Google’s September 2026 Spam Update: What Changed, Who Got Hit, and What It Means for Your Links

September 2026 Spam Update - Google rankings shield and filter motif

Oct 1, 2026 · @Justin Davis

Google started rolling out the September 2026 spam update on September 24, and it is the fourth spam update of the year. The earlier three wrapped up in less than three days each. This one has a window of up to two weeks, which means rankings could keep moving until about October 8.

That longer window has made a lot of site owners nervous, and for good reason. Early reports point to heavy losses for programmatic and AI-generated page farms, and some publishers say their Discover traffic fell off a cliff over the weekend after launch.

I have been building backlinks for more than 11 years, and every spam update teaches the same lesson in a slightly different way. In this article, I’ll walk through what Google has actually confirmed, the 2026 policy changes this update enforces, who appears to be losing ground, and what all of it means for your link profile. I’ll also flag the claims floating around that you should not repeat until there is better evidence.

This article was written while the rollout was still in progress. I’ll update it once Google marks the update complete.

What Google Confirmed (and What It Didn’t)

Google’s official statement is a single sentence posted to the Google Search Status Dashboard at 9:15 a.m. Pacific on September 24: “Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete.”

That is the whole announcement. Google did not say which tactics the update targets, how many queries it affects, or whether any one region will feel it more than another. John Mueller confirmed the two-week window was intentional and not a typo.

Here is what we can say for certain:

It applies everywhere. Every country and every language is in scope.
No new policy came with it. The update improves how Google enforces the spam policies that already exist.
SpamBrain does the work. Google describes SpamBrain as its “AI-based spam-prevention system” and says spam updates are the moments when it makes “notable improvements” to it.
Recovery is slow by design. Google says changes “may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies.”

If you are new to how Google judges links and content, my Link Building 101 guide and the backlinks FAQ cover the basics this article builds on.

Is This Really the Longest Spam Update Ever?

No. It is the longest spam update of 2026, but not of all time. Several trade headlines have called it the “longest yet,” and that is only true if you start counting in January.

Google’s own ranking update history tells the full story. The August 2025 spam update ran for 26 days and 15 hours, nearly twice the window Google gave this one.

Update	Started	Finished	Rollout time
September 2026 spam update	Sep 24, 2026	In progress	Up to 2 weeks
August 2026 spam update	Aug 18, 2026	Aug 20, 2026	2 days, 16 hours
June 2026 spam update	Jun 24, 2026	Jun 26, 2026	2 days, 1 hour
May 2026 core update	May 21, 2026	Jun 2, 2026	11 days, 21 hours
March 2026 core update	Mar 27, 2026	Apr 8, 2026	12 days, 4 hours
March 2026 spam update	Mar 24, 2026	Mar 25, 2026	19 hours, 30 minutes
February 2026 Discover update	Feb 5, 2026	Feb 27, 2026	21 days, 17 hours
December 2025 core update	Dec 11, 2025	Dec 29, 2025	18 days, 2 hours
August 2025 spam update	Aug 26, 2025	Sep 22, 2025	26 days, 15 hours

Source: Google Search Status Dashboard, checked October 1, 2026.

How long did each Google update take to roll out?

Every confirmed ranking update from March 2025 to now. Tap a bar for dates. The striped bar is still rolling out.

The August 2025 spam update took 26 days and 15 hours, nearly twice the window Google gave the September 2026 update. Tap any bar to compare.

Spam updateCore updateDiscover updateIn progress (up to 14 days)

Source: Google Search Status Dashboard, checked Oct 1, 2026.

Why does the length matter? A short update usually means a narrow fix. A long one usually means Google is refreshing more of its systems at once, and the impact tends to arrive in waves. That is exactly what we have seen so far, as you’ll read below.

It also matters for diagnosis. Two weeks is a long time for your rankings to move for other reasons, too. If you are trying to figure out how many backlinks you need to recover a lost position, wait until the rollout ends before you make that call.

The 2026 Policy Changes Behind This Update

Google did not add a new policy with this update, but it rewrote several of its spam rules earlier this year. This is the first spam update since some of those changes took effect, so it is worth knowing what is now on the books. Google’s spam policies page was last updated on August 28, 2026.

Five months of rule changes, then one big update

The September update brought no new policy, but it is the first spam update since several 2026 changes took effect. Open each one to see what changed.

