Google September 2026 Spam Update: Was Your Site Hit? A Checklist

Google wrapped up its September 2026 spam update on October 8. The rollout began on September 24, covered every language and region, and took 13 days and 16 hours, longer than this year’s three earlier spam updates combined. Google has not said what exactly it changed.

If your rankings slipped in late September, the update is not automatically to blame. Here is how to check, and which risks matter most for a small business website.

What sets this update apart

A spam update is not a new rule. It is Google’s label for a significant upgrade to the automated systems that detect spam, including SpamBrain. Those systems run all the time; an “update” marks the point when they get noticeably better.

There have been four of them in 2026. The first three finished within three days. September’s stretched to almost two weeks:

Google gives no reason for the longer rollout. The practical takeaway: judge the impact once the rollout is over, not from the first few days.

Separating real losses from noise

Every update starts with alarming charts in third-party SEO tools, and this one had an extra complication. Search Engine Journal, citing SEOmonitor, reports that from September 26 many rank trackers recorded sharp swings that ordinary searchers never saw, and SEOmonitor’s explanation is that Google was returning incomplete and incorrect results to automated queries. Google has not confirmed this, so treat it as analysts’ interpretation.

So rely on your own Search Console data rather than someone else’s graph:

A genuine hit from the spam systems usually persists for several days and shows up in both impressions and clicks. A one-day dip in a rank tracker proves nothing on its own.

There is some early third-party data, too. Diib looked at 32,569 sites connected to Google Analytics and compared their share of unpaid Google traffic on September 24–26 with the same days a week before. The median share went from 34% to 31%, and the portion of sites that lost half or more of that share doubled from 5% to 10%. Diib itself calls this a preliminary read, and the data cannot tell which sites Google actually classified as spam. Treat it as background, not a diagnosis.

What to audit on a small business site

Most of Google’s spam policies target sites that game search on purpose: buying links, mass-producing pages, hiding text. A typical company website or online store rarely does that intentionally. Yet a few of these problems turn up on ordinary sites all the time, often without the owner knowing.

Back button hijacking deserves a closer look. Google declared it a violation in April 2026 and began enforcing the policy on June 15. Its announcement points out that the behavior often comes from a bundled library or an ad platform rather than the site owner, so a widget or ad tag can put your site at risk without you noticing.

On AI-assisted writing: Google does not ban generative content, and on October 1, 2026 it revised its guidance on the subject. The core message stands. Churning out pages that give readers nothing counts as scaled content abuse, and a human should still check the facts, titles and descriptions.

If the drop is confirmed

There are two scenarios, and they call for different responses.

You have a manual action. The Manual actions report describes the problem and lists the affected pages. Fix every issue on every listed page, make sure Googlebot can reach those pages, then file a reconsideration request explaining what you changed. According to Search Console Help, reviews usually take anywhere from a few days to a few weeks, and link-related ones can take longer. Do not send a second request while the first is pending.

There is no manual action, but traffic fell. That points to the automated systems. Google’s advice is to bring the site in line with its spam policies. Recovery is possible but slow: the systems need months to recognize that the site now complies. And if rankings relied on paid links, part of the loss is permanent, because whatever boost those links provided is gone once Google neutralizes them.

My view: on small business sites, the spam systems more often catch neglect than black-hat SEO. A CMS that has not been updated in years, forgotten plugins, unmoderated comments, scripts left behind by a previous contractor. Regular website maintenance removes most of these risks before Google ever sees them.

What to do next

1. Collect a few weeks of data after October 8 and compare it with the period before September 24 in Search Console.
2. Open the Manual actions and Security issues reports. It takes two minutes.
3. Go through the risk table above: comments, mass-produced pages, third-party scripts, links.
4. Avoid major site changes while future updates are rolling out, or you will not know what made the difference.

Not sure whether the update affected your site? Get in touch: we will review your Search Console data and tell you whether anything needs fixing.

Author: Sergey Filatyev, founder of the Veb-Dev studio.