The September spam update is finished: how to check if your site was hit

Was my site hit by the September 2026 spam update?

Google spam updates in 2026, how long each rollout ran

24 Mar 202619 hours, 30 minutes
24 Jun 20262 days, 1 hour
18 Aug 20262 days, 16 hours
24 Sep 202613 days, 16 hours

Source: Google Search Status Dashboard

Google's September 2026 spam update ran for 13 days and 16 hours. That is longer than the year's three earlier spam updates put together. Our estimate, from the durations on Google's status dashboard: 328 hours, against 19.5 for March, 49 for June and 64 for August, which add to 132.5. That makes September roughly two and a half times the three earlier spam updates combined, and about five times August's.

That long window is why a dip in your traffic over those two weeks proves nothing on its own. Something else could easily have happened to your site in a fortnight. To know whether the update touched you, compare your Search Console numbers for 24 September to 8 October with the weeks either side, then open the Manual actions report.

The dates are now fixed. Google's dashboard entry reads: "Released the September 2026 spam update, which applies globally and to all languages." Its final note says: "The rollout was complete as of October 8, 2026."

One thing nobody can tell you is what the update was aimed at. As Search Engine Journal points out, neither Google's spam updates page nor the dashboard's notes say what the rollout addressed, or why it ran so much longer than this year's earlier ones. So the check below works from your own data, not from a guess about Google's target.

Step one: compare the rollout fortnight with the weeks either side

Before

DuringRollout: 13 days, 16 hours

After

24 Sep Released the September 2026 spam update
26 Sep Rank trackers show sudden changes searchers didn't see
8 Oct The rollout was complete as of October 8, 2026.
Around 11 Oct Performance report over 64 hours behind
12 Oct back to normal
Wait a few weeks, then re-check Search Console

During + after

against

Previous period

and

Same dates last year

Source: Google Search Status Dashboard, Search Engine Journal, Search Engine Roundtable, Google Search Central

Open the Performance report in Search Console. Set a custom range from 24 September to 8 October 2026, plus a couple of weeks after it. Then use Compare twice: once against the previous period, once year over year.

Google's traffic-drop guide also suggests setting the date filter to the last 16 months. That shows whether this time of year always dips for you, which a spring slowdown in your trade would explain far better than any update.

Two habits keep the picture honest:

Switch to weekly view. The Performance report lets you choose weekly or monthly granularity, which smooths day-to-day swings. A single bad Tuesday stops looking like a trend.
Ignore the dotted line. The newest data "can be preliminary" and shows dotted. Judge only the solid part.

If you looked during the weekend after the rollout and saw a cliff, look again. The Performance report ran over 64 hours behind around 11 October and was back to normal by the morning of 12 October.

Step two: read what fell, and where

What your Performance report shows	What Google's guide says it points to
Impressions and clicks both fell	Work through the common causes of a drop
Impressions held but clicks fell	A weak page title or snippet, or competitors' stronger rich results, may be the cause
Sort pages by "Clicks Difference"	To see whether the loss is site-wide, a group of pages or one page
16-month view with year-over-year Compare	To rule out yearly seasonality

Source: Google Search Central

The pattern matters more than the size of the drop. Google's traffic-drop guide reads it like this:

Impressions and clicks both fell. Work through the common causes in step four.
Impressions held but clicks fell. You were still being shown, people just clicked less. Google says a weak page title or snippet may be the cause, or competitors may have stronger rich results.
Sort your pages by "Clicks Difference". This tells you whether the loss is site-wide, a group of pages or one page. A whole site sliding points somewhere different from one blog post losing its spot.

You can also filter by web, image, video or news if your traffic comes from more than plain web results.

For reading these reports month to month, beyond this one update, our guide How to tell whether your SEO is actually working goes through the rest.

