Google spam update September 2026: were you hit, and what to do

Google's September 2026 spam update began rolling out on 24 September. It applies worldwide, to every language, and Google expects it to take up to two weeks — so it should finish around 8 October, this week. If you opened your analytics on Monday and the graph looked wrong, this update is one of the first things to rule out. Below: how to tell whether your site was actually hit, what Google counts as spam in 2026, and what to do about it either way.

What the September 2026 spam update actually is

Google's search status dashboard has the facts: the September 2026 spam update started on 24 September, applies globally and to all languages, and may take up to two weeks to complete. That puts the finish line at roughly 8 October.

A spam update is Google tightening the systems that decide which pages are trying to game its results. Sites leaning on tricks lose visibility. Sites playing straight usually don't move much — and some pick up ground as competitors drop.

One disambiguation, because the word trips people up every time: this is about search results, not email. If your problem is mail landing in customers' spam folders, that's SPF, DKIM and DMARC territory — a different subject, and one we've covered separately in our guide to why emails land in spam.

And a note on timing: rankings wobble while a rollout is in progress. Don't judge your site on this week's numbers alone.

Two spam updates in six weeks: the 2026 running guide

So far this year, Google has announced two spam updates:

| Update | Announced | Rollout | Scope | | --- | --- | --- | --- | | August 2026 spam update | 18 August | Complete as of 21 August | Not stated in the announcement | | September 2026 spam update | 24 September | Due to finish around 8 October | Global, all languages |

Both confirmed updates we're tracking are spam updates rather than core updates — narrower affairs aimed at manipulative tactics, not broad reassessments of every page on the web. If Google confirms other update types later in the year — a core update, say — they go into this table too.

The pattern is the story. Two spam updates inside six weeks looks like sustained enforcement rather than an annual purge. If your site runs on marginal tactics, the likelier future is being caught progressively across updates, not all at once. That changes the calculus: waiting to see whether the next update spares you is a worse strategy than tidying up now.

Two honest limits. Google doesn't announce targets in advance, and it doesn't publish a list of demoted sites. "Who it hit" is inferred from the tactics Google's spam policies name and what site owners report — we'll stick to that rather than speculate.

Last updated: 6 October 2026. This post is our running guide to this year's Google search ranking updates: each spam update goes into the table as Google confirms it, with dates, scope and plain-English impact. Bookmark it — this is the record we keep current.

Were you hit? The Monday-morning check

You can run this in Google Search Console in about fifteen minutes.

1. Set the comparison window. Open Search Console, then Performance, then Search results, and use the date comparison. It needs two fixed date ranges — "24 September onwards" isn't an option it offers. For a first read today, compare like with like: 12–23 September against 24 September–5 October. Twelve days against twelve. The most recent day or two of data will still be filling in, so discount it mentally.

2. Split branded from non-branded. In the Queries tab, filter queries with a regex covering your brand name. For us it would be:

codexio|codex io

Swap in your own name. Branded queries are people typing your business name; non-branded is everyone else — and it's the non-branded half that spam demotions hit. The signature of a spam hit is non-branded impressions and clicks falling sharply around the rollout dates while branded queries hold steady. People don't stop searching for you by name because Google demoted your town pages.

3. Open the Pages tab. Which landing pages lost impressions tells you what was demoted, and it usually names the tactic. If only your location pages dropped, that points at doorways. If a batch of blog posts published in one week dropped together, that points at scaled content. A page-by-page pattern is more diagnostic than the site-wide total.

4. Mind the timing. The rollout should complete around 8 October, and Search Console data lags a couple of days. So: a first read now, a confirmation read after 8 October, and the definitive four-weeks-either-side comparison — 27 August–23 September against 24 September–21 October — run on 23 or 24 October, once the final days of data have landed. A scary number on 7 October isn't a verdict.

5. Don't conflate surfaces. Spam updates target organic web results. Your Google Business Profile and map-pack presence run on a separate system — if enquiries dried up, check which surface actually dropped before assuming the worst. Our Business Profile checklist covers what to look at there. Paid listings are separate too: a spam update doesn't touch Google Ads.

