Google's September 2026 spam update, for owners

Google finished a spam update on October 8, and the job this week is a twenty-minute look at Search Console, not a rebuild: compare your clicks for the three weeks before September 24 with the three weeks after October 8. If they held, you are done. If they fell, there are three places to check, and an owner can check each one.

Google’s Search Status Dashboard posted the start on September 24 at 9:15 AM Pacific: “Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete.” It marked the rollout complete as of October 8.

What Google confirmed, and what it did not

Google confirmed the name, the dates and the reach. It is the fourth spam update on the dashboard this year, after March, June and August, and the August one ran only from August 18 to 21. No core update is listed for the same weeks, so a large change between the two windows below has fewer other suspects.

What Google did not say:

• Which sites were affected. Google publishes no list. A tool or vendor that “knows” you were hit is reading the same traffic you can read yourself.
• What it targeted. The announcement names no tactic. Google’s spam updates page says only that its systems, including one it calls SpamBrain, are improved from time to time to catch new kinds of spam.
• A notice. The Manual actions report covers reviews by people; an automated update leaves no note there.

Compare the weeks before and after in Search Console

In Search Console, open Performance, then Search results, click the date filter and choose Compare, then Custom. Set September 3 through 23 against October 9 through 29. Both run 21 days with three of every weekday, so a slow Monday cannot tilt the result. Then read:

1. Total clicks. A few percent either way is ordinary movement.
2. The Pages tab. A drop spread across every page reads differently from a drop on twelve city pages and nowhere else.
3. Position on the pages that fell. Google’s guide to traffic drops separates a small slip, such as 2 to 4, from a large one, such as 4 to 29.
4. The same weeks last year. A pool company sees October fall every year, update or not.

What the comparison shows	What it most likely means	What to do
A drop that matches last October’s	The season	Nothing
Small position slips on a few pages	Ordinary reshuffling	Watch for a month
A large fall on one group of pages	Something on those pages	Check the three areas below
A large fall on every page	A site-wide or technical issue	The three areas, then Page indexing

If clicks fell: three things to check first

Google’s spam policies for web search list more than a dozen practices. Three describe things a local business site can end up with without the owner choosing them.

City pages with only the town name swapped

Doorway abuse, in Google’s words, includes “multiple domain names or pages targeted at specific regions or cities that funnel users to one page.” Open two of your location pages side by side. If the text is the same apart from the town’s name, those are the pages to deal with first.

The fix is fewer pages or better ones. Fold thin town pages into one service area page, or give each something true about that place: jobs done there, the questions its customers ask, the office that issues its permits. A page that would read wrong with another town’s name in it is doing its job.

Links somebody paid for

Link spam covers “exchanging money for links, or posts that contain links,” plus low-quality directory links and keyword-stuffed links in guest posts and press releases. If a vendor sold you a monthly bundle of backlinks, ask for the list, then compare it with the top linking sites in Search Console’s Links report.

Pages on your domain you did not write

Google’s site reputation policy says third-party content alone is fine; a freelancer writing your blog is not the problem. Pages unrelated to your business, hosted mainly to borrow your domain’s standing, are. So are dozens of near-identical posts churned out to fill a quota, which Google calls scaled content abuse.

Hacked pages belong in the same check. Search Google for site: followed by your domain and scroll. Pages you never published, in a language you do not use or selling things you do not sell, are a job for your web host today, and for the Security issues report.

If nothing moved, change nothing

A flat comparison is the answer. A site with real service pages and links earned from its chamber, suppliers and local press gives a spam update little to find, so there is nothing to buy: no audit package, no disavow file, no rewrite of pages that bring in calls. Google says even a site that genuinely broke its policies may take months to recover after cleaning up, and a fix for a problem you do not have only adds risk.

What to do this week

• Run the comparison and screenshot it, so the next update has a baseline.
• If a group of pages fell, read two of them side by side as a customer from that town would.
• Ask any link or content vendor, in writing, for everything they built or published in your name.
• Run a site: search on your domain.
• If nothing moved, note it and leave the site alone.

Our local SEO work starts with this review, and the page for business owners explains the free plan. Send your site through the form below and we will run this comparison with you and name the pages, if any, worth a closer look.