Step three: open the Manual actions report

Search Console: Manual actions report

A green check mark and an appropriate message

No manual action: any change is algorithmic or another cause, so go to step four

Manual action listed (from a human reviewer at Google)

Fix every affected page (no partial return for some pages)
Select Request Review
Review can take several days or weeks
Don't resubmit before a decision

Also check: Security issues report, Data anomalies page

Source: Google Search Console Help, Google Search Central

A spam update is not a manual action, which comes from "a human reviewer at Google" and is reported to you in Search Console.

That makes this report the quickest yes or no you will get on whether a manual action is in play. If there is a manual action, Google says "we will notify you in the Manual actions report and in the Search Console message center." If there is none, the report shows "a green check mark and an appropriate message".

If you do find one, fix it properly. Google is blunt: "Fixing the issue on just some pages will not earn you a partial return to search results." Fix every affected page, then select Request Review. Reviews "can take several days or weeks", and you should not resubmit before a decision comes back.

While you are in Search Console, open the Security issues report and the Data anomalies page too. The traffic-drop guide lists both as early checks.

Step four: rule out the other causes

Possible cause of a drop	Where to look
Algorithmic update	Google's status dashboard
Technical issues	Page indexing, Crawl stats
Security issues	Security issues report
Spam issues	Manual actions report
Seasonality and changing interests	16-month date filter, Google Trends
Site moves	Google's site-move troubleshooting guidance
Reporting glitches	Data anomalies page

Source: Google Search Central, Google Search Status Dashboard

A green check mark and a drop that lines up with the rollout still only gives you a coincidence in timing. In Search Engine Journal's words, "a dip during this time doesn't automatically mean the update was the cause."

Google's traffic-drop guide names the usual suspects: an algorithmic update, technical issues, security issues, spam issues, seasonality and changing interests, site moves, and reporting glitches. For the technical and security ones it points you to Security issues, Page indexing and Crawl stats.

Two of those causes are worth ruling out early, and neither is about spam:

Crawlers being blocked. If Crawl stats fell off, check your firewall settings. Our article on whether Cloudflare blocks Googlebot shows how.
Pages dropping out of the index. Our 20-minute website health check covers the basics you can test yourself.

If your drop started after 8 October, note that at the time of writing Google's dashboard listed no ranking update running since. A later fall needs a different explanation.

If the timing still fits, skim the spam policies

Google spam policy	What it looks like on a small business site
Scaled content abuse	"Using generative AI tools or other similar tools to generate many pages without adding value for users"
Keyword stuffing	"Blocks of text that list cities and regions that a web page is trying to rank for"
Hacked content	Injected pages, hidden links, redirects that can depend on the referrer, user agent or device
Link spam	Buying or selling links, not a violation if qualified with rel="nofollow" or rel="sponsored"
Doorway abuse
Site reputation abuse
Google hasn't said which of these the September update addressed.

Source: Google Search Central, Search Engine Journal

Google's own advice after a spam update is plain: "Sites that see a change after a spam update should review our spam policies to ensure they are complying with those." It adds that sites that break them "may rank lower in results or not appear in results at all."

The full list is long, but a handful are the ones a small business site realistically trips over:

Scaled content abuse. Google's example is "Using generative AI tools or other similar tools to generate many pages without adding value for users". A batch of near-identical suburb or service pages written by a tool fits that description.
Keyword stuffing. Google's example: "Blocks of text that list cities and regions that a web page is trying to rank for". The "we service Parramatta, Penrith, Blacktown…" footer is the classic case.
Hacked content. Injected pages, hidden links and redirects that depend on the referrer, user agent or device. You may not see these when you visit your own site directly.
Link spam. Paying for a link is not a breach in itself, as long as it is qualified with a rel="nofollow" or rel="sponsored" attribute.
Site reputation abuse. We covered how this one applies here in Google eased its site reputation penalty in Europe, not in Australia.

Read this list as a self-check, not a diagnosis. Google hasn't said which of these the September update dealt with. If the drop was large, Google's guide says to "self-assess your whole website overall (not just individual pages)".

