Google September 2026 Spam Update: Two Weeks, No Named Targets, and Rank Trackers You Shouldn’t Trust

By Mark Buraga, Independent SEO Consultant, Growth Engine PH. Last updated 15 October 2026.

Google’s September 2026 spam update started on 24 September 2026 and finished on 8 October 2026, a rollout of 13 days and 16 hours (Search Engine Journal). It applies globally and to all languages. Google did not say which spam tactics it targeted. That makes it the longest spam update of 2026 by a wide margin, and the vaguest.

Two things make this one different from the June update we covered here. First, a two-week rollout means two weeks of noise, and noise is where bad diagnoses happen. Second, during that window our rank tracker told us one client had lost almost all of its page-one rankings. Search Console told us the opposite. This post covers what the update was, what we saw, and how to tell a real spam hit from a broken reading.

What Is the September 2026 Spam Update?

The September 2026 spam update is an algorithmic update to Google’s automated spam-detection systems. It began rolling out around 12:00 p.m. ET on 24 September 2026 and completed on 8 October 2026 (Search Engine Roundtable). Google’s announcement said it “applies globally and to all languages” and “may take up to two weeks to complete.” It took almost exactly that.

Google describes a spam update as a notable improvement to the automated systems it uses to detect spam (Google Search Central). There is no Search Console message when one affects you. The demotion is silent, so you find it by matching a drop to the rollout dates.

How Is This Spam Update Different From the Others in 2026?

It ran about five times longer than any spam update before it this year. Google’s own update history puts the 2026 spam updates at 19 hours and 30 minutes in March, 2 days and 1 hour in June, and 2 days and 16 hours in August (Search Engine Journal). September took 13 days and 16 hours.

A longer rollout changes how you read your data. A two-day update gives you a clean before and after. A two-week update overlaps with normal weekly swings, month-end reporting and anything else Google ships in that window. Barry Schwartz tracked visible ranking shifts on 25 to 27 September, 30 September and 4 to 6 October, and noted some people described the effect as close to a core update (Search Engine Roundtable). Three separate waves inside one rollout is a lot of room for a wrong conclusion.

What Did Google Say It Targets?

Nothing specific. Google has not said which spam tactics this update addressed (Search Engine Journal). That is a real change from June, when reporting indicated link spam and site reputation abuse were out of scope.

In practice this means you cannot rule any policy out. Every tactic in Google’s spam policies is in play: scaled content abuse, cloaking, sneaky redirects, scraped content, hidden text, expired domain abuse, site reputation abuse and link spam. If a site has a known weakness in any of those, check it.

One detail matters for link spam. Google says that when a spam update neutralizes spammy links, any ranking benefit those links gave the site is lost and “cannot be regained” (Google Search Central). Fixing the links will not bring that lift back. Only new, legitimate signals replace it.

How Big Was the Impact?

The best early data is directional. Diib looked at 32,569 sites with connected analytics and compared the share of visits from unpaid Google search on 24 to 26 September with the same days a week earlier (Search Engine Journal). The median share fell from 34% to 31%. The share of sites that lost half or more of that traffic rose from 5% to 10%.

Diib called it “an early read, not a verdict,” and that is the right way to hold it. It covers the first three days of a fourteen-day rollout. It also cannot say which of those sites Google actually flagged as spam.

What Did We Observe on the Sites We Track?

The clean sites we track came through the update without harm. The most useful data comes from a Philippine law firm we work with, because it has enough search traffic to measure.

Search Console, the firm’s whole site, daily averages:

Clicks held through the rollout and rose after it. Average position improved in both windows. Impressions did ease, but that decline started in August, before the update, and came from loosely related searches the site rarely won. We cannot tie it to the update, so we don’t.

AI visibility held too. In our weekly AI Mode check of 15 questions, the firm was named in 8 answers on 21 September and 9 on 5 October. The 28 September run was blocked by Google’s captcha on most questions, so we excluded it rather than guess.

That is the expected result. A spam update demotes policy violations. A site with no scaled content, no cloaking and no bought links has nothing for it to act on.

