Google released its September 2026 spam update on 24 September, and it applies globally, across every language, with a rollout window of up to two weeks, the longest of any spam update this year. If your rankings shift over the next fortnight, this is almost certainly why, and there's no fix to chase yet because Google hasn't said which tactics it's targeting.
What did Google's September spam update actually change?#
Google's own statement was three lines long: it released the September 2026 spam update, applying globally and to all languages, with a rollout that "may take up to two weeks to complete." No mention of which spam policies moved, no list of affected tactics, and no note about core ranking systems changing at all. This is purely an update to Google's automated spam detection, and Google's own spam policies documentation hasn't been rewritten alongside it either.
That two-week estimate is unusually long. The site Search Engine Land reported that this is the fourth confirmed spam update of 2026, and the previous three moved much faster: March took 19.5 hours, June took just over two days, and August took two days and sixteen hours. September is stretching that out by roughly six times.
Does this affect me if I haven't changed anything on my site?#
Probably not, but "probably" is doing real work in that sentence. Google itself has admitted, more than once, that legitimate sites occasionally get caught in spam updates despite following every guideline. If you see a ranking drop this week with nothing on your end to explain it, don't assume you broke a rule. Check first.
If your site leans on any of the usual spam-adjacent shortcuts, thin AI-generated pages with no original input, scraped or spun content, expired-domain abuse, link schemes, this is the update that's most likely to catch you. Everyone else can mostly keep working and just watch the data for two weeks instead of one day.
Here's what I'd actually check this week if I ran a site with organic traffic that mattered:
- Search Console's Performance report, filtered to the last 7 days against the prior 7, before you touch anything
- Whether the drop (if there is one) hit specific pages or the whole site, since that tells you spam-policy versus something unrelated
- Whether a third-party rank tracker is even reading clean data right now, given Google's own /goto redirect changes earlier this month already broke a few of those tools
- Recovery timeline expectations: Google says compliance fixes can take months to show up in rankings, not days
The honest trade-offs here#
The case for this being a good thing is straightforward. A longer rollout usually means Google is running more careful, more layered checks rather than flipping one blunt switch, and that generally produces fewer false positives over time, even if it's noisier to watch in the short term.
The case against it is just as real. Two weeks of uncertainty is two weeks where you can't tell signal from noise. A dip on day four could be the spam update, seasonal traffic, or a tracking gap, and it can look a lot like the organic traffic loss pattern we've already covered from a completely different cause.
Google gave zero specifics on what's being targeted, so every SEO forum will spend two weeks guessing in public, and some of those guesses will be confidently wrong. I'd treat most "I found the pattern" posts this week with real skepticism, including any of my own if I write one.
How we're handling it#
At WebEpex we pulled Search Console data for every client site the morning this update dropped, on 24 September, specifically to have a clean before-and-after snapshot before two weeks of rolling changes made that comparison harder. That's a five-minute habit, not a project, and it's the single most useful thing anyone can do this week.
We also build most of our own SEO monitoring inside n8n rather than leaning on one third-party rank tracker, and that decision paid off again this month, since the /goto redirect issue was already putting noise into a few of those tools before this update even started. When two things can be wrong at once, you want a monitoring setup you actually trust.
For GCC and European clients running lean on organic traffic right now, we've already made the call to hold off on any reactive content rewrites until the two-week window closes. Reacting to day-three noise on a two-week rollout has burned us before, on a past update, and we'd rather lose a few days of theorizing than ship changes based on half the picture.
What I'd tell a client asking about this#
Don't touch anything yet unless you already know you're running spam-adjacent content. Pull last week's Search Console numbers today so you have a real baseline. Set a calendar reminder for two weeks out, not two days, and check again then. If you do see a drop and you're confident it's unrelated to the update (a broken redirect, a seasonal dip, a tracking issue), fix that specific thing rather than rewriting content that was never the problem. And if you're genuinely unsure which one it is, that's a five-minute question, not a project.
If you want a second pair of eyes on your Search Console numbers this week, send them over and I'll tell you straight whether it's this update or something else. Takes me two minutes, no pitch attached. cal.com/webepex/growth-review