Trying to Manipulate AI Overviews and AI Mode Is Now Spam

On May 15, 2026, Google expanded its definition of spam. It now covers “attempting to manipulate generative AI responses in Google Search,” which means AI Overviews and AI Mode.

This is a big deal for anyone selling generative engine optimization (GEO). Tactics like self-promotional “best of” listicles, written mainly so AI tools will cite the author’s own brand, now carry real risk. I covered the early signs of this in Is Google Targeting LLM-Focused Self-Promotional Content?, and the policy change makes that risk official.

The safer path is the one Google has always rewarded: content written for people first. My breakdown of Google’s user-first content guidelines explains what that looks like in practice.

Back Button Hijacking

Google announced a new policy against back button hijacking on April 13 and began enforcing it on June 15. The policy covers sites that stop users from returning to the page they came from, or that send them to pages they never visited, often to show more ads.

In Google’s words: “When a user clicks the ‘back’ button in the browser, they have a clear expectation: they want to return to the previous page.” Sites can break this rule by accident through third-party ad scripts, so check what your ad code is doing.

Site Reputation Abuse Now Splits at the EU Border

Site reputation abuse, often called parasite SEO, is when a strong site hosts third-party content mainly to borrow its ranking power. On August 28, Google changed how it enforces this rule inside the European Economic Area, after talks with the European Commission.

Since August 30, users in the EEA no longer see the effect of a manual action for this policy. Instead, Google says the affected section “may be separated in our systems so that, over time, it ranks independently.” Outside the EEA, nothing changed, and manual actions still demote the pages.

Google's four site reputation abuse factors and how enforcement differs in the EEA — The four factors Google’s reviewers weigh, and how enforcement now differs inside and outside the EEA.

Google also listed four factors its reviewers weigh when deciding whether content breaks this rule:

Presentation: Does the design and formatting match the host site?
Quality: Does the content fall below the host site’s usual standard?
Authorship: Is it clear who owns and wrote the content?
Distribution: Does the same or nearly the same content appear on other sites?

That last factor matters for link builders. Syndicated or spun guest posts that show up on many sites at once look a lot like the pattern Google is describing.

Early Patterns: Who Is Dropping

Google has not said who the update targets, so everything in this section comes from people watching the data. Treat it as early evidence, not a final verdict.

The Impact Is Arriving in Waves

Rank trackers started showing unusual movement on September 23, the day before Google’s announcement. After launch, the first big wave hit from September 25 to 27, with Saturday showing the highest volatility across tools like Semrush, AccuRanker, Mangools and Wincher.

A second wave landed on September 30 and carried into October 1. Several site owners reported “a huge drop right on 9/30”. With up to a week of rollout left, a third wave would not be surprising.

Day by day: the September 2026 spam update

Tap a day to see what happened. The yellow outline marks the day this article was last updated.

September 2026October 2026

Early volatilityLaunchReported waveRolling outRollout window left

Programmatic and AI Page Farms

The clearest pattern so far involves sites that publish huge numbers of templated pages. SEO consultant Glenn Gabe reported big drops “across a number of sites” in many verticals and countries. Lily Ray pointed to sites with highly templated, programmatic, and probably AI-generated pages, giving the example of one page for every phone number or area code. Grokipedia, the AI-generated encyclopedia, also dropped further.

This fits Google’s scaled content abuse policy, which covers “using generative AI tools or other similar tools to generate many pages without adding value for users.” It also lines up with the August 2026 spam update. In that update, SE Ranking data found that 16.71% of top-10 URLs fell beyond position 100, compared with a 9.2% baseline.

Bar chart showing 16.71% of top 10 URLs fell past position 100 compared with a 9.2% baseline — Source: SE Ranking data on the August 2026 spam update.

The same logic applies to link building. Scale is not a crime, but scale without real value is exactly what these systems are trained to find. I wrote about where that line sits in The Truth About Scalable Link Building.

Discover and News Publishers

Some of the loudest complaints are coming from publishers who rely on Google Discover. Site owners have described Discover traffic as “practically dead” after September 30. Others reported Discover drops of around 70% and overall traffic losses of 48% to 80%.

Keep in mind that these figures come from individual site owners, not from a broad study. They show how hard some sites were hit, not how common those losses are.

The Reddit Exception

Not everyone is losing. Reddit’s machine-translated pages surged again in Italy, Germany, Brazil and France, reversing declines from earlier 2026 updates. It is an odd result in an update aimed at low-value, automated content, and it shows how much strong brand and user signals can still outweigh the way a page was produced.

