Google's September 2026 spam update ran from September 24 at roughly 12:00pm ET to October 8 at 4:37am ET, according to Google's own Search Status Dashboard. That's 13 days and 16 hours, Google's longest spam-fighting rollout since August 2025 and, per Search Engine Roundtable's tracking, the longest of any Google spam update since the July 2021 link spam update, which took 29 days. For comparison, the June, August, and March 2026 spam updates each wrapped in one to seven days.

If your traffic moved in late September or early October and you're trying to work out why, here's what's confirmed directly from Google, what SEOs observed independently, and what to actually do about it.

What Google confirmed, in its own words

Google's announcement, posted to its Search Central channels, said the update "is a normal spam update, and it will roll out for all languages and locations," and that it targets "sites violating some of the Google search spam policies." That's it. Google did not name a specific policy category, did not say what percentage of queries were affected, and did not single out a content type, industry, or site structure. That vagueness is standard practice for Google spam updates; it rarely gets more specific than pointing you back to the general spam policies documentation.

Those policies cover 16 categories: cloaking, doorway abuse, expired domain abuse, hacked content, hidden text and link abuse, keyword stuffing, link spam, machine-generated traffic, malicious practices, misleading functionality, scaled content abuse, scraping, site reputation abuse, sneaky redirects, thin affiliate content, and user-generated spam. A "spam update" is Google re-running its spam-detection systems against the full index and adjusting which pages get demoted or removed for violating one or more of those. It isn't a single new algorithm; it's an enforcement pass.

What SEOs observed, which Google didn't confirm

Here's where the picture gets more specific, but also less official. PPC Land's reporting and Search Engine Roundtable's Barry Schwartz both tracked three distinct windows of elevated ranking volatility during the rollout: September 25-27, September 30, and October 4-6. PPC Land says it logged elevated movement starting even earlier, around September 22, two days before Google's own stated start date.

The more notable pattern SEOs flagged wasn't algorithmic ranking movement, it was a jump in manual actions, the kind triggered by an actual human reviewer at Google, not just automated demotion. SEO consultant Marie Haynes told PPC Land she'd seen "a big increase in requests for help with manual actions lately," moving from essentially zero such requests to several a week, and said most of the affected sites she was seeing were "legitimate long standing businesses," not obvious spam operations. Schwartz separately reviewed a dozen threads on Google's Webmaster Help forum and found a repeating pattern: site owners who'd removed thousands of URLs (one case removed 4,000, another more than 6,000) and still had their manual action rejected on reconsideration, often tied to thin content or what Google's notices described as "major spam problems" concentrated in /blog/ directories. Consultant Daniel Foley Carter attributed the spike to "SEO shortcuts, scaled content abuse, and businesses cutting SEO budgets," and described some cases losing "90% or more of traffic lost overnight."

To be clear about sourcing: the 13-day duration and global scope are confirmed by Google directly. The specific tactics apparently getting hit, scaled content abuse and thin /blog/ content above all, come from SEO practitioners reviewing public forum threads and client cases, not from a Google statement naming those categories. Treat it as a strong pattern, not an official target list.

How this fits the rest of 2026's spam updates

This wasn't Google's only spam enforcement action this year. March, June, and August 2026 each saw a spam update, and per Search Engine Roundtable's tracking, every one of those wrapped inside a week, several in under two days. September's 13-day-plus rollout breaks that pattern by a wide margin, close to seventeen times longer than March's update, which PPC Land clocked at roughly 19.5 hours. Google's own internal range for a typical spam update, stated in its documentation, is one to two days. A rollout seven times that length, while still described by Google as "normal," suggests either a much larger set of affected sites than usual or a more complex detection pass, though Google hasn't said which. Either way, if you escaped the March, June, and August updates clean but got hit this time, that's consistent with what site owners reported: September's update reached further than the earlier ones did.

How to tell if this hit you

Two different mechanisms can be in play, and they call for different checks.

Algorithmic demotion (no manual action, rankings just dropped): Open Search Console, go to Performance, and overlay your clicks and impressions against the September 24 to October 8 window specifically. A drop that starts inside that window and holds, rather than a single-day dip that recovers, points at the spam update rather than normal volatility. Check whether the drop is site-wide or concentrated in specific sections, since the forum pattern Schwartz found concentrated damage in blog and content-hub directories rather than core product or service pages.

Manual action (an actual penalty, visible and explicit): This one isn't ambiguous. Open the Manual Actions report in Search Console. If your site has one, you'll see it listed there with the specific violation type, not a vague ranking drop you have to infer. If that report is clean, you're dealing with algorithmic effects, not a manual penalty, even if your rankings fell during the same window.

