Google’s September 2026 Spam Update: What Changed and What to Check

What did Google release on 24 September?

At 09:15 Pacific time on 24 September 2026, Google posted one line on its Search Status Dashboard: it had released the September 2026 spam update, which applies globally and to all languages, and the rollout may take up to two weeks to complete. As of the morning of 26 September the entry was still open, with no completion time posted.

That is all Google said. It did not name a policy, a tactic or a type of site. Trade coverage on the day, such as Search Engine Journal’s report, noted the same gap. So anyone telling you this update “targets” a particular practice is guessing. What we can do is read the published rules the update enforces and check a site against them.

Google explains the term on its spam updates page. Its automated spam systems run all the time; a spam update is what Google calls a notable improvement to how those systems work. The main one is SpamBrain, which Google describes as its AI-based spam-prevention system and improves from time to time so it catches new kinds of spam.

How a spam update differs from a core update

A core update changes how Google judges quality and relevance across the whole index, so pages can rise or fall without having done anything wrong. A spam update is narrower. It improves how Google finds pages that break its spam policies, and the pages it catches can rank lower or not appear at all.

That difference changes the response. After a core update the usual advice is to improve the content and wait. After a spam update, the first question is whether anything on the site matches a named policy. Here is 2026 so far, from the dashboard:

This is the fourth spam update of the year and the second in about five weeks. The three before it finished in under three days. This one has a two-week window, closer to how long a core update takes. Google has not said why. The practical effect is that rankings may keep moving into early October, so a single bad day this week is not yet a verdict.

Which practices do Google’s spam policies name?

The policies were last updated on 28 August 2026. For the kind of business that hires a marketing agency, a handful of them matter far more than the rest:

• Scaled content abuse: many pages generated mainly to manipulate rankings rather than help users, “no matter how it’s created.” Google’s examples include using generative AI to produce many pages without adding value, stitching content from other pages together, and scraping or auto-translating content where little value is added.
• Doorway abuse: pages built to rank for similar queries that funnel people somewhere else. Google’s examples include multiple domains or pages aimed at specific regions or cities that funnel users to one page, and substantially similar pages that sit closer to search results than a real site structure.
• Site reputation abuse: third-party content published on a host site mainly to borrow the ranking signals that site earned with its own content.
• Expired domain abuse: buying an expired domain and reusing it to host low-value content that trades on its past.
• Link spam: buying or selling links for ranking, excessive link exchanges, automated link programs, and paid or guest content that passes ranking credit.

Google finds violations with automated systems and, when needed, human review that can end in a manual action. A spam update improves the automated half.

Where AI-assisted publishing crosses the line

Google does not ban AI writing. Its guidance on generative AI content says these tools can be useful for researching a topic and adding structure to original content. The line is volume without value: using generative AI to produce many pages that add nothing for users may violate the scaled content abuse policy.

The same guidance asks for accuracy, quality and relevance, especially when content is generated automatically. It also says to keep automatically generated titles, meta descriptions, structured data and image alt text accurate. That last point is often missed. A site can have careful body copy and still ship hundreds of machine-written descriptions that say nothing.

The warning signs are easy to spot in an audit. Look for dozens of posts on one topic that differ by a keyword, articles with no named author and no sources, or statistics no one can trace. The fix is rarely to delete everything. It is to decide which pages earn their place, then improve those or take them out of search.

Why translated and city pages deserve a second look

Two items in the policy text land close to home for businesses that sell across Miami, Mexico and the rest of Latin America.

First, the scaled content abuse examples list translating as one of the “automated transformations” that can turn scraped or copied content into many low-value pages. A Spanish version of a site is not a problem in itself; it serves real buyers. The risk is a machine translation of every page, published unchecked, that adds nothing a Spanish-speaking reader could not get from a browser’s translate button.

Second, the doorway examples include pages aimed at specific regions or cities that funnel users to one page. Neighborhood and destination pages are useful when each one says something true and specific about that place, such as prices, schools, flight times or seasonal demand. When fifty of them share one paragraph with the city name swapped, they start to look like doorways.

Because this update applies to all languages, Spanish and Portuguese pages are in scope just like English ones. If you are building a bilingual site for real estate search, each language should be written for the reader of that language.

How to tell whether this update hit your site

Google does not send a notice when an automated spam update lowers a site. You have to read the data yourself. This is the order we work in:

1. Open the Manual actions report in Search Console. Google says it notifies a site there and in the Search Console message center when a human reviewer finds pages that break its policies. If it is empty, you are dealing with the automated systems, not a person.
2. Compare the right dates. In the Performance report, compare the days since 24 September with the same weekdays before it. Keep in mind that the rollout is still running.
3. Find where the loss sits. Filter by page and by query. A drop across a whole folder, such as auto-generated city pages or a guest-post section, points somewhere different than a drop on one article.
4. Rule out other causes. Check for a recent site migration, a robots.txt or noindex change, a tracking break or a seasonal dip before blaming Google. The Search Console multimodal filter Google added on 24 September also moved some traffic out of the text-based Web totals.
5. Match the affected pages to a named policy. If none fits, the movement may just be ranking noise during the rollout.

What to do if your traffic dropped

Google’s advice is direct: review the spam policies and make sure the site complies. It also sets expectations on timing. Changes may help if its automated systems learn, over a period of months, that the site now follows the rules. There is no request button for an automated drop and no fast path back.

Links are a special case. Google says that when its systems remove the effect of spammy links, any ranking benefit those links used to give is simply gone, so cleaning them up might not bring an improvement. If a site was held up by bought links, the honest plan is to earn better ones and rebuild on the content.

If there is a manual action, the path is different. Fix every issue listed, then use Request Review in the Manual actions report and describe what you changed. Google emails when it receives the request and again when the review is complete.

Whatever the cause, do not answer a drop by publishing faster. More thin pages is the pattern the policy describes. Our view, set out in is AI killing SEO, is that the sites that hold up are the ones built to be quoted, which is also the idea behind generative engine optimization.

How we publish daily with AI and stay inside the rules

We publish a post on this blog every day, researched and drafted with AI, so this policy applies to us as much as anyone. These are the rules we hold every post to:

• One question per post. Before writing, we check the sitemap so two pages never compete for the same query.
• Every number links to a primary source opened the same day, and we keep a source log for each post. If a figure cannot be traced, it is cut.
• A named author, Josh Stein, whose credentials can be checked.
• No invented quotes, clients, results or prices.
• Something to add: our own data, like the scan of 63 Miami real estate websites, or a Miami and Latin America angle a generic article would not have.

AI speeds up the research and the drafting. It does not decide what is true. That is the difference between AI marketing that builds a site and AI publishing that ends up in a spam update.