Google’s September 2026 spam update: the lessons that last

Google's September 2026 spam update ran from 24 September to 8 October 2026. What Google confirmed, how it differs from a core update, and how to respond.

Every few weeks, a marketing team somewhere sees organic traffic move and asks the same question: was it the Google update?

Sometimes it was. Often it was not. The way to tell starts with knowing exactly what Google has confirmed, and when.

This article looks at the most recent ranking update documented on Google’s Search Status Dashboard at the time of research, 10 October 2026, and the lessons that outlast it.

The latest update: September 2026 spam update

According to the dashboard entry, Google released the September 2026 spam update on 24 September 2026. Google said it “applies globally and to all languages” and that the rollout “may take up to two weeks to complete.”

The dashboard recorded the rollout as complete on 8 October 2026.

Google did not publish a detailed list of what this particular update targeted. Any claim that it hit a specific tactic should be treated as observation or speculation unless Google says so.

The busy year around it

The September release was not an isolated event. The dashboard lists several ranking updates in 2026 alone.

There were spam updates in March, June and August. There were broad core updates in March, from 27 March to 8 April, and in May.

The May 2026 core update is the most recent core update listed. It began on 21 May 2026 and completed on 2 June 2026.

For a CMO, the main point is simple. Updates are routine, so a strategy that depends on any single ranking state is fragile.

Spam updates and core updates are different

These two types of update are often lumped together. Google’s documentation treats them quite differently.

Spam updates target practices that break Google’s spam policies. Google’s spam updates guidance says it uses automated systems, including one called SpamBrain, and that sites affected should review their compliance with those policies.

Core updates are broad changes to how Google assesses content overall. Google’s core updates guidance says a drop after a core update does not necessarily mean anything is wrong with a page.

That distinction changes the response. A spam-related drop calls for a compliance review. A core update drop calls for an honest look at content quality and usefulness compared with competitors.

Recovery is slow, and not guaranteed

Google is unusually direct about timing.

The spam guidance says that after fixing problems, improvements may take months to show. It also says that ranking benefits previously gained from spammy links, once lost, will not return.

The core updates guidance says recovery may take several months, and in some cases may not come until the next core update. It also notes that improvements do not guarantee recovery.

This matters for budgeting. If a channel drops after an update, plan for a recovery measured in quarters, not weeks.

How to read your own data

Google’s core update guidance sets out a sensible order of work.

First, wait until the rollout is complete. Then wait at least a full week after completion before analysing, and compare with a similar period before the update began.

Second, judge the size of the change. Google contrasts a small movement, such as from position 2 to 4, which needs no drastic action, with a large one, such as 4 to 29, which merits a deeper assessment.

Third, look at search types separately. Web, image, video and news traffic can behave differently.

For the September spam update, that means a fair analysis could begin from around mid-October 2026, comparing with the weeks before 24 September. That date is our own arithmetic from Google’s guidance, not a Google instruction specific to this update.

Not every update is announced

Google’s core updates guidance adds a point that is easy to miss. It says Google makes smaller core updates throughout the year that it does not announce, because they are not widely noticeable.

So the absence of a dashboard entry does not prove nothing changed in ranking systems. And the presence of one does not prove a given site was affected.

Rule out the other explanations

Before attributing a change to the update, check two other causes.

The first is measurement. Tracking changes, site releases and reporting glitches can all move the numbers on their own.

The second is seasonality. A drop in September for a summer product may have nothing to do with any update. Year-on-year comparisons help separate the two.

This edition’s companion article sets out a step-by-step method for both checks.

Who should own the response

The two update types also suggest different owners.

A spam-related drop is a compliance question. It belongs with whoever controls link-building, content sourcing and any third-party content hosted on the site.

A core update drop is a quality question. It belongs with the people who decide what content gets made, and whether it is genuinely more useful than the alternatives a searcher could find.

Durable lessons for a CMO

Four lessons outlast this particular update.

Know the dates. Keep a simple log of confirmed updates from the dashboard next to your traffic chart.

Separate compliance from quality. Spam updates and core updates need different responses and different owners.

Avoid quick fixes. Google’s guidance warns against rushed changes, and treats removing content as a last resort rather than a first move.

Budget for patience. Recovery, where it happens, is measured in months.

What not to conclude

A confirmed update and a traffic change in the same week are a correlation, not a diagnosis.

The honest answer to “was it the update?” is often “possibly, and here is what else changed in the same period.” That answer is more useful to a board than certainty you cannot support.