Google September 2026 Spam Update: What Small Businesses Should Do

Google started rolling out its September 2026 spam update on September 24. It’s the fourth spam update of the year, and the first one Google has said could take up to two weeks. If your traffic has moved since then, the timing is worth checking. It’s also worth staying calm, because during a rollout this long, rankings can swing around before they settle.

Status on October 2: we couldn’t find a completion notice for this update on Google’s Search Status Dashboard. Two weeks from the start runs to about October 8, and Google posts the finish date there, so wait for it before you judge any change.

What’s different about this one

The March, June and August updates each wrapped up in under three days, and March took about 19 hours. This time Google has given itself two weeks, and it hasn’t said what the update targets. The dashboard calls it a normal spam update that applies worldwide, in every language.

The gaps are getting shorter too. It was 92 days from the March update to June, 55 days from June to August, and 37 days from August to this one. That’s a pattern, not a promise, since Google hasn’t said it will continue. Still, it’s a good reason not to treat spam enforcement as something you check once a year.

What a spam update is, and what it isn’t

Google’s spam-detection systems run all the time. A spam update is Google announcing a notable improvement to them. The example it gives is SpamBrain, its AI-based spam-prevention system.

What these systems enforce is Google’s published spam policies, and that’s what separates a spam update from a core update. A core update changes how Google ranks content broadly, so a drop afterwards rarely points to a single cause. After a spam update, a drop often means something on your site matches a rule you can actually name, which makes it easier to find and fix.

Two things get muddled around these updates, so let’s separate them.

AI-written content isn’t automatically spam. Google’s policy on scaled content abuse applies “no matter how it’s created”. The problem is mass-producing pages to rank without giving readers anything useful, whether a person or a tool wrote them. One carefully edited page written with AI help isn’t the target. Two hundred unedited ones are.

Fake or paid-for reviews aren’t part of this update. They fall under a different rulebook, which we’ll get to below.

Should you be worried?

Probably not, but checking is cheap. Google hasn’t said who this update is aimed at, and most honest small-business sites aren’t the target. The sites that get caught are usually carrying something the owner didn’t know about, often left behind by a previous developer or SEO vendor. If you’ve never seen what was done to your site, it’s worth a look. These are the things Google’s policies actually name:

Pages made in bulk with nothing to add. Fifty service pages with the same paragraphs and a different keyword swapped in is the classic version. Google calls it scaled content abuse.

City pages that are copies of each other. Google’s doorway policy names pages targeted at specific cities that funnel visitors to one page. Its keyword-stuffing policy names blocks of text that just list the cities and regions a page wants to rank for, and a footer reading “we serve Lahore, Karachi, Islamabad, Faisalabad…” fits that description. If you serve several cities, each page needs something only that city’s page can say: local projects, real customers, local questions, delivery or service details. If you can’t write that, one honest “areas we serve” page does the job better.

Leftovers from an old SEO package. Hidden text, keyword-packed headings, links bought in bulk or created by software, and links from low-quality directory sites are all named in the policies. Google hasn’t called this a link spam update, but cheap links are still the wrong thing to keep adding.

A hacked site. Owners miss this one because the site can look completely normal to them. Hackers add spam pages you never see, hide links in existing pages, or redirect visitors only when they arrive from Google. Google’s own description includes a redirect that fires from a search result but not when you type the address directly. Outdated plugins and pirated (“nulled”) themes are common ways in, and our post on the signs your website needs a security audit covers what to watch for.

What to do this week

1. Wait for the finish line, and note the date. Don’t rewrite anything based on a few days of data. Until Google marks the rollout complete, movement in both directions is normal.
2. Compare like with like in Search Console. Use equal-length periods before and after September 24, and look at individual pages and queries, not just the site total. One catch: on September 24, Search Console also started splitting Web results into text-based and multimodal, which covers searches that start with an image, like Google Lens. Reports say Google confirmed that traffic wasn’t counted before, so if your impressions look odd around that date, set the Search type filter to text-based and compare that.
3. Rule out the boring explanations first. A site change, a broken redirect, a tracking problem, a seasonal dip in demand. Google’s guide to debugging drops in search traffic walks through them.
4. Check for a hack. Search Google for site:yourwebsite.com and scroll through the results looking for pages you didn’t make, in languages you don’t use, or about things you don’t sell. Look at the security issues and manual actions reports in Search Console. Then open your site by clicking through from a Google result on your phone, not just by typing the address.
5. Audit against the list above, fix what’s real, then wait. Google says changes may help if its systems learn over a period of months that your site follows the policies. Don’t expect a quick bounce back.

Reviews play by a different rulebook

If a past campaign offered “leave us five stars and get 10% off”, stop it. Google’s Maps content policy doesn’t allow reviews posted because of an incentive such as payment, discounts or free goods. It also bans asking only your happiest customers for reviews, pressuring people to post while they’re still on your premises, and telling them what to write. None of that is new, but Google has been tightening how it enforces it this year. It applies to your Business Profile, not to your website’s rankings, so a spam update won’t fix it or cause it. The safe approach is to ask every customer and let them say what they think.

While you’re in Search Console

Search Console now has a separate report for Google’s generative AI features, meaning AI Overviews and AI Mode, which Google rolled out to every property on August 31. It shows impressions but not clicks or search queries, so treat it as a rough signal of whether your pages are being used there, not as a scorecard.

And if your Google Business Profile is half-finished, completing it is some of the cheapest local-search work you can do. Whitespark’s analysis of 1.8 million profiles, published on Search Engine Land, found that specific primary categories and complete profiles go along with better local rankings. That’s a correlation, not proof, but the work is free and takes about an hour. Our Google Business Profile guide for Pakistan covers the setup.

What stays the same

Spam updates will keep arriving. What they enforce hasn’t changed: original pages written for real customers, a clean and secure site, honest reviews, and no shortcuts from anyone promising instant rankings.

If you’d like someone to check whether anything on your site is working against you, our SEO audit covers technical health, on-page issues and competitors, and our security scanning checks for malware, outdated software and signs of a compromise. Or get in touch and we’ll take a look.

Sources: Google’s spam policies (updated 28 August 2026) and its guidance on spam updates; the Search Status Dashboard for dates and rollout times; Google’s Maps content policy; PPC Land’s reports on the rollout window and the Search Console multimodal change; Search Engine Land’s write-up of the Whitespark study. Rollout status can change, so check the dashboard for the latest.