Google's September 2026 spam update has finished: what we know

Google's September 2026 spam update is done. It started on 24 September and Google marked it complete on 8 October, which puts the rollout at 13 days and 16 hours on the Google Search Status Dashboard.

That is a long time for a spam update. The three earlier ones this year each finished in under three days. Google warned at launch that this one "may take up to two weeks to complete", and it used almost all of that.

What Google said

Not much, which is normal for spam updates. The dashboard post on 24 September read: "Released the September 2026 spam update, which applies globally and to all languages." On 8 October Google added: "The rollout was complete as of October 8, 2026."

On LinkedIn, Google Search Central described it as "a normal spam update, and it will roll out for all languages and locations", according to Search Engine Roundtable. When people asked about the timing, John Mueller replied on Bluesky: "Yes, it's likely to take longer than some of the previous ones."

Google did not say which spam policies the update focused on, did not give a share of queries affected, and did not announce any policy change alongside it. Search Engine Roundtable's summary also notes that it was not a link spam update.

How it compares with this year's other spam updates

Update	Started	Length
March 2026 spam update	24 March	19 hours 30 minutes
June 2026 spam update	24 June	2 days 1 hour
August 2026 spam update	18 August	2 days 16 hours
September 2026 spam update	24 September	13 days 16 hours

Durations are from Google's ranking incident history. This was the fourth spam update of 2026 and the longest by a distance. A longer rollout doesn't automatically mean a bigger update, but it does make diagnosis harder, because any effect arrives in waves rather than on one day.

When the movement happened

Search Engine Roundtable logged ranking volatility on 25 to 27 September, 30 September and 4 to 6 October, with the caveat that those dates assume nothing else in Google was changing at the same time.

That caveat matters more than usual this time. Rank tracking company Morningscore says Google sent its tracker truncated result pages from the evening of 24 September, the same day the update began, with the problem peaking on 30 September and 1 October. Sites missing from those cut-down pages showed up as ranking drops that weren't happening in real search. We've covered that in a separate piece.

One more thing changed on 24 September. Search Console started reporting searches made with Google Lens and Circle to Search as a new search type, and Google says that data wasn't in the counts before. If your Web numbers in Search Console look different from that date, read our explainer on the multimodal report before blaming the update.

Our take

A two-week spam update with no named target leaves you working from your own data and Google's spam policies. That's fine if you know what you're looking at. The risk is reading a rank tracker chart from the last week of September and blaming the update for a drop that was really a data problem. Or the opposite: writing off a real loss as tracker noise.

Spam updates also work differently from core updates in one useful way. Google's spam update documentation says sites that see a change "should review our spam policies to ensure they are complying with those." It also says that making changes "may help a site improve if our automated systems learn over a period of months that the site complies." So recovery depends on fixing the cause, and it isn't quick. Waiting for the next core update and hoping is not a plan.

Since this wasn't a link spam update, it's also not the moment to start disavowing links in a panic.

What to do now

1. Use Search Console as the source of truth. Compare clicks and impressions for 24 September to 8 October against the two weeks before. Search Console reflects real searches. Rank trackers don't always.
2. Look for patterns by page type. If losses cluster on one kind of page, such as thin programmatic pages, content on an expired domain, or a section hosted for a third party, read the matching section of Google's spam policies.
3. Leave alone what wasn't hit. If traffic is flat, a long rollout isn't a reason to rewrite pages.
4. Annotate the dates. Mark 24 September and 8 October in GA4 and your reports, so the next person looking at the chart knows why it moved.

Core updates are a different problem with a different fix. If that's what you're dealing with, our write-up of the March 2026 core update covers what to do when a site drops.