Why Did Our Rank Tracker Say the Opposite?

On the same law firm, our daily rank tracker showed 18 tracked keywords on page one on 22 and 23 September. Then the count started falling: 11 on 25 September, 5 on 3 October, 3 on 8 October, and 1 by 13 October. Read on its own, that is a site being wiped out by a spam update.

It wasn’t. The tracker was returning blanks, not lower positions. For 7 to 13 October, Search Console still had those keywords on page one. “criminal lawyer philippines” ranked around #2. “cybercrime lawyer philippines” ranked around #3. “cyber libel” ranked around #6, across 3,935 impressions and 20 clicks. The tracker showed all three as not found.

Our data provider told us Google was serving different, sometimes unrelated result sets to some sessions during the rollout, and that the issue was industry-wide. That did not explain the blanks that continued after the rollout ended on 8 October, so we tested it. We sent the same 18 “lost” keywords through the provider twice at the same time. One run found the firm on 7 of them, the other on 8, and they disagreed keyword by keyword. The same keyword could read #5, then “not found” a few minutes later. A real Google search had the firm’s cyber libel guide at #7.

So we changed how we report. Every daily ranking is now checked against Search Console. Where Google’s own data has the keyword, that position is shown as confirmed. Where it doesn’t yet, the tracker’s reading is shown as unconfirmed until Google catches up, usually two to three days later. A tracker blank on its own no longer counts as a lost ranking.

The lesson is simple. A rank tracker is a sample of what one session saw. Search Console is what Google actually showed your site to real searchers. When they disagree during an update, Search Console wins. Search Engine Journal gave the same advice: a decline that lasts several days across both impressions and clicks in Search Console carries more weight than short swings in third-party trackers (Search Engine Journal).

What Should SEO Consultants Do About the September 2026 Spam Update?

Use case: a client sees a red number on a dashboard and asks if the update hit them.

The lesson: the long rollout and a misbehaving tracker can make a clean site look like a casualty. Your job is to check the source before you answer.

Actions to apply now: – Check Search Console clicks and average position for the window before 24 September against 24 September to 8 October. If clicks held, the update did not hit the site, whatever the tracker says. – Check each “lost” keyword in Search Console for the same dates before you report it as lost. A blank in a tracker is not a ranking. – If clicks did fall and stayed down, match the timing to the three volatility waves (25 to 27 Sept, 30 Sept, 4 to 6 Oct), then work through every spam policy. This update named no targets, so none is ruled out. – Pause any performance figure that depends on daily rank data from this window until the data is verified.

What Should Agencies Do About the September 2026 Spam Update?

Use case: you report rankings to many clients from one tracker, so one tracker fault becomes many bad reports.

The lesson: a data fault looks like a crisis when it shows up across a whole portfolio at once. If every client “dropped” on the same days, suspect the data before you suspect Google.

Actions to apply now: – Compare the tracker’s page-one count with Search Console for a few accounts. If the tracker fell and Search Console did not, flag every client report that uses tracker data from 24 September onward. – Tell clients before they see it. A short note that says “the update did not affect you, and here is the Search Console data” builds more trust than explaining a scary chart after the fact. – For clients who really did drop, give an honest timeline. Google says sites that fix violations may recover as its systems learn “over a period of months” (Google Search Central). There is no reconsideration request for an algorithmic demotion. – Check every client’s backlink profile this time. June’s update reportedly left link spam alone. This one named no exclusions.

What Should Business Owners and Marketing Managers Do?

Use case: you run the business or own its marketing, and leads or calls went down. Someone suggests it was the Google update.

The lesson: the update is one possible cause, and it is the easiest to check. Check it first, then look at the rest.

Actions to apply now: – Ask for one number: Search Console clicks before and during the rollout. If they held, Google did not demote your site, and the cause of fewer leads is somewhere else. – If clicks held but leads fell, look at the lead side. Is every form and call actually being counted? Did leads shift to phone, chat or referral? Did one service area slow down while others held? – If clicks really fell, ask which pages lost them. A spam demotion hits specific pages or tactics, so the fix is page by page, not a site rebuild. – Be wary of anyone selling an emergency fix for a site that did not drop.