What the early figures showed across thousands of sites

Diib's early read, 32,569 sites, 24 to 26 Sep vs a week earlier

Median share of visits from unpaid Google search

A week earlier34%
24 to 26 Sep31%

Sites losing half or more of that share

Earlier period5%
24 to 26 Sep10%

"an early read, not a verdict"Source: Diib, reported by Search Engine Journal

The only broad numbers so far come from Diib, as reported by Search Engine Journal. Across 32,569 sites, the median share of visits from unpaid Google search fell from 34% to 31% on 24 to 26 September, compared with a week earlier. Ten per cent of sites lost half or more of that share, against 5% in the earlier period.

Diib itself called it "an early read, not a verdict", and it covers only the first three days of a rollout that ran almost a fortnight. It suggests more sites than in the week before took a heavy hit early on. It says nothing about yours. Only step one does that.

What to leave alone while you check

Rank-tracker charts on their ownTrackers showed changes from 26 Sep that searchers didn't see
Rewriting pages that already perform wellGoogle recommends "avoiding making radical changes if your page is already performing well"
Deleting or disavowing links in a panicGoogle hasn't said this was a link spam update
Building your own rank scraperScraping Google for rank-checking counts as "machine-generated traffic"
Expecting a quick reboundGoogle talks about "a period of months"

At Search Engine Hub, our view is that the most expensive mistakes after an update are the ones made in a hurry. Here is what to keep your hands off.

Rank-tracker charts on their own. A drop on a rank tracker is not proof the update hit you, because many trackers showed sudden changes from 26 September that searchers didn't see. Search Engine Roundtable reported one tracking firm's finding that around 8.0% of results came back poisoned, and another provider said about 2% of tracked results were still affected as of 16 October. A decline that lasts several days and shows in impressions and clicks "carries more weight than a quick fluctuation seen on third-party charts".

Don't swap in a home-made rank scraper either. Google counts scraping its results for rank-checking without permission as "machine-generated traffic", which is on the spam list too.

Pages that are still doing well. Google's guide says "Small fluctuations in position can happen at any time (including moving back up in position, without you needing to do anything). In fact, we recommend avoiding making radical changes if your page is already performing well." A whole-site rewrite risks the pages that were never the problem.

Your links, in a panic. Google hasn't said this was a link spam update. Mass deleting or disavowing links on a hunch is a big step to take on thin evidence. If step four turns up paid links without nofollow or sponsored on them, that is a specific fix. A blanket clean-up is not.

The calendar. Don't expect a bounce by next week. The next section explains why.

How long recovery takes, if your site was affected

The check at a glance

Rollout: 24 Sep 2026 to 8 Oct 2026, 13 days, 16 hours
Google Search Status Dashboard
Compare in Search Console: previous period, year over year, last 16 months, sort by Clicks Difference
Google Search Central
Manual actions report: a green check mark, or fix all pages and Request Review; reviews can take several days or weeks
Google Search Console Help
After changes, wait a few weeks before re-checking
Google Search Central
Improvement, if it comes, is learned over a period of months; there's no guarantee
Google Search Central

Source: Google Search Status Dashboard, Google Search Central, Google Search Console Help

Google measures this in months. Its spam updates page says: "Making changes may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies."

The traffic-drop guide says some changes take effect in "a few days" and others in "several months", and suggests waiting "a few weeks" before re-checking Search Console. It also says, plainly, that "there's no guarantee that changes you make to your website will result in noticeable impact".

So fix what you found, write down what you changed and when, and leave the rest alone long enough to read the result.

When to get a second pair of eyes

If your checks turn up a manual action, a security issue, or a drop that sits on one group of pages and isn't seasonal, that is worth talking through before you change anything. The same goes if the numbers simply don't add up.

Tell us the situation: what fell, from when, and what you've already checked. Search Engine Hub will give you a straight read on it. We won't promise you page one, because nobody honestly can, and Google says as much itself.