Recovery steps that actually apply

If it's a manual action, Google's own process is explicit: fix every affected page, not a sample of them (Google states partial fixes earn no partial restoration), confirm the pages are accessible to crawling and not blocked by login walls, paywalls, or robots.txt, verify the fix with the URL Inspection tool, then file a reconsideration request that specifically describes what was wrong and what you did about it. Google's own guidance on recovery timelines is blunt: it "can take many months," and resubmitting before you get a decision on the first request doesn't speed anything up.

If it's algorithmic rather than a listed manual action, there's no reconsideration request to file. Audit against the spam policy categories most consistent with what SEOs observed this cycle: thin or low-value pages published at scale, content in blog or resource sections that doesn't add anything beyond what's already well-covered elsewhere, and any unnatural link patterns pointing at or from your domain. If you find a real link spam problem on either side, how to disavow links covers the process. For a broader structural check of what actually affects rankings versus what's SEO folklore, the technical SEO checklist that actually moves rankings is a reasonable place to start an audit after a spam update, rather than guessing at fixes one at a time.

The honest caveat: without a Google-confirmed target, any fix list is an educated guess based on pattern-matching across affected sites, not a guarantee. If your content is genuinely original, adds real information, and isn't built on manipulative linking, you're very likely not who this update was aimed at, even if your rankings moved during the window for unrelated reasons (seasonality, a competitor's content refresh, a technical issue on your own site).

The AI-content guideline update, separated from the spam update

Running in parallel, and frequently conflated with the spam update in casual coverage because of the timing, Google quietly updated its guidance page on generative AI content on October 1, 2026, aligning it with sections 4.6.5 and 4.6.6 of the Search Quality Rater Guidelines. Search Engine Journal reported this wasn't a formal announcement, Google simply posted it to its documentation changelog, and SEJ was the one that flagged it publicly.

Here's what the updated page actually says, in Google's own words: "generative AI outputs may contain inaccuracies (also known as hallucinations)," and "it is critical to manually factcheck and review all AI-generated content for accuracy and trustworthiness before publishing." Google explicitly extends that review requirement beyond body copy to metadata: title tags, meta descriptions, structured data, and image alt text, any of which can appear directly in search results. The guidance also restates something Google has said before but worth repeating here: using generative AI to "generate many pages without adding value for users may violate Google's spam policy on scaled content abuse," which is the direct link between this documentation update and the spam update running at the same time, both point at the same underlying problem of AI tools making it cheap to publish volume without adding value.

What this isn't: a new penalty for using AI to write content, a requirement to disclose AI usage publicly, or a detector that flags "AI-written" text for demotion. Google has said consistently, including in this update, that content quality and usefulness are what matter, regardless of how it was produced. What it actually is: a fact-checking obligation Google is making explicit, because hallucinated claims, including in places you might not think to check like your own meta descriptions or alt text, create the kind of inaccurate, low-trust content the spam policies already prohibit. If you're running AI-assisted content production at any volume, that metadata line is the practical takeaway: someone needs to be reading your AI-generated titles and alt text before they go live, not just your article bodies.

The ecommerce detail is easy to miss but worth flagging if you sell products: the updated page specifies that AI-generated product images need the IPTC DigitalSourceType field set to TrainedAlgorithmicMedia, and AI-generated product data needs to be separately labeled as such. If your product feed or image pipeline runs through a CMS or PIM tool, check whether it's writing that metadata automatically or whether that's now a manual gap in your process. The groundwork for getting any of your pages, AI-assisted or not, structured well enough for Google and AI systems to parse cleanly is covered in semantic HTML for SEO.

For more on what else changed in search this week, including the AI Overviews and ChatGPT ads stories running alongside this one, see this week's AI search news roundup.

FAQ

How long did the September 2026 spam update take?

13 days and 16 hours, from September 24 at roughly 12:00pm ET to October 8 at 4:37am ET, confirmed on Google's Search Status Dashboard. That's Google's longest spam update rollout since August 2025.

Did Google say what this update specifically targeted?

No. Google's public statement described it only as "a normal spam update" enforcing its existing spam policies globally, without naming a specific category. SEO analysts who reviewed affected sites and forum reports observed a pattern concentrated in thin and scaled content, especially in blog sections, but that's independent observation, not a Google-confirmed target.

How do I know if I got a manual action versus an algorithmic hit?

Check the Manual Actions report in Search Console. If it's empty, you weren't manually penalized, even if rankings dropped during the update window; that points to algorithmic effects instead, which don't have a reconsideration process.

Is Google penalizing AI-written content now?

Not based on how it was produced. Google's October 1 documentation update requires manually fact-checking AI-generated content, including metadata, before publishing, and reiterates that mass-producing low-value AI content can trigger the existing scaled content abuse policy. Well-researched, accurate content isn't penalized for having used AI in its production.

How long does recovery take after a manual action?

Google's own guidance says it "can take many months." There's no fixed timeline, and resubmitting a reconsideration request before getting a decision on your current one doesn't speed up the review.