SAFE: Google Is Hunting Networks, Not Just Pages

One of the most interesting stories around this update is a Google research paper on a system called SAFE, short for Scaled Abuse Forensics Examiner. Search Engine Journal reports that the paper describes four AI agents working together; the primary Google Research paper is available here:

A root agent that runs the investigation.
A content agent that looks for signs of synthetic, mass-produced material.
A behavior agent that spots inorganic activity patterns.
A cluster agent that maps networks of related accounts and sites through shared infrastructure.

Inside SAFE: how Google says it hunts spam networks

Google’s research paper describes four AI agents working as a team. Tap each one.

Most spam systems judge one page at a time. SAFE is described as looking at the whole group of accounts or sites behind the content.

Source: reporting on Google’s SAFE paper. Google says SAFE is deployed, but it has not linked SAFE to the September 2026 spam update.

The paper focuses mostly on synthetic video and channel abuse, but it uses broad terms like “synthetic media” and never limits SAFE to video. Google states that “early deployment results indicate that SAFE significantly accelerates the identification of novel synthetic threats.” The report is careful to say SAFE may be part of the September update, not that it is. It is also the second system of this kind identified in 2026, after one called the Scalable Cluster Termination System.

Why should link builders care? Because the cluster agent works on the same idea Google has been patenting for two decades: judge the network, not the single page. I’ve broken down several of those patents on our backlink blog:

Google’s PBN patent groups sites run by one owner and cuts their combined voting power.
Google’s link spam detection patent spots link farms by the shape their links make together, not by how many links there are.
The seed site patent measures how far a site sits from trusted sources in the link graph.
The spammer’s feedback loop explains how Google delays and scrambles ranking changes so spammers can’t test what works. It is also a good reason not to react to day-one movement during a two-week rollout.

If a group of sites shares owners, templates, hosting or link patterns, it leaves a footprint. Systems like SAFE are built to follow those footprints faster than a human reviewer ever could.

What Spam Updates Mean for Your Backlinks

Google has not said whether this update targets link spam. Anyone claiming it does, or that it doesn’t, is guessing. What Google has said, in its spam updates documentation, is far more important for anyone who buys or builds links:

“When our systems remove the effects spammy links may have, any ranking benefit the links may have previously generated for your site is lost. Any potential ranking benefits generated by those links cannot be regained.”

Diagram showing spammy backlinks losing all ranking value after a spam update while editorial links keep theirs — Spammy links lose their value for good. Only new, earned links can replace it.

Read that twice. With most spam problems, you can clean up and slowly recover. With link spam, the value is simply gone. Disavowing or deleting the links will not bring back rankings those links were propping up. The only way back is to earn new links that Google trusts.

Google’s link spam policy is specific about what counts. It includes “buying or selling links for ranking purposes,” exchanging goods or services for links, and automated link programs. Paid placements are allowed only when they carry a rel=”sponsored” or rel=”nofollow” attribute.

Signs a Link Profile Is at Risk

Spam updates tend to expose the same weak spots again and again:

Illustrative example. A natural profile leans on branded and URL anchors and grows steadily. A risky one is heavy on exact match anchors and grows in sudden spikes.

Links from site networks. If many of your links come from sites with the same owner, design or hosting, they can be grouped and discounted together.
Cheap links in bulk. Low prices usually mean low editorial standards. My comparison of $500 vs. $100 backlinks shows where the money actually goes, and Should Backlinks Really Cost Hundreds of Dollars Each? explains why quality costs more.
Over-optimized anchors. Too many exact-match anchors is a classic signal. See why anchor text ratios matter and why anchor diversity still matters when AI writes your pitches.
Unnatural timing. Sudden spikes of new links look different from steady growth. I explain how Google reads that in the historical data patent.
Mass-pitched guest posts. The same article placed on many sites matches the distribution factor in Google’s site reputation rules. After analyzing 1,000 backlink pitches in my own inbox, I estimated that at least 98% offered no real value, and many were selling placements on the same small pool of sites.

How exposed is your link profile?

Tick every statement that is true for your site. These are the patterns spam updates tend to expose.

Low exposure

Nothing ticked yet. Keep earning links the way you are.

