Google's September 2026 spam update finished rolling out on 8 October 2026, after nearly 14 days of deployment. That is unusually long for this type of update. Search Engine Land reports that the previous few spam updates wrapped in two days, not two weeks, which makes the extended timeline worth noting if you are trying to make sense of ranking movement during late September and early October.
The update began on 24 September 2026 at around midday Eastern Time and completed on 8 October at 4:37 am ET. Google confirmed both dates on its incident dashboard and noted the update applies globally, to all languages. It also described this as a "normal spam" update with nothing specifically new, which means the enforcement targets remain consistent with earlier rounds: scaled thin content, expired domain abuse, link schemes and unrelated third-party material hosted on your domain to manipulate rankings.
If your site saw rankings shift during the rollout and those changes have now settled, the update is finished. Whatever moved has moved. If you saw a drop that stuck after 8 October, it is time to treat it as final and work through an honest review of anything sitting in the grey areas of Google's spam policies.
Three volatility spikes during the rollout
Search Engine Land tracked three distinct periods of ranking volatility during the update. The first came the day after the announcement, on Friday 25 September, and continued through that weekend. A second spike appeared around 30 September. The final wave ran between 4 and 7 October, just before Google confirmed the rollout was complete.
If your rankings moved, then reversed, then moved again during that window, this pattern is why. Spam updates do not always apply evenly or all at once, particularly when they run for this long. Sites can shift in and out of view as different signals or regions are processed, and the final state only becomes clear once the update finishes.
The extended rollout also complicates attribution if you are reviewing traffic or conversion data for September and early October. Movement during this period could be the spam update, seasonal behaviour, other algorithm changes running in parallel, or manual action unrelated to the update itself. The only reliable way to separate signal from noise is to annotate the rollout window in your analytics, from 24 September through 8 October, so you can isolate what happened during that fortnight when you compare month-on-month performance or investigate drops later.
What Google is targeting with spam updates
Google did not introduce new enforcement categories with this update. The targets remain the same as they have been through 2026, and the same as the previous spam updates in August and June. The four areas that consistently show up in confirmed manual actions and algorithmic spam demotions are:
- Scaled thin content. Pages created in volume with little or no useful information, often generated or rewritten by automation without meaningful editorial input or fact-checking.
- Expired domain abuse. Buying domains with existing authority or backlink profiles and filling them with unrelated content to inherit rankings the current material has not earned.
- Link schemes. Buying links, trading links or participating in networks designed to manipulate PageRank rather than reflect genuine editorial endorsement.
- Third-party content abuse. Hosting content from unrelated third parties on your domain, often commercial in nature, to exploit your site's authority for ranking purposes when the material has nothing to do with your core offering or audience.
If your site does not engage in any of those four practices, a spam update should not affect you. There are always edge cases where a legitimate site gets caught by a filter intended for spam, and those do happen, but the majority of confirmed drops from spam updates land on sites doing at least one of the above, whether intentionally or through careless partnerships and content licensing.
What to do if your rankings dropped and stuck
If you saw a rankings decline during the rollout and it has remained after 8 October, the update is done and the change is final unless you address the underlying issue. Waiting for a reversal will not help. Spam updates are not like core updates, where rankings can shift as Google refines quality signals. They are enforcement actions, and recovery usually requires you to remove or substantially change the content or links that triggered the demotion.
Start with an honest technical SEO audit of the areas Google flags most often. Look for pages created at scale without individual editorial attention. Check whether you have licensed content sitting on your domain that has nothing to do with your business. Review your backlink profile for patterns that look like schemes rather than natural endorsement. If you bought a domain in the past year and redirected it to your main site, check whether the old domain's content and audience matched your current focus, or whether you were simply after the link equity.
Where you find something that fits one of the four spam categories, remove it or fix it properly, then submit a reconsideration request if you have a manual action, or wait for the next spam update if the penalty was algorithmic. Do not assume Google will credit partial fixes or good intent. The standard is whether the issue is gone, not whether it has improved.
If your rankings moved but then recovered
Some sites will have seen movement during one of the three volatility spikes, only to return to their previous positions by the time the update finished. That can happen for a few reasons. You may have been on the edge of a filter and then reassessed as the update progressed. A competitor may have been demoted temporarily and then restored, which would have shifted your relative visibility. Or the ranking change may have had nothing to do with the spam update at all, coinciding with it by timing rather than cause.
If your rankings are back where they were before 24 September, you do not need to do anything in response to this specific update. It is still worth reviewing the four spam categories as part of your regular site maintenance, particularly if you publish content at scale or work with third-party contributors, but an immediate audit is not required unless you have other reasons to suspect a problem.
Context for the rest of 2026
This is the fourth Google spam update announced in 2026, following updates in June and August. The frequency is consistent with Google's stated approach of running spam updates more regularly rather than letting issues accumulate and then deploying a single large enforcement round. That pattern is likely to continue, which means if you have grey-area practices on your site, they will be tested again, probably within the next few months.
The fact that this update took 14 days instead of two does not signal a change in enforcement scope or severity. Google did not add new spam categories or tighten existing definitions. The extended timeline more likely reflects the scale of the update or the complexity of processing certain signals globally, but the outcome is the same: sites engaging in the four core spam behaviours are at higher risk, and sites that avoid them are not.
If you are running a competitor analysis audit or trying to understand why a competitor dropped out of the rankings during this period, check their site for the same four issues. Expired domain redirects and third-party content hosting are often visible in Wayback Machine snapshots or current site structure. Link schemes are harder to confirm from the outside, but if a site lost rankings during a spam update and has a sudden backlink profile spike in the past year, that is a reasonable working hypothesis.
Annotate the window and move on
The most practical step for any site, whether affected or not, is to mark 24 September through 8 October in your analytics platform and reporting templates. When you review October's performance, compare year-on-year trends, or investigate a conversion rate change, you will want to separate this rollout period from everything else that happened during the same fortnight. Seasonal shifts, campaign launches, site changes and other algorithm updates all compress into the same data, and the only way to attribute cause accurately is to isolate known events like this one.
If your rankings dropped and have stayed down, treat it as an enforcement action and audit accordingly. If they moved and recovered, monitor but do not panic. And if you saw no movement at all, the update did not affect you, which is the expected outcome for sites that do not engage in the behaviours Google is targeting.