Google’s September 2026 Spam Update: What Small Business Sites Should Check, and What to Leave Alone

Google started rolling out the September 2026 spam update on September 24 at 9:15 a.m. Pacific, according to its Search Status Dashboard. It is the fourth spam update this year. The first three finished in under three days each. This one has a window of up to two weeks, and Google has not said what it is aimed at.

That combination is how small business owners end up buying a recovery package before the rollout is even finished. So this is the practitioner read: what is confirmed, what is guesswork, which sites should actually worry, and how to check your own without changing anything you will regret.

What did Google actually announce?

Very little, and that is worth taking at face value. The dashboard entry says the update applies globally, to all languages, and may take up to two weeks to complete. No named target, no new policy, no mention of links. Search Engine Roundtable confirmed it is not a link spam update.

Here is how it compares with the rest of 2026, using the rollout times Search Engine Journal tracked:

Two other dates matter as context, though Google has tied neither to this update. On May 15, Google clarified that its spam policies cover attempts to manipulate AI Overviews and AI Mode, not only rankings. And the spam policies page itself shows a last-updated date of August 28, 2026.

Does a two-week rollout mean this update is bigger?

Maybe. Nobody outside Google knows yet. A longer window could mean more systems involved, more data to process, or a staged release, and the Digital Applied team made the honest point on day one that anything more specific published this week is inference, not information.

What it does mean for you is practical. For the next two weeks, daily rank movement is noise. Rank tracking tools showed volatility spikes on September 24 and 25, which tells you something moved. It does not tell you it moved your site, or that it moved for a spam reason.

Our own view is that the window length is the least interesting part. The interesting part is that this is the fourth spam update in six months. Google is now running spam enforcement on something close to a quarterly rhythm, so a shortcut on your site gets re-tested every few months, not every few years. Tactics that survived the last update have not been cleared. They have been postponed.

Will the September spam update affect my small business website?

Probably not, if your site is a normal service business site with pages a person wrote about work you actually do. Spam updates enforce Google’s spam policies. They are not a quality review of your homepage. The sites Glenn Gabe documented after the August update were running programmatic content across hundreds of thousands of URLs, thin Amazon affiliate pages padded with AI filler, and redirects into worse sites.

Small business sites do get caught, though, and it is usually something an agency, a plugin, or a previous owner added years ago. These are the patterns we would check first on a local or service business site, matched to the policy names on Google’s own list:

The first row is the one we would look at hardest. Templated city pages have been standard local SEO advice for a decade, and plenty of agencies still sell them by the batch. A location page that describes real jobs done in that area, the actual service radius, and the team that shows up is a page. Forty copies of one paragraph with the town name changed is a doorway, and Google has had a policy name for that for years.

We have audited and consolidated templated city pages on service business sites across a few client types, and the pattern is consistent: the bulk pages rarely send meaningful enquiries, the one genuine location page does, and consolidating the rest into redirects onto a strong service-area page has not cost the traffic the templated pages were credited with. That is an observation from the accounts we have touched, not a controlled study, but it is why we would consolidate first and ask questions later.

How do I check whether my site was hit?

Wait until Google marks the rollout complete on the dashboard, then compare the two weeks after against the two weeks before in Search Console. Anything earlier is guessing. This is the check we would run on any site we manage:

• Bookmark the incident page and wait. The dashboard entry will update when the rollout finishes.
• Compare date ranges in Search Console. In Performance, then Search results, use the Compare option on the date filter: 14 days after completion against the 14 days before September 24.
• Remove branded queries. Add a query filter that excludes your business name. Branded searches rarely move on a spam update, and they hide what is happening on everything else.
• Read the Pages tab for a pattern. Spam demotions tend to follow a pattern: every city page, the whole blog folder, or the entire site. A drop spread thinly across unrelated pages usually points somewhere else.
• Open Manual Actions and Security Issues. The Manual Actions report only lists actions taken by a human reviewer, so an empty report does not clear you of an automated demotion. Security Issues matters because hacked content is on the policy list.
• Rule out the boring causes. A redesign that dropped the tracking tag, a site migration, seasonality, or the ordinary movement that happens every week. If the drop is in Google Maps and the local pack rather than in organic results, that is usually a profile problem, not a spam demotion; here is the order we check a Google Business Profile that stopped showing up.

Then check the number that pays the bills. Rankings are a proxy. If your CRM records lead source, pull organic leads for the same two windows. A rank tracker can flag a fall on terms that never sent a single enquiry, and stay flat while the one page that did send enquiries slides. This is the argument we keep making about connected growth systems: you only get a clean answer when search data and lead data sit in the same place. We covered the setup side in our post on tracking AI and search referrals inside a CRM.

What should I not do while the update rolls out?

Do not rewrite pages mid-rollout. If you change ten things during a two-week update, you will never know which change did what.

Do not disavow links in a panic. Google’s own spam update documentation says something most people miss: when its systems neutralize spammy links, whatever ranking benefit those links gave you is simply gone, so cleaning them up may not bring anything back.

Do not pay for “spam update recovery” this week. Nobody can diagnose an update that has not finished.

Do not shift your whole organic budget into ads on day three. Decide that with two weeks of lead data, not two days of rank tracker screenshots.

If my site was hit, how long does recovery take?

Months. Google’s documentation says a site may improve if its automated systems learn, over a period of months, that the site now complies. Gabe’s read on the August cases was the same: expect at least several months after the cleanup is done.

The cleanup has to remove the pattern, not trim it. For templated city pages, that usually means one strong service-area page plus a small number of genuine location pages, with the rest redirected. For an AI-scaled blog, keep the posts that earn traffic and rewrite them properly, then delete or noindex the rest. Half-measures leave the pattern for the next update to find. If you want a second pair of eyes on which pages fall where, that is part of what our SEO service covers.

What we’ll only know once the rollout finishes

Whether the sites that dropped share a pattern, which the case-study write-ups will start surfacing in October. And whether a two-week window is the new normal or a one-off.

If you have watched a spam update hit a site you were sure was clean, we want to hear what it had in common with the others, because those false positives teach more than the obvious cases. We will write up what we see once the rollout closes. Join the list if you want it when it goes out.

Frequently asked questions