s nothing there?
Who’s Actually More Exposed Right Now
Scaled content abuse and site reputation abuse are the two categories most directly connected to the current explosion in AI-generated publishing, and it’s a reasonable, if not officially confirmed, read that this is a meaningful part of what’s driving the accelerating spam-update cadence. That has a genuinely uneven impact depending on your industry.
Regulated and compliance-sensitive industries – NDIS providers, aged care, allied health, legal and accounting practices — carry a specific, additional layer of exposure here that a generic small business doesn’t: content published quickly to “keep up” with AI-driven publishing volume, without genuine regulatory review, isn’t just a spam-policy risk. It’s also a real compliance risk in its own right, since marketing claims in these industries carry obligations well beyond ordinary SEO best practice. We see this constantly in our NDIS, aged care and allied health work – the businesses that treat content volume as the goal, rather than content accuracy within their actual regulatory framework, are doubly exposed right now.
A Genuinely Useful Side Note: Use the New AI Overviews Report While You Watch This
Google rolled out new Search Console reporting showing your visibility inside AI Overviews and AI Mode, fully available worldwide as of late August. If your site’s AI-feature visibility shifts noticeably during this spam update’s rollout window, that’s a genuinely new, first-party data point nobody had access to during the March, June or August updates this year — worth actively checking rather than relying on traditional Performance report data alone.
What to Actually Do This Fortnight
- Mark the rollout date in your own reporting now — 25 September in AEST — so any movement over the next two weeks gets read against the correct date, not the US-time date most global coverage reports.
- Compare like with like in Search Console — weekday against the same weekday, and against the equivalent window last month, not day-to-day.
- If you do see movement, work through the self-check list above before touching anything else on your site. A panicked content rebuild on a site that was never actually affected is the single most common overreaction to a spam update.
- If you find a genuine policy issue, fix it properly and then be patient — Google’s own guidance points to months, not weeks, before compliance is reflected in rankings.
My Honest Take
I spent years in agency life watching teams reward speed and volume over whether the work was actually any good – publish more, spend less time per piece, move on to the next deliverable. Four spam updates in six months tells me Google’s systems are finally catching up to exactly that instinct, whether it’s coming from an agency’s content mill or an AI tool set to “publish 50 posts a week.” I don’t think that’s a coincidence, and I don’t think it’s going to slow down. If your content strategy depends on volume rather than something a genuine expert stood behind, this is the year that stops working quietly in the background and starts costing you rankings directly.
Frequently Asked Questions
Is the September 2026 spam update confirmed by Google?
Yes — Google confirmed it directly on its Search Status Dashboard on 24 September 2026, corroborated by Search Engine Journal and Search Engine Land the same day.
How long will the September 2026 spam update take to roll out?
Google’s own estimate is up to two weeks, though the company notes this is a maximum, not a guarantee it will take the full window.
What’s the difference between this and a core update?
A spam update targets specific policy violations (like scaled content abuse or link schemes) and requires fixing the actual violation before recovery. A core update reassesses overall content quality relative to competitors and requires genuine content improvement, not a specific fix.
Should I make changes to my site right now?
Only if you’ve identified a genuine, specific policy violation using the self-check list above. Making broad, reactive changes without a specific identified cause is the most common — and most counterproductive — response to a spam update.
Are AI-generated content sites specifically targeted by this update?
Google hasn’t confirmed this specifically for the September update, though the broader trend (four spam updates in six months, up from one in all of 2025) lines up with the well-documented rise in AI-generated publishing volume across the web. Scaled content abuse — content published at volume primarily to manipulate rankings — is one of the named policies most relevant to this trend.
See our compliance-literate approach to regulated-industry SEO, read the August 2026 spam update for context, or book a free strategy session if you’re seeing unexplained movement right now.
