Google’s September 2026 Spam Update Is Live: What It Means for Your Rankings

Google started rolling out the September 2026 spam update on 24 September 2026 at 9:15 a.m. Pacific time, which was 7:15 p.m. in Kenya. It applies globally and to all languages, and Google says the rollout may take up to two weeks. When this article was published on 26 September, the Google Search Status Dashboard had not yet posted a completion notice.

If your rankings or enquiries move over the next fortnight, this guide explains what Google has said, what it has not said, and how to check your own data before you change anything on your site.

Key Takeaways

• The September 2026 spam update began on 24 September 2026, covers every country and language, and may take up to two weeks to finish.
• Google has not named a specific spam policy or tactic that this update targets.
• It is the fourth confirmed Google spam update of 2026, after March, June and August, and the first this year with a two-week window rather than “a few days”.
• AI-generated content is not spam by default. Publishing many low-value pages can break Google’s scaled content abuse policy however those pages were made.
• Judge the impact only after the rollout ends, by comparing Search Console data from before and after 24 September.
• Google says recovery can take months, and ranking benefit from spammy links does not come back once removed.

What Is the September 2026 Google Spam Update?

The September 2026 spam update is an improvement to the automated systems Google uses to detect search spam. Google released it on 24 September 2026 for all regions and languages, with a rollout window of up to two weeks. Sites that break Google’s spam policies may rank lower or drop out of results entirely.

Google’s spam detection runs all the time. According to Google’s documentation on spam updates, the company calls it a spam update when it makes a notable improvement to those systems. One of them is SpamBrain, Google’s AI-based spam prevention system, which Google improves from time to time so it catches new types of spam.

A spam update is not the same as a core update. Core updates are broad changes to how Google ranks content overall. Spam updates are about detecting practices that break the spam policies.

How September compares with earlier 2026 spam updates

Search Engine Journal reported the rollout times for this year’s earlier spam updates:

The longer window stands out, but Google has not explained it. A two-week estimate does not mean the update will take two weeks, and it tells us nothing on its own about how many sites will be affected.

What Has Google Actually Confirmed?

Google has confirmed the update’s name, start time, global scope, all-language coverage and a rollout window of up to two weeks. It has also listed the update as an incident affecting ranking. Google has not said which spam policy or tactic the update focuses on.

Google’s standing advice after any spam update is the same: sites that see a change should review the spam policies to make sure they comply. So be careful with any post that says this update “targets” a particular tactic unless it quotes Google. At the time of writing, no such statement exists.

What Types of Spam Does Google Already Target?

Google’s spam policies define spam as techniques used to deceive users or manipulate Search into featuring content prominently. The current definition, last updated on 28 August 2026, also covers attempts to manipulate generative AI responses in Google Search. Violations are caught by automated systems and, where needed, by human reviewers who can issue a manual action.

These are the policies most relevant to business websites:

• Scaled content abuse: many pages produced mainly to rank rather than to help people, usually unoriginal and low in value.
• Doorway abuse: sites or pages made to rank for similar searches that send visitors to a less useful intermediate page, including city pages that all funnel to one place.
• Link spam: buying or selling links that pass ranking credit, excessive link swaps, automated link building, and low-quality directory or bookmark links.
• Keyword stuffing: loading a page with keywords or numbers, including blocks of city and region names the page is trying to rank for.
• Scraping: republishing other sites’ content with little or no added value, even when reworded with synonyms or automated tools.
• Site reputation abuse: third-party content hosted on an established site mainly to borrow that site’s ranking strength.
• Expired domain abuse: buying an old domain and filling it with low-value content to exploit its history.
• Cloaking and sneaky redirects: showing search engines something different from what people see, or sending visitors somewhere they did not expect.
• Hacked content and user-generated spam: pages, links or comments added without the owner’s permission.
• Thin affiliation: affiliate pages copied from the merchant with no original content.
• Malicious practices: including malware, unwanted software and back button hijacking.

Hacked content deserves attention from small business owners. A WordPress site with an outdated plugin can end up hosting spam pages its owner has never seen, and those pages are judged under the same policies.

Does This Update Target AI-Generated Content?

Google has not said the September 2026 spam update targets AI-generated content. Google’s policies judge the result, not the tool. Scaled content abuse applies to large volumes of low-value pages “no matter how it’s created”, so AI-written pages are only a problem when they add little for readers.

Google’s guidance on generative AI content says AI can be useful for researching a topic and adding structure to original work. The same page warns that using AI tools to generate many pages without adding value may violate the scaled content abuse policy. It also asks site owners to check the accuracy of AI-written titles, meta descriptions, structured data and image alt text.

