Google's September 2026 spam update finished rolling out this morning. Google's Search Status Dashboard marked it complete on October 8, posting the notice at 1:37 a.m. PT (4:37 a.m. ET), 13 days and 16 hours after the September 24 start. The dashboard had said it "may take up to two weeks to complete." It used nearly all of it.
For scale: the March 2026 spam update finished in 19 hours and 30 minutes, per the same dashboard history.
So the obvious move is to open Search Console, find the day your traffic fell off a cliff, and match it to the rollout. Every SEO newsletter you get this week will tell you to do that.
Skip it. That exercise stopped producing answers this month, and the reason is worth more than the answer you wanted.
TL;DR
- The September 2026 spam update ran September 24 to October 8, the longest of Google's four spam updates this year. The March, June and August updates each finished in under three days.
- It landed in at least four waves. Search Engine Roundtable tracked impact September 25 to 27, September 30, and October 4 to 6. Google published no impact figure, no target list, and no Search Central blog post.
- The four spam policies most likely to catch a legitimate business all describe work a vendor did on your behalf, and Google's recovery language is "over a period of months." There is no next-update reset button.
Two Weeks Is Not a Slow Update. It Is a Different Kind of Update.
A 19-hour rollout behaves like a switch. Google flips it, the index reshuffles, you get one clean before and after. That is the world the standard traffic-drop diagnosis was built for, and it is how this year's first three spam updates behaved: 19.5 hours in March, about two days in June, under three days in August.
A two-week rollout behaves like weather. Google's John Mueller has explained that core updates take weeks because ranking components are updated step by step rather than all at once, as PPC Land noted when this rollout began. Google has not confirmed a spam update works that way, but the observed shape fits. It is not unprecedented either: the August 2025 spam update ran more than 26 days. What is new is that a two-week window is landing on a year that trained everyone to expect a switch.
Four Impact Windows Means You Cannot Date Your Drop
Search Engine Roundtable tracked elevated volatility September 25 through 27, again September 30, and again October 4 through 6. It also recorded heavy movement September 22 to 24, before launch.
Count the problem. Your chart holds four to six candidate inflection points inside three weeks, and Google never said which queries, which regions, or what share of searches moved.
The cliff on your chart is real. The cause is not inferable from its date.
The Policies This Update Enforces Read Like an Agency Services Menu
Spam updates introduce no new rules. They enforce existing ones algorithmically, and Google's spam policy documentation names them plainly. Four describe work sold to legitimate companies as marketing. We covered what Google's spam updates actually punish in August; here is the short version.
Scaled content abuse: generating many pages primarily to manipulate rankings, with little value to the reader. If your content program ships 40 templated posts a month, that is the policy you are standing next to.
Doorway abuse: pages created to rank for specific, similar queries that funnel users elsewhere. The 80-URL city-and-service matrix a Boca Raton home services company gets built every year is a doorway risk by construction, not by intent.
Site reputation policy: third-party content published on your domain mainly to borrow your ranking signals. That is the "partner content" subfolder somebody pitched you as free traffic.
Expired domain abuse: buying an expired domain and repurposing it primarily to move rankings. Ask your SEO vendor, in writing, whether they ever redirected an acquired domain to you.
None of these feel like spam to the person paying for them, and three of the four are executed by an agency, not the owner. The honest first question is not what Google did to you. It is what was done on your behalf.
Google Already Told You There Is No Recovery Date
Google's guidance for affected sites is to review the spam policies and fix the violations. Then this: "Making changes may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies."
Months. Not the next update.
That kills the plan we hear most, which is to wait for the next spam update and hope it reverses. Reassessment is continuous and slow, so every week spent diagnosing instead of fixing is a week the clock is not running on the fix.
Half Your Search Visibility Is Not in the Chart You Are Staring At
Even a perfect read on blue-link traffic is partial in 2026. Search Console's generative AI performance report counts impressions only, broken out by page, country, date and device. No clicks, no queries, so AI surface losses cannot be traced to specific searches. It is one more reason to build a funnel that does not depend on one traffic source.
A measurable channel with four possible drop dates, an unmeasurable channel beside it. Any single-cause story about this month is a guess wearing a suit.
What To Do This Week
- Segment by query class, not by date. Pull Search Console for September 1 to 23 against September 24 to October 8, split non-brand transactional, non-brand informational and brand, then filter by country, since Google adjusted site reputation enforcement in the European Economic Area on August 28. Brand held while non-brand informational fell: AI surface substitution, not a demotion. Non-brand transactional fell while informational held: go to the policy list.
- Crawl your own site and count. Flag every template-generated page set over 25 URLs, every subfolder of third-party or partner content, and every domain redirecting to yours that you did not originally own. Then ask your SEO vendor which of the four policies describes anything they shipped. Keep the reply.
- Check Manual Actions and Security Issues, and expect them empty. These demotions are algorithmic, so nothing shows up there. An empty report next to a traffic drop is not an all-clear. It is the signal to audit against the policy list instead of waiting for a notification that will never arrive.
FAQ
Was my site hit by the September 2026 spam update?
Not from a date. The update rolled out in at least four waves between September 24 and October 8, and Google released no impact data or target list. The usable test is whether your site matches a named spam policy: scaled content, doorway pages, third-party content on your domain, or a repurposed expired domain. If none fit, your drop likely has another cause.
How long does it take to recover from a Google spam update?
Google's language is that sites may improve if its automated systems learn "over a period of months" that the site now complies. No fixed timeline, no guaranteed recovery. Fixing the violation starts the clock. Waiting for the next update does not.
Should we stop publishing AI-written content after this update?
No, but stop publishing it at volume without editing. Google's scaled content abuse policy targets pages mass-produced to manipulate rankings, not the tool used to draft them. The risk sits in the publishing rate and the thinness, not the authorship. Most companies bought AI seats and never shipped systems, and content at volume without an editor is what that gap looks like in search.
The Real Takeaway
Two weeks of rollout, four impact windows, zero published impact data. Google did not just ship a spam update this month. It quietly retired the diagnostic agencies have leaned on for fifteen years: point at a date, call it a cause.
What replaces it is less satisfying and more useful. Audit against the written policies. Segment by query class. Assume nobody is coming to tell you what happened. If you want a second set of eyes on that audit, that is what our SEO services team does every week.
Book a 30-minute SEO strategy call. No pitch, just a straight read on whether anything on your site matches the policies this update enforces. Get a free strategy call.