In short
Google's September 2026 spam update has completed its rollout. Spam updates target policy violations rather than general quality, so most sites see nothing. If your traffic moved during the rollout window, the first job is separating a spam-update effect from the ordinary volatility that runs alongside it - and the honest answer is often that you cannot, which changes what you should do about it.
How to tell whether it touched you
Open Search Console, set the date range to span the rollout window with several weeks either side, and compare like with like. Three things to look for:
- A step change rather than a drift. Spam updates tend to produce an abrupt move on a specific date, not a gradual slope.
- Whether it is site-wide or page-level. A site-wide drop points at something structural; a drop confined to a section points at that section.
- Whether impressions or position moved first. Losing impressions while position holds usually means something other than an algorithm update.
Be wary of the trap here. Something always changes in the same window - seasonality, a competitor's launch, a site change of your own. Attributing a move to the update because the dates line up is the most common error in this kind of analysis.
Three patterns worth auditing anyway
Regardless of whether this update touched you, these are the policy areas that carry the most exposure for ordinary businesses:
- Scaled content without added value. Pages produced in volume from a template - location pages, category permutations, product descriptions that differ only in the attributes.
- Link schemes. Paid links, reciprocal link arrangements, and directory networks whose only purpose is links. Worth noting that networks of sites under one owner linking to each other fall here too.
- Expired-domain abuse and parasite content. Buying authority rather than earning it. Less common among small businesses, but it does arrive via agencies.
If you were affected
Spam updates are not recovered by waiting. If a policy violation caused the drop, the violation has to go, and the recovery usually arrives with a later update rather than immediately after the fix.
The more useful framing: if you cannot identify a violation, you probably were not hit by a spam update, and you should be looking at the ordinary explanations instead - a technical change, a competitor, a seasonal pattern, or a core update that overlapped.
Sources
Want to know what an AI agent sees on your site?
We check exactly that as part of an audit: crawler access, what is in the initial HTML, and the layer of information an agent can actually cite. Free SEO & AEO report → or talk to us →