In our view, the risk looks like this in practice:

If AI search visibility matters to you, the same principle applies. Our guide on how to improve AI search visibility covers the honest ways to get cited, and Google’s spam definition now makes clear that attempts to game AI answers count as spam.

How to Tell If the Spam Update Affected Your Website

Wait until Google confirms the rollout has finished, then compare Search Console clicks, impressions and positions after 24 September with an equal period before it. A sharp, lasting drop across many pages or queries that starts inside the rollout window is worth investigating. A one or two day dip usually is not.

Google’s guide to debugging traffic drops groups algorithmic updates and site-wide spam issues together as causes of large, sudden falls. It also lists seasonality, technical problems and reporting glitches, so rule those out first.

1. Check the Status Dashboard. Do not draw conclusions until Google posts that the rollout is complete. We suggest giving the data about a week after that before deciding anything.
2. Compare the right dates. In the Search Console Performance report, compare the post-rollout period with the same length of time before 24 September. Search Console reports dates in Pacific time, and the update began on the morning of 24 September Pacific time, so treat 24 September as day one in your reports.
3. Look at 16 months of data. Google recommends this to rule out a seasonal dip that happens every year, such as a quiet period after the school holidays or a slow month for tourism on the Coast.
4. Find the pattern in the Pages tab. Sort by clicks difference. A drop across the whole site, a drop in one section such as location pages or the blog, and a drop on one important page each point to different causes.
5. Check your top queries in Google Trends. If searches for your main terms fell everywhere, the problem is demand, not your site.
6. Open the Manual Actions and Security Issues reports. A manual action is separate from an automated update and comes with a report in Search Console. Google’s spam update documentation does not mention any notification for automated demotions, so an empty report does not rule the update out.
7. Rule out technical causes. Check the Page indexing and Crawl stats reports, and think about any recent redesign, migration, plugin change or hosting problem. If pages have disappeared from Google altogether, our guide to a website not showing on Google walks through the common causes.

Also note the size of the change. Google describes a move from position 2 to 4 as a small drop, which can reverse on its own, and advises against radical changes to pages that are already performing well. A fall from position 4 to 29 across many terms is the kind of drop that calls for a proper review.

What to Do If Rankings or Traffic Drop

If your data shows a real drop that lines up with the rollout, review Google’s spam policies against your own site and fix what breaks them. Avoid deleting pages or disavowing links in the first few days. Work through the areas below in order of how much of your site they touch.

Pages made for search engines rather than people

Look for groups of pages that are thin, duplicated or produced in bulk: near-identical service pages, auto-generated tag and archive pages, and batches of AI-written posts nobody reviewed. For each group, improve the pages that deserve to exist, merge overlapping ones with 301 redirects, and remove or noindex the rest. Google’s policy is direct on this point: if you host scaled content, exclude it from Search.

Location and service-area pages

Open your city pages side by side. If they read the same apart from the town name, they risk looking like doorways. See the local section below for what to do instead.

Backlinks

List any links you or a previous SEO provider paid for, swapped or built with software. Paid links are allowed when they carry rel=”sponsored” or rel=”nofollow”, so ask site owners to add those attributes or remove the links. Be realistic: Google says that once its systems discount spammy links, any ranking benefit those links gave cannot be regained.

Hacked pages and user spam

Check the Security Issues report, search Google for site:yourdomain.co.ke and look for pages you did not create, and review blog comments and user accounts for spam. Update WordPress, themes and plugins, and remove any you no longer use.

Third-party content on your domain

If you sell sponsored posts or host partner content that has nothing to do with your business, review it against the site reputation policy.

Not sure which of your pages are the problem? Our SEO services include a spam policy audit that maps your pages, links and location content against Google’s rules and gives you a prioritised list of fixes.

What Local Businesses and SEOs Should Watch Closely

Most small business websites are not spam, and Google has not said this update is aimed at local sites. Still, several common local SEO shortcuts sit close to the lines drawn in Google’s spam policies. These are the ones to check.

Thin city pages

A plumber, lawyer or tour operator with near-identical pages for Nairobi, Mombasa, Kisumu, Nakuru and Eldoret is exactly what Google’s doorway policy describes when it mentions pages targeted at specific cities that funnel users to one page. A city page earns its place when it says something true and specific: whether you have staff or an office there, projects you have completed in the area, local prices or call-out fees, travel times, and photos from real jobs. If you cannot say anything specific about a town, one clear service-area page is more honest than ten copies. Our local SEO strategies for Kenya guide covers how to build location pages that help customers.

Keyword-stuffed service-area text

Google gives “blocks of text that list cities and regions” as an example of keyword stuffing. A short, plain list of the areas you serve helps customers. A paragraph repeating “best plumber Nairobi Westlands Kilimani Karen Lavington” is written for a search engine and reads badly to people.

