TL;DR
Google shipped its fourth spam update of 2026 on 24 September (25 September AEST), global, all languages, up to two weeks to roll out, no detail on targets.
Three spam updates in three months and a longer rollout window than the last three suggest it’s not routine. Don’t react for a fortnight, annotate the date, watch Search Console, and if a site moves, audit against the spam policies before touching anything.
Google began rolling out its September 2026 spam update on 24 September at 9:15am Pacific time, which is 2:15am AEST on Friday 25 September for those of us in Queensland.
It applies globally and to all languages, and Google says the rollout may take up to two weeks to finish.
At the time of writing this, Google hasn’t said what this update targets (which is very normal).
That’s the whole announcement.
Everything else is context, and the context is always the interesting part.
Four spam updates in six months
This is the fourth confirmed spam update of the year.
The March update started on 24 March and completed a day later.
June started on 24 June and completed on 26 June. August started on 18 August and completed on 21 August. Add September and Google has now shipped three spam updates in three months, alongside core updates in March and May.
Compare that with 2025, which had a single spam update in August and it’s strongly believed that the higher use or ai generated content is to blame for these more frequent updates.
The rollout window is the tell
The previous three updates were each given a “few days” estimate and all finished inside that. Google’s two week window for September doesn’t guarantee it will take the full two weeks, and it doesn’t prove the update is larger or more consequential.
The August 2025 spam update also carried a long window and completed 27 days later, and that one had real bite which we reported on extensively.
The practical consequence for anyone watching a client’s numbers: don’t call it either way for at least a fortnight.
A site that dips on day three and recovers on day nine hasn’t been hit.
A site that looks fine on day three and slides on day twelve may well have been.
If your traffic turned somewhere in the first or second week of August, this update is a live suspect, even though the official window had not opened yet.
Why this matters: If you are matching your traffic drop to the official 18 to 21 August window and finding it does not quite line up, widen the window.
In our tracking the movement associated with this update spans roughly 11 to 21 August – however sites declining traffic continues to take effect.
What spam updates actually do
Spam updates are not core updates.
A core update reassesses how well content answers a query relative to everything else on the web.
A spam update improves the automated systems that identify sites breaching Google’s spam policies: scaled content abuse, site reputation abuse, expired domain abuse, link schemes, cloaking, doorway pages, hacked content and the rest.
Sites caught by those policies rank lower or drop out of results entirely.
The distinction matters because the recovery path is different.
If a core update moves you, the answer is usually “make the content better and wait for the next core update”.
If a spam update moves you, the answer is “find the policy breach, fix it, and wait months”.
Google’s own guidance is that its systems need to observe a site complying with the policies over a period of months before it recovers. Months, not weeks.
What we're doing for clients this fortnight
Nothing dramatic, we need to let rankings settle to have a better understanding of changes.
The worst response to a spam update is a panicked rebuild of a site that was never affected.
1. Annotate the rollout in every reporting stack now, so any movement in the next two weeks is read against the right date. In Australia that date is 25 September, not 24.
2. Watch Search Console daily, but compare like with like. Weekday against weekday, and against the same window last month, not against the day before.
3. If a site does move, audit against the spam policies before anything else.
Expired domain acquisitions, subfolders publishing third party content, programmatic pages at scale, and any paid link activity from the last 18 months are the usual suspects.
4. Hold off on structural changes until the rollout is confirmed complete. Google will post completion on the Search Status Dashboard, and we’ll update this piece when it does.
The bigger picture
Three spam updates in three months is Google saying the quiet part out loud.
The volume of automated, low effort content hitting the index has forced it to move from annual clean ups to a rolling programme.
That’s good news for any business publishing content that a human would actually want to read, and a warning for anyone still treating volume as a strategy.
If your rankings held through March, June and August, you’re almost certainly fine. If they’ve been wobbling with each one, this is the update to take seriously.
