Google finished its September 2026 spam update on 8 October 2026, after 13 days and 16 hours of changes to the systems that police its search results. If your website's visits from Google moved in late September, that is the first thing worth checking, and the easiest thing to get wrong.
Here is what actually happened, a five-minute way to check your own site, and the handful of moves that help. None of it needs technical knowledge, and none of it needs money this week.
What happened, and when
The update started on 24 September 2026 and Google marked it complete on 8 October 2026: 13 days and 16 hours, against the "up to two weeks" the company warned about at launch. It applied everywhere, in every language. For scale, this year's three earlier spam updates each finished in under three days, while the one in August 2025 ran to about 27 days.
Google describes a spam update as an improvement to its automated systems for spotting sites that break its rules. What it has not published is which rules this round concentrated on. There is no named tactic, no named industry, and no statement that AI-written content was the target. Anyone telling you confidently what it hit is filling that gap with a guess.
Take the uncertainty seriously: Google's own dashboard says only that the update was global, covered all languages and could take up to two weeks. Claims that go beyond that stay opinion until Google adds detail.
What Google's spam rules cover, in plain English
You do not need the policy document to understand the shape of it. The rules target sites that publish pages mainly to occupy search results rather than help a reader.
Mass-produced pages. Dozens of near-identical service or location pages, generated in bulk, saying the same thing six slightly different ways.
Borrowed authority. Buying an old domain and filling it with thin content to inherit its history, or hosting third-party pages that ride on your site's reputation without adding anything for your visitors.
Tricks. Doorway pages that funnel visitors somewhere else, hidden text, and keywords repeated until the page reads like something wrote it for a machine rather than a customer.
Sites that break these rules can rank lower or drop out of results altogether. On 1 October 2026, Google also refreshed its guidance on AI-written content: using AI to help write is fine, while publishing large numbers of unoriginal pages mainly to climb the rankings is not. Google has said separately that it can lose trust in a site leaning on low-value templated pages, which means the damage is not always limited to the pages that caused it.
Your rank tracker may have moved without Google doing anything
Rank-tracking tools reported sudden swings from 26 September, before the update had got far. One of those platforms, SEOmonitor, attributes the movement to incomplete and inconsistent results Google returned to automated searches: the changes never appeared to people actually searching.
That distinction matters because trackers estimate while Search Console records. A real update effect tends to hold across several consecutive days and shows up as impressions and clicks in your own data. A line that dips for two days on a third-party chart is not evidence of anything.
A five-minute check on your own site
Do this before changing anything on your website.
1. Open Search Console and go to Performance, then Search results.
2. Set your dates. Compare 15 to 23 September, before the update, with 29 September to 6 October, after it finished rolling out. Leave the rollout itself out of both.
3. Look at pages first, then search terms. Several similar pages falling together is a signal. One page having a bad Tuesday usually is not.
4. Read the pattern, not the day. Low-traffic sites swing naturally, because a handful of visits either way moves the average.
For context rather than diagnosis: an early read published on 29 September 2026, covering 32,569 connected websites, found the median share of visits from unpaid Google search fell from 34% to 31% across 24 to 26 September compared with the week before. Its authors called it an early read, not a verdict, and the data cannot show which sites were caught by the update.
Resist the panic window. The two weeks of a rollout are the worst possible time to redesign, delete or rewrite a site. Judging an update by a single bad day is how businesses make changes they regret for months.
What a real fix looks like
If the check above does show a drop, start from Google's published spam policies rather than guesswork. Find the pages that do not earn their place: near-duplicate service pages, thin location pages, old posts written for a search engine instead of a customer, landing pages that exist only to catch traffic.
Then either merge them, rewrite them around what a customer genuinely asks, or remove them if they serve no purpose. Keep publishing useful, original material on a schedule you can sustain. Google's documentation says revisions may be recognised over a period of months, and at a Search Central Live session in Barcelona on 2 October 2026 a Google engineer put core update recovery at three to six months in normal cases and six months to a year in slower ones. Spam updates are not core updates, so read that as how Google thinks about recovery, not a date to wait for.
What not to do
Do not delete content in a panic. Removing pages is a legitimate fix for the wrong pages and a terrible one for everything else.
Do not buy a fast recovery. Nobody can shortcut Google's automated systems, and offers to do so are usually money spent on nothing.
Do not rewrite the whole site with AI in one weekend. Bulk publishing is exactly what the refreshed guidance from 1 October warns about, so it points a spotlight at you rather than away from you.
The best protection is unremarkable
A site with a sensible number of pages, written for real people and updated when there is something worth saying, is very hard to catch in a spam sweep. So is content that answers the questions your customers actually type. As more searches end inside an AI answer rather than a list of links, that same readable, clearly structured content is what gets quoted. Our AEO setup service exists to make that happen on purpose, and how AI search picks its sources explains the mechanics behind it.
The other option is knowing where you stand before Google looks. Our AI Website Audit reads your site the way search systems do and lists the pages that put you at risk, in the order worth fixing them. If you would rather start yourself, the SEO basics guide covers the groundwork.
Worried your rankings have slipped?
We read your site the way Google's systems do, flag the thin, duplicated and templated pages that put you at risk, and tell you which fixes to make first. You get a plain-English report, not a spreadsheet of jargon.
Get an AI Website Audit