Google confirmed on 8 October 2026 that its September spam update has finished rolling out. It began on 24 September, so it ran for nearly two weeks, far longer than the roughly two days recent spam updates have taken. If your enquiries or traffic wobbled at any point in the last three weeks, now is the right time to look at why, calmly and with the full picture in front of you.
What actually happened
Google announced the update on 24 September as a global release covering all languages, and said at the time it could take up to two weeks. It finished on 8 October, according to Google's own Search Status Dashboard. Google called it a normal spam update, but its length was anything but normal.
Barry Schwartz at Search Engine Roundtable tracked the ranking tools over the period and saw three separate bursts of movement: 25 to 27 September, around 30 September, and 4 to 6 October. He described the update as fairly impactful, and some people in the industry compared its effect to a core update, though he wasn't sure that comparison holds. Google hasn't said how many searches were affected.
The practical point is that your rankings could have moved on any of those days, and a site that looked fine on 28 September may have changed since. Many people checked once, relaxed, and haven't looked since.
Why this one is worth a proper look
A spam update is Google's automated systems demoting pages that break its spam policies. Think thin pages made only to catch searches, content scraped or auto-generated at scale, hidden or injected content, and manipulative links.
Two things make these updates awkward for a business owner. First, there is no warning. Unlike a manual action, an automatic demotion doesn't show up as a message in Search Console. Second, recovery is slow. PPC Land reported that sites can improve once Google's systems learn over several months that they now comply, and that any benefit from spammy links is lost for good rather than restored.
So the goal now isn't a panicked rewrite. It is to find out whether you were affected and, if so, whether there is something real to fix.
What this means for your business
Most small business websites that were written by a person, for customers, won't have been touched. But there are a few ways an honest site can get caught, and they're worth ruling out:
- Old content nobody owns. Dozens of thin "location" pages or near-identical service pages added years ago by an SEO supplier are a classic risk.
- Content you didn't write. Hacked sites, outdated plugins or comment spam can inject hidden links and pages without you knowing. This is why keeping WordPress and its plugins updated matters beyond security alone. Our note on the September WordPress security update explains why those updates are worth doing promptly.
- Bulk or outsourced content. Mass-produced articles with little real knowledge in them are the kind of thing spam systems are built to catch.
- Paid or swapped links. Links bought to boost rankings are the other major target.
A calm five-step check
- Open Search Console and look at clicks and impressions from 20 September to now, compared with the same stretch before. Look for a clear step down that lines up with 25 to 27 September, 30 September or 4 to 6 October.
- Check which pages dropped, not just the total. A fall on one old page tells a very different story from a fall everywhere.
- Search for your business name and main service and see whether you still appear where you expect.
- Look for pages you don't recognise. Search Google for your domain with a few of your main terms and scan the results for anything odd.
- Write down what you find, then wait. If nothing looks wrong, leave things alone. Changing a healthy site because of an update tends to do more harm than good.
Our earlier piece on Google's August 2026 spam update walks through reading the data against specific dates, and our Search Console beginner's guide explains where to find each report if you haven't used it before.
Is a core update next?
Possibly. Coalition Technologies noted that the last broad core update started on 21 May 2026 and that Google has averaged a little over three a year recently, so one wouldn't be surprising. A spam update doesn't reliably predict one, though, and nobody outside Google knows. The sensible approach is to check the Search Status Dashboard when you have a moment and otherwise carry on running your business.
Frequently asked questions
How do I know if the spam update hit my site?
Compare Search Console clicks and impressions before and after 24 September, looking for a sudden step down on one of the three busy periods. Google doesn't send a notice for this kind of demotion, so the data is the only evidence.
How long does recovery take after a spam update?
Often many months, because Google's systems need to see sustained improvement. Fix genuine problems, keep publishing useful content and avoid quick tricks.
Should I change my website now the update is over?
Only if you've found a real problem, such as thin duplicate pages, hacked content or bought links. If your numbers look steady, the best move is usually to leave it alone.
A sensible next step
You're busy running your business, and working out whether a Google update touched your site shouldn't be another job on your list. If this has raised questions about your own website, our SEO and GEO audit looks at the technical and content checks that matter. And if your site is old enough that it might be part of the problem, our free website design offer is an easy first step: we design it for nothing and you only pay if you approve it.
Sources: Google Search Status Dashboard via PPC Land (8 Oct 2026), Search Engine Roundtable (Barry Schwartz, October 2026), Coalition Technologies (7 Oct 2026).
No comments yet