What Holds Up Through Every Update

Links that survive spam updates share a few traits. They come from real, independent sites with real audiences. They sit inside content that would exist even without the link. And they build up at a pace that looks like a business getting noticed, not a campaign being run.

That is the idea behind building a natural backlink profile, and it is why Google’s reasonable surfer patent gives more weight to links people are likely to click. If you want to see how we apply this with clients, our link building process lays it out step by step. Agencies that resell links can also review our white label link building approach, since a spam hit on a client’s site lands on the agency’s reputation too.

Spam Update or Core Update? How to Read Your Search Console Data

A traffic drop in late September does not automatically mean the spam update hit you. Rankings move for many reasons, and a two-week rollout overlaps with plenty of them. Here is a simple way to sort it out:

Mark the dates. Add annotations in your reporting for September 23 (early volatility), September 24 (launch), September 25 to 27 (first wave) and September 30 (second wave).
Compare page groups, not the whole site. Spam systems often hit one section, such as a directory of templated pages or a guest post area, harder than the rest.
Check other search engines. It’s worth checking whether your losses happen only on Google. If Bing traffic holds steady while Google drops, an algorithm change is the likely cause.
Look at competitors. If the sites around you dropped too, the change may be broad. If you dropped alone, look closer at your own pages and links.
Check for manual actions. Open the Manual Actions report in Search Console. A spam update is automated, but a manual action is a separate notice from a human reviewer and needs a different response.
Wait for the finish line. Don’t judge the final impact until Google marks the update complete on the Search Status Dashboard.

Did the spam update hit your site? A 60-second check

Answer five quick questions about your traffic drop. This is a starting point, not a diagnosis.

Based on Google’s guidance on spam updates and its spam policies. Nothing you enter is saved.

While you are in your data, it helps to know which numbers actually matter. My guide to common SEO metrics in link building explains what to track, and How to Use AI to Analyze Competitor Backlinks 10x Faster shows how to compare your profile with the sites that held their ground.

If You Were Hit: A Recovery Plan That Doesn’t Backfire

The worst thing you can do after a spam update is panic. Former Google search team member Kaspar Szymanski warned recently that rushed moves, like deleting content in bulk or filing a reconsideration request too early, can make recovery harder.

Seven step roadmap for recovering from the Google September 2026 Spam Update — Recovery takes months, and many sites don’t fully recover until a later update.

Here is a calmer plan:

Wait for the rollout to end. This update is arriving in waves, so early losses can deepen or ease before it’s over.
Audit against the actual policies. Go through Google’s spam policies one by one. Look hardest at scaled content, site reputation abuse, expired domain abuse and link spam.
Fix the cause, not the symptom. If you have thousands of thin, templated pages, improve them, merge them or remove them. Simply rewording them will not change what they are.
Clean up your link building going forward. Stop any paid link schemes and add rel=”sponsored” to paid placements. Remember that links Google already discounted won’t come back, so focus on earning new ones.
Get an outside view. Szymanski recommends an independent audit, because it is hard to judge your own site fairly.
Be patient. Google says sites can improve as its systems learn “over a period of months” that they follow the rules. Many sites don’t see full recovery until a later update.
Spread your risk. Szymanski also suggests building traffic sources beyond Google, so a single update can’t sink the business.

If you need to rebuild authority after cleaning things up, set realistic goals first. How Many Backlinks Can I Expect? The 80/20 Rule and our backlink costs calculator can help you plan a budget that doesn’t cut corners. You can also review our backlink pricing to see what a quality campaign involves.

Key Takeaways

The September 2026 spam update began on September 24 and could run until about October 8. It is the longest spam rollout of 2026, but the August 2025 update ran longer.
Google named no targets. Early evidence points to programmatic, templated and AI-generated page farms, with heavy reported losses for some Discover publishers.
This is the first spam update since Google made manipulating AI Overviews and AI Mode a spam violation. GEO tactics built on self-promotion now carry real risk.
Google is getting better at spotting networks, not just single pages. Shared owners, templates and link patterns leave footprints.
Links Google discounts as spam lose their value for good. The only lasting fix is earning links from real, independent sites.

Spam updates keep raising the bar, and that has always been good news for anyone doing link building the right way. If you’d like a second opinion on your link profile, or want to build links that will still count after the next update, get in touch with Link Builders. You can also read more about who I am and how I work, or browse the rest of the Link Builders blog, including Building Backlinks in an Age of AI.