Google's September spam update: done after nearly two weeks - target still unexplained

Google's Search Status Dashboard marked the end with a one-line note: "The rollout was complete as of October 8, 2026." That closed out the September 2026 spam update, which Google released on September 24. The dashboard puts the start at 09:15 and the end at 01:00, US/Pacific time. Barry Schwartz, executive editor of Search Engine Roundtable, put it as starting around 12:00 pm ET on Thursday, September 24 and completing at 4:37 am ET on October 8. Why it matters if you run a business: if your website's Google traffic moved in the last two weeks, you now have a closed window to measure against, and a short list of rules worth checking your site against before you spend money reacting.

This spam update outlasted both of this year's core updates

Google said at launch that the update "applies globally and to all languages" and that "the rollout may take up to two weeks to complete." It used nearly all of that time. Google's own ranking history lists the September 2026 spam update at 13 days and 16 hours, longer than either of the two core updates Google ran earlier in 2026. According to the same dashboard history, the May 2026 core update took 11 days and 21 hours and the March 2026 core update took 12 days and 4 hours.

The contrast with other spam updates is sharper still. Search Engine Journal noted that this year's three earlier spam updates took 19 hours and 30 minutes in March, 2 days and 1 hour in June, and 2 days and 16 hours in August. A long spam rollout is not without precedent, though: Search Engine Journal also pointed out that the August 2025 spam update ran from August 26 to September 22, 2025, about 27 days.

Google, for its part, described it as routine. Search Engine Roundtable reported that Google said on LinkedIn, "This is a normal spam update, and it will roll out for all languages and locations." Schwartz was openly skeptical: "I am not sure why this is 'normal' when it took two weeks to roll out instead of two days but what do I know."

Google has not said what this update was aimed at

Google's spam updates documentation describes a spam update as a notable improvement to its automated systems for detecting spam. It names SpamBrain as its "AI-based spam-prevention system," which Google says it improves from time to time to make it better at spotting spam and "to help ensure it catches new types of spam." That is the general description. It does not tell you what changed this time.

As of publication, Search Engine Journal reported, neither Google's spam updates documentation nor the update's two dashboard notes say what the September rollout addressed or why it took longer than this year's earlier spam updates. In his quick-facts summary, Schwartz lists the target as sites violating some of Google's spam policies and says the update does not target link spam. That matters, because Google's documentation warns that after a link spam update, any ranking benefit lost from spammy links cannot be regained.

Early traffic data points to a minority taking heavy hits

The best outside numbers so far come from Diib, which on September 29 published early data from 32,569 websites with connected Google Analytics, according to Search Engine Journal. Diib compared each site's share of visits coming from unpaid Google search on September 24 through 26 with the same days a week earlier. It used share rather than raw visits because overall traffic fell that week.

The median share went from 34% to 31%. Diib found that 10% of sites saw their share of unpaid Google search visits drop by half or more, compared with 5% in the earlier week. Read together, those two numbers suggest the typical site moved a little while a smaller group moved a lot. Diib itself called the findings "an early read, not a verdict" and said its data does not reveal which sites Google identified as spam.

Schwartz wrote that the update seemed pretty impactful and that "some are saying more core update like of an impact," before adding, "I am not sure about that." He logged the dates where he saw impact: September 25 through 27, September 30, and October 4 through 6. He was careful to say this assumes Google ran no other updates during the rollout, which he does not know for sure.

Rank tracker charts may have shown drops searchers never saw

This is the part that can save you a panicked phone call. According to SEOmonitor, many rank trackers across the industry showed sudden ranking changes starting September 26 that people searching on Google did not see. SEOmonitor attributes this to Google returning incomplete and incorrect results to automated searches. The company added that spam-related changes usually hold over several days and often show up in Search Console impressions and clicks.

Think of it like a weather app versus looking out the window. A rank tracker is a third-party tool that runs its own automated searches and reports what came back; Search Console is Google's own count of how often your site appeared and was clicked. If the app says storm and the window says sun, trust the window. It is also worth knowing that Google's spam policies list scraping results for rank-checking purposes without express permission as machine-generated traffic that violates those policies.

If your rank tracker showed a sudden fall starting in late September, open Search Console before you do anything else. Search Engine Journal gives the same advice: a decline that lasts several days and shows up in impressions and clicks carries more weight than a quick swing on a third-party chart, and a dip during this period does not automatically mean the update caused it. With the rollout complete, September 24 through October 8 gives you a fixed window to compare before, during and after as more data comes in.

Several spam rules describe things ordinary business sites do

Google's spam policies page defines spam as techniques used to deceive users or manipulate Search, including "attempting to manipulate generative AI responses in Google Search." Google says it detects violations through automated systems and, as needed, human review that can result in a manual action. Most of the page covers practices no clinic or contractor would knowingly use. A few deserve a second look, because a site owner may not have put them there personally.

Google's spam policies list two examples any business serving several towns should check its own site against: pages for specific cities that funnel visitors to one page, and blocks of text listing the cities and regions a page is trying to rank for. The first sits under what Google calls doorway abuse, the second under keyword stuffing. Two more are worth a look:

• Hacked pages. Google says hackers can add new spammy pages to a site, and that "your existing pages might not show signs of hacking."
• Links traded for favours. Under link spam, Google includes exchanging goods or services for links and sending someone a product in exchange for writing about it with a link. Google says paid or sponsored links are acceptable when marked with a rel value of nofollow or sponsored.

Google's documentation says fixes are slow to pay off: making changes may help a site improve if its automated systems learn over a period of months that the site complies with its spam policies. Sites that violate the policies, Google says, may rank lower or not appear in results at all.

What Google still has not told anyone

The other side: Google has not published what the September 2026 spam update addressed, why it ran nearly 14 days when its earlier 2026 spam updates each took under three, or how many sites it touched. The only traffic numbers are Diib's, drawn from sites that connected Google Analytics and covering just the first three days, and Diib says they do not show which sites Google flagged. Schwartz's impact dates rest on the assumption that nothing else changed in Google during the rollout, which he says he cannot confirm. And SEOmonitor's warning cuts both ways: some of the chart turbulence people cited as proof of a big update may have been bad data rather than real ranking changes.

Bottom line

The September 2026 spam update is over, it ran unusually long, and Google has not said why or what it went after. For most business owners the right move is unexciting: pull up Search Console, compare clicks and impressions before September 24, during the rollout, and after October 8, and only worry if a drop held for days in Google's own numbers.

If it did, read Google's spam policies with your city pages, location lists, link arrangements and site security in mind, fix what applies, and expect months rather than days before it shows. When did you last look at your own Search Console instead of someone else's chart?