The Action Checklist

• Compare Search Console clicks and position for before 24 September against 24 September to 8 October.
• Treat Search Console as the source of truth when it disagrees with a rank tracker.
• Check every “lost” keyword in Search Console before reporting it.
• Pause performance figures that depend on tracker data from this window until the data is verified.
• If clicks fell and stayed down, match the timing to the waves on 25 to 27 Sept, 30 Sept and 4 to 6 Oct.
• Audit against every spam policy, links included; this update named no exclusions.
• Expect any real recovery to take months, with no reconsideration request for algorithmic demotions.
• If traffic held but leads fell, audit lead tracking and lead sources before touching the site.

Our Take: Where This Update Is Heading

Spam updates are getting longer and quieter. Google named no targets, took two weeks, and left the industry to work out the impact from noisy data. That pushes the burden onto how well you measure, not how fast you react.

It also exposes a weak point in how SEO gets reported. Many dashboards still rest on daily rank checks from a single session, and those checks broke during this rollout. The firms that came through calmly were the ones reading Search Console and real lead data, not a ranking chart. The same shift is happening in AI search, where we track whether a firm is named in answers rather than where a blue link sits. Measure what customers actually see.

If you are not sure whether this update touched your site, or whether your reports are reading broken data, that is the kind of check we do. See what an engagement looks like, or tell me what moved. Every update we cover is listed in our Google Updates hub.

Frequently Asked Questions

When did the September 2026 spam update roll out? Google started the September 2026 spam update on 24 September 2026, around 12:00 p.m. ET, and completed it on 8 October 2026. The rollout took 13 days and 16 hours, much longer than the March, June and August 2026 spam updates, which each finished in under three days.

What did the September 2026 spam update target? Google did not say. Its announcement only stated that the update applies globally and to all languages. Because no tactics were named or excluded, every spam policy should be treated as in scope, including scaled content abuse, cloaking, site reputation abuse and link spam.

How do I know if the September 2026 spam update hit my site? Compare Search Console clicks and average position before 24 September with 24 September to 8 October. A real hit shows as a sustained drop in clicks and impressions that lines up with the rollout. If clicks held, the update did not demote your site, even if a rank tracker shows losses.

Why does my rank tracker show big losses after the update? Rank trackers sample one search session at a time. During this rollout, some tools returned blank or inconsistent results while Search Console showed the same keywords still on page one. Check each lost keyword in Search Console before acting. If Search Console shows it ranking, the tracker data is wrong.

Can the September 2026 spam update cause fewer leads? Only if it reduced the search traffic that brings those leads. Check Search Console clicks first. If clicks held steady through the rollout, the drop in leads has another cause, such as lead tracking gaps, a shift to phone or referral enquiries, or demand changes in a specific service area.

How long does recovery from a spam update take? Google says sites that fix spam policy violations may see changes as its systems learn over a period of months. There is no reconsideration request for an algorithmic spam demotion. If the demotion came from links that were neutralized, Google says that lost ranking benefit cannot be regained.

Is the September 2026 spam update a core update? No. Google classed it as a spam update, which retunes the systems that detect spam policy violations. Some observers said its effects looked similar to a core update, partly because of its length, but the diagnosis is different: a spam hit traces back to specific policy violations.

Should I disavow links after the September 2026 spam update? Only if you have evidence of a link problem and a matching drop in Search Console. Unlike the June update, this one did not exclude link spam, so links are worth checking. Disavowing will not restore any lift Google already neutralized, and it will not fix a content problem.

Sources

• Search Engine Journal, Google Completes September 2026 Spam Update After Nearly 14 Days
• Search Engine Roundtable, Google September 2026 Spam Update Is Done Rolling Out
• Google Search Status Dashboard, September 2026 spam update
• Google Search Central, Google Search spam updates
• Google Search Central, Spam policies for Google web search