At 9:15 a.m. Pacific Time on September 24, Google started rolling out the September 2026 spam update (recorded on the Google Search Status Dashboard). The announcement was short, global in scope, covering all languages, and possibly taking up to two weeks. This is the fourth spam update of 2026, after March, June, and August. On the day it landed, two reactions showed up most often, reaching for changes right away, or panicking at a single day's curve in a rank tracker. Hold both, for the reasons below.

Here is the conclusion up front. This update is not finished; as of writing, it still shows as in progress on Google's release list, with no duration. Until a duration appears, every fluctuation number you see is an interim state. What is worth doing over these two weeks comes down to three things. Save a clean before-window, get the order of attribution straight, and run through a self-check against the current spam policies. Big moves, rebuilds and mass deletions included, should wait until the rollout ends and the result is on record.

Separate what is known from what is not

Four things are known. The start time is September 24, 9:15 a.m. Pacific, per the official status page; the scope is global, all languages; the announced duration is "up to two weeks"; and it is the fourth spam update this year. In social posts, Google added the framing of "a normal spam update" and said the ranking release history will be updated when the rollout completes. One line of background. A spam update is one kind of algorithm update, aimed at behavior that violates the spam policies. Core updates reassess overall content quality; the two run on separate tracks.

What is not known matters just as much. Google has not said which spam policies this round targets, has not said why the window is longer than the previous three, and has not published an impact range. Any claim that this round targets a certain kind of content is third-party inference at this point, not an official statement.

Durations are useful to read, pointless to guess. The actual runtimes of 2026's first three spam updates were 19 hours 30 minutes, 2 days 1 hour, and 2 days 16 hours; before that, the March 2024 update was also announced as up to two weeks and measured 14 days 21 hours. All of this comes from Google's release list. It helps with one thing. The announced window is a preview, and completion is marked by a duration appearing in the list.

How to keep an observation window, and how to attribute

The most important work during a rollout is preserving evidence. Save roughly four weeks of data before September 21 as the before-window, then compare it later with the same measurement basis. The line sits on the 21st because several rank trackers already showed movement on September 22 and 23, and that movement happened before the update began, so it does not belong to this round by timeline (updates are not rolled out in advance, a point Search Engine Roundtable quotes John Mueller on).

Read by week, not by day. Daily curves are noisy, especially on small sites. On this site, for example, the last 28 days brought 33 clicks and 3,100-plus impressions, and the -54.9% week-over-week drop in impressions seen in Monday's review happened before the update began. The example makes two points. Drops have to be attributed on a timeline, and update effects are best read week over week and page cluster over page cluster, not by staring at one day.

Watch for a measurement change as well. On the same day, Search Console split the Web search type into text and multimodal (per seo-kreativ's record and testing). If you compare a pre-September-24 export with newer data, the difference will include that change; pull both sides fresh, fix one search type, and the comparison stays clean.

Attribution runs in three layers. First, indexing and crawling, whether pages are indexed normally and crawling is error-free, the foundation. Second, content and page clusters, which types of pages are moving and in which direction. Third, rule out other changes of your own, rebuilds, template adjustments, measurement shifts, all set aside first. Once all three layers are cleared, consider that the update may be involved.

A self-check list against the current spam policies

Google's only advice for affected sites is to review the spam policies and check compliance. Below is an actionable list by policy area; each one is worth opening in the original.

Scaled low-value content. This maps to scaled content abuse, defined to include generating many pages with AI tools without adding value, and stitching or rewriting content at scale. Go through page clusters generated in bulk over the past two years and ask one question per page. Does it hold standalone value for users beyond search traffic?

Site-level trust risks. Two areas deserve attention, site reputation abuse, third-party content published by leveraging a host site's trust, and expired domain abuse, buying expired domains and repackaging them as new sites. Check whether subdirectories or subdomains are rented out for third-party content, and whether any old domains were acquired to build on.

Links and comments. Link spam takes forms like buying links, exchanging links, or building links with tools; user-generated spam covers junk submitted by users in comment sections and forums. Check whether link exchanges involve compensation and whether UGC areas have any moderation.

Function matching promises. The misleading functionality category covers pages whose features or promises do not match reality, which does real damage to site trust and shows up often on tool-style landing pages.

Structured data. Google maintains separate general guidelines for structured data, requiring markup to match what the page actually shows; serious violations lose rich result eligibility, or get flagged as spam.

To repeat, Google has not said what this round targets; the five items above are long-term compliance baselines, not a call-out list.

What not to do this round

Do not chase recovery tricks before the rollout finishes. No recovery technique has official backing right now; the official documentation is blunt that after changes, systems may take months to reassess compliance, and for link-related handling, changes may not bring back what was already lost.

Do not run large-scale rebuilds while the measurement basis is unsettled. Rebuilds tangle the variables, and separating update effects from your own changes afterwards becomes impossible. Fixing pages that clearly violate policy is routine compliance and can continue; systematic rewrites and structural overhauls should wait.

Do not restructure over single-day swings. This repeats the point above, but it happens daily in the wild.

Do not go looking for winner-loser lists. Google publishes no such list, third-party versions are mostly screenshot roundups with opaque samples and methods, and they are poor decision inputs.

Common pitfalls

Attributing pre-update movement to this update. The tracker movement on September 22 and 23 preceded the start; the impression drop in Monday's review did too. When the timeline does not line up, discussing impact is meaningless.

Deleting or restructuring the moment a curve moves. Making systematic changes mid-rollout is like swapping reagents halfway through an experiment; nobody can tell afterwards where the result came from.

Believing claims that this round targets a certain kind of content. Google gave no target; any specific pointer is interpretation. Interpretation can be read, but label it as such.

Mistaking overall tracker volatility for your site's impact. Trackers reflect unrest across the SERP; whether your site is affected should be read from your own Search Console timeline.