Google has begun rolling out its September 2026 spam update, and this one breaks from the pattern set earlier this year. Here’s what’s confirmed, why the timeline matters more than usual, and what to actually do about it if you manage a website.
What Happened
According to Google’s Search Status Dashboard, the update began rolling out globally, across all languages, on September 24, 2026, at 09:15 Pacific time. Google’s own language for the release was standard and sparse: the update “applies globally and to all languages,” and “the rollout may take up to two weeks to complete.”
No blog post accompanied the announcement, and Google gave no indication of which spam tactics or policies it’s specifically targeting this time. As we’ll get to, that’s actually normal.
The Detail That Makes This One Different
The number worth paying attention to isn’t the release date. It’s the two-week rollout estimate. Every other spam update this year finished in days, not weeks.
| Update | Rollout Duration |
|---|---|
| March 2026 | 19 hours, 30 minutes |
| June 2026 | 2 days, 1 hour |
| August 2026 | 2 days, 16 hours |
| September 2026 | Up to 2 weeks (estimated) |
That’s roughly six to eighteen times longer than what Google has told site owners to expect all year. A longer estimated window doesn’t necessarily mean a more severe or more disruptive update. Google’s stated timelines are always upper-bound estimates, and updates sometimes wrap up well before the deadline. But it does mean one practical thing: if your traffic or rankings shift at any point over the next two weeks, you won’t be able to assume the update has already finished the way you could in March, June, or August. The attribution window is simply longer this time.
Fourth Spam Update of the Year
This marks the fourth confirmed spam enforcement action of 2026, following updates in March, June, and August, a noticeably faster cadence than in recent years, when Google typically issued one or two spam updates annually. Whether that reflects an uptick in spam Google is trying to get ahead of, or simply a shift in how proactively the SpamBrain team is iterating, isn’t something Google has commented on publicly.
What a “Spam Update” Actually Does
It’s worth being precise about this, because “spam update” and “core update” get used interchangeably by people who haven’t dealt with either, and they behave very differently.
A core update re-evaluates how Google assesses content quality and relevance broadly. It can lift sites up as easily as it pushes them down, because it’s fundamentally about re-ranking based on quality signals. A spam update is narrower and one-directional: it’s an enforcement action against sites already violating Google’s spam policies, things like cloaking, link manipulation, scraped or mass-produced content, and deceptive redirects. You don’t get “promoted” by a spam update. At best, if you were never violating anything, it simply doesn’t touch you.
The mechanism behind most of this enforcement is SpamBrain, Google’s AI-based spam-detection system, which the company periodically retrains and tunes rather than releasing as a single static tool. A spam update is the public marker of one of those tuning cycles. Google’s automated systems are detecting spam constantly, but the update label refers specifically to a notable improvement to how that detection works.
If You See Ranking Changes During This Window
Given the two-week runway, here’s a more useful way to approach monitoring than just watching Search Console anxiously every day:
Separate signal from noise. A day or two of fluctuation is common during any rollout and isn’t diagnostic on its own. Look for a sustained trend across at least 4 to 5 days before concluding the update is actually responsible for a change you’re seeing.
If you drop, audit against Google’s actual spam policies, not against a general sense of “quality.” Spam updates hit specific, definable violations: aggressive link schemes, auto-generated content at scale, cloaking, or abusive redirect patterns. If none of those describe your site, a drop during this window is more likely coincidental or related to something else entirely (a core update lag effect, a technical issue, seasonal demand).
Don’t expect instant recovery from genuine fixes. If you do find and correct a real violation, Google’s systems need time, often measured in months, not days, to reassess and confirm compliance. This is especially true for link-based penalties: once Google’s systems discount the ranking value of manipulative links, that value doesn’t come back even after the links are removed or disavowed. The fix stops future harm; it doesn’t retroactively restore what was lost.
Keep a timestamped log. Note exactly when you observe changes, and cross-reference against the dashboard’s eventual completion notice. This is the only reliable way to distinguish “the spam update did this” from “something unrelated happened to coincide with it.”
What We Don’t Know Yet
Google hasn’t disclosed a target category for this update, and it may never do so explicitly. That’s consistent with how March, June, and August were handled too. The only reliable signal will come after the fact: once the rollout completes, third-party rank-tracking tools (Semrush Sensor, SISTRIX, Mozcast, and similar) typically show which niches or content types saw the most volatility, which is often the best available clue as to what actually got targeted.
We’ll update this piece once Google posts the completion note on the Search Status Dashboard.