Mass AI publishing

Packages that promise dozens of AI-written blog posts a month for a low fee often produce the pattern the scaled content abuse policy describes: many pages, little original value. Fewer posts that answer real customer questions, with your own expertise in them, are safer and more useful.

Cheap link packages

Offers of thousands of backlinks for a fixed price, mass directory submissions, and paid guest posts with keyword-rich links that pass ranking credit are all listed as link spam in Google’s policies. If a provider cannot tell you where each link will appear and why a real reader would click it, do not buy it.

What about Google Business Profile?

Google’s announcement refers to Search ranking and says nothing about Maps or Business Profile listings. Business Profiles follow their own guidelines, but the same honesty applies: a real address or service area, a real business name without added keywords, and genuine reviews. Our guide to Google Business Profile optimisation in Kenya explains what Google allows.

A note for SEOs and agencies

If you manage several client sites built from the same template, check whether the location and service pages differ in substance or only in names. A review now is cheaper than a recovery project later.

Can a Website Recover After a Spam Update?

Yes, but usually slowly. Google says fixing spam policy problems may help a site improve once its automated systems learn, over a period of months, that the site complies. There is no guaranteed timeline, and ranking gained through spammy links does not return after those links are discounted.

What recovery depends on:

• Automated demotion: fix the issues across the whole site, not only on the pages that dropped, then give Google time to recrawl and reassess. Google’s traffic drop guide says some changes show within days while others take several months, and that it may take months for its systems to decide a site is helpful over the long term.
• Manual action: fix every issue listed in the Manual Actions report, then submit a reconsideration request in Search Console explaining what you changed.
• Link spam: removing bad links stops the risk, but the ranking those links once propped up is gone. Rebuilding means earning links and mentions that people would give you anyway.

Google is also clear that there is no guarantee changes will produce a noticeable effect, because more deserving content may still rank ahead of yours. If you are wondering how long a normal SEO programme takes to show results, our article on how long SEO takes in Kenya sets realistic expectations.

Finally, a drop during the rollout does not prove the spam update caused it. If your site does not break any policy, look at seasonality, technical changes and competitors before you rewrite anything.

September 2026 Spam Update Checklist

Use this once Google confirms the rollout is complete:

• Confirm the completion notice on the Google Search Status Dashboard.
• Compare Search Console clicks, impressions and positions after 24 September with an equal period before.
• Check 16 months of data to rule out seasonality.
• Sort pages by clicks difference and note whether the drop is site-wide, one section or one page.
• Check the Manual Actions and Security Issues reports.
• Rule out technical causes in the Page indexing and Crawl stats reports.
• Review thin, duplicate or bulk-generated pages, then improve, merge or remove them.
• Compare your city and service-area pages for real local differences.
• Remove keyword-stuffed lists of towns and repeated phrases.
• Audit paid, swapped or automated backlinks and add rel=”sponsored” or remove them.
• Search for hacked pages and spam comments, and update WordPress and plugins.
• Record every change with a date so you can match it against future Search Console data.

Frequently Asked Questions

When did the Google September 2026 spam update start?

The September 2026 spam update started on 24 September 2026 at 9:15 a.m. Pacific time, which was 7:15 p.m. East Africa Time. Google announced it on the Google Search Status Dashboard and said it applies globally and to all languages.

How long will the September 2026 spam update take to roll out?

Google says the rollout may take up to two weeks. That is an estimate, not a fixed length. The three earlier Google spam updates of 2026 each finished in under three days, according to Search Engine Journal.

Does Google penalise AI-generated content in spam updates?

Google does not treat AI-generated content as spam by default. Its scaled content abuse policy applies to large numbers of low-value pages however they are created. AI-assisted content that is accurate, reviewed and useful to readers is not a policy violation.

How long does it take to recover from a Google spam update?

Google says a site may improve after its automated systems learn, over a period of months, that the site complies with the spam policies. There is no guaranteed timeline. Ranking benefit that came from spammy links cannot be regained after Google discounts those links.

Will Search Console tell me if the spam update affected my site?

Search Console reports manual actions in the Manual Actions report, but Google’s documentation on spam updates does not mention notifications for automated changes. To check for impact, compare Performance report data from before and after 24 September once the rollout is complete.

If Your Numbers Move This Week

The Google September 2026 spam update is still rolling out, Google has not said what it targets, and early swings are not a verdict. Watch your Search Console data, wait for the completion notice, then check your site honestly against the spam policies. Sites that publish useful pages, build links people would give anyway and keep their location content specific have the least to worry about.

If you would like a second opinion on your data or your location pages, talk to Donvic Marketing and we will review what changed and what, if anything, needs fixing. We will update this article when Google confirms the rollout is complete.