What counts as spam in 2026, in plain English

Google doesn't publish a target list for each update. What it does maintain is a standing set of spam policies, and those policies are what spam updates enforce. Here's the plain-English version of the ones that catch real businesses.

Scaled AI-written pages. Mass-producing content with little human input or original value — the two hundred blog posts in a week approach, each a rewording of the last. Drafting with AI is fine; we use it for first passes like anyone else. Publishing unedited AI output at scale is what gets demoted.

Doorway location pages. The classic trade-business risk. "Plumber in Leeds", "Plumber in Manchester", "Plumber in Birmingham" — near-duplicate pages that exist to catch searches rather than serve them. The test is simple: if a town page would read identically with the place name swapped, it's a doorway.

Expired-domain tricks. Buying an old domain for its leftover authority and repurposing it for unrelated content — a tactic some clinics and lead-gen sites have tried. Google has got better at spotting the break in a domain's history: the archive shows a decade of one business, then a sudden pivot to another.

The classics still apply. Hidden text, bought links, copied content, and renting out sections of your site to third-party pages. None of that has aged into respectability.

Who actually gets hit? Google publishes no list of demoted sites. From the tactics these policies name, the profile is sites that grew pages faster than they grew genuine expertise. It isn't small sites, and it isn't thin sites simply for being thin — a five-page site with honest pages has nothing to fear from this update.

You were hit: the triage list

Work down this list in order. It resists panic, which is the main thing.

1. Confirm the diagnosis with the check above before touching anything. Often, apparent update hits turn out to be tracking breakage or seasonality instead.
2. Rule out a manual action. Search Console has a manual actions report. Spam updates are algorithmic: no notification, no reconsideration request. Manual penalties come with a message and a formal process. If that report is empty, you're dealing with the algorithm.
3. Audit the content. List every page published in bulk, every town page, anything you couldn't defend reading aloud to a customer. Consolidate or rewrite with real detail; delete what has no job.
4. Fix doorways properly. Merge thin location pages into one strong service page, or rebuild each page with genuinely local proof — jobs done, names, photos, prices.
5. If you bought the domain second-hand, check its history. Archive snapshots will show what the domain used to be and whether you inherited a problem.
6. Then wait, and be honest about it. There is no appeal form for algorithmic demotions. Recovery tends to arrive with a future update, weeks or months out, and only if the tactic is genuinely gone. Anyone promising a fast fix is selling something.

While you work through the list, run our free SEO audit tool. It flags thin titles, indexing faults and technical problems that compound a content demotion — the sort of things worth fixing regardless.

You weren't hit: four other reasons traffic drops in October

Most owners who run the check above will find no spam signature. Before you start "fixing" a non-problem, consider the usual suspects.

• Seasonality and demand shifts. Compare year on year, not just week on week, before blaming an update — October is not September. A landscaper's dip this month says more about the weather than about Google.
• AI answers taking clicks. AI Overviews and assistants now answer many queries directly, which depresses clicks even when impressions hold. Different problem, different fix.
• Technical and indexing faults. Pages accidentally noindexed, canonical mistakes, crawl problems. We've a plain-English guide to how Google finds, reads and stores your pages — worth ruling out before you blame an update.
• Tracking breakage. A dropped analytics tag reports a drop that never happened. Check a second source before acting on any number.

The durable answer: fewer, better pages — and being findable beyond Google

Every spam update rewards the same posture: pages that exist because a customer needs them, written by someone who has actually done the work. That's the whole strategy. The tactics in the spam list are just the ways sites drift off it — usually gradually, usually with an agency's reassurance.

Diversify the surface while you're at it. Assistants like ChatGPT increasingly recommend local businesses directly, and being cited there doesn't rise or fall with Google's spam systems. Our free AI readiness check shows how your site reads to them, and our AI search service covers the work of earning those recommendations.

If this post surfaced problems you don't have time to fix, that's our day job — our SEO service covers audits, content and Business Profile work.

Book a free call and we'll give you an honest read on whether you were hit and what it would take: book a free call.

Questions people ask

Found this useful? Share on LinkedIn · Email it to someone