A Google Spam Update Is Rolling Out. What Should You Actually Do?

A Google Spam Update Is Rolling Out Right Now. What Should You Do?

As of 25 September 2026, Google is rolling out the September 2026 spam update. Its own Search Status Dashboard lists the announcement date as 24 September 2026 with no completion time yet. The honest answer for most B2B sites is simple. Watch, do not panic, and change nothing this week.

We say that because we have watched this pattern all year with client sites. Rankings wobble for a few days. Someone screenshots a drop. A plan gets made to rewrite forty pages. Then the update finishes and most of the drop comes back on its own.

That does not mean spam updates never matter. They do, and a small number of sites deserve a real look. This piece is about telling those two groups apart before you spend a month of your team's time.

What Is a Spam Update, and How Is It Different From a Core Update?

A spam update improves the systems that catch practices Google bans outright. A core update changes how Google judges quality across the board. Spam updates target rule breaking. Core updates re-weigh everything. A site can shrug off one and feel the other clearly.

Google's spam policies page names sixteen categories. Cloaking, doorway abuse, expired domain abuse, hacked content, hidden text and link abuse, keyword stuffing, link spam, machine-generated traffic, malicious practices, misleading functionality, scaled content abuse, scraping, the site reputation policy, sneaky redirects, thin affiliation, and user-generated spam.

Read that list again and notice what is not on it. Nothing about design. Nothing about page speed. Nothing about whether your blog posts are long enough. A spam update is not a quality review. It is enforcement.

The 2026 record backs this up. Google's status dashboard shows a March 2026 spam update, a June 2026 spam update, an August 2026 spam update, and now the September one. Between them came a March 2026 core update and a May 2026 core update. Two different machines, running on two different schedules.

How Long Do These Updates Take to Finish?

Spam updates finish fast. Google's status dashboard records the August 2026 spam update at 2 days and 16 hours, the June 2026 spam update at 2 days and 1 hour, and the March 2026 spam update at 19 hours and 30 minutes. Core updates run far longer.

The same dashboard puts the May 2026 core update at 11 days and 21 hours, and the March 2026 core update at 12 days and 4 hours. The February 2026 Discover update ran 21 days and 17 hours. So a spam update is usually done inside three days, and a core update takes closer to two weeks.

This single fact should shape your calendar. If you start rewriting pages on day one of a spam update, you will finish your first draft after the update has already completed. You will then have no way to tell whether your edits helped, hurt, or did nothing at all.

How Do You Tell a Spam Update Hit From Normal Traffic Noise?

Look for a sharp, sustained change that starts on the announcement date and holds after the rollout ends. Compare the same weekdays, not raw daily totals. Segment by page type. A real hit lands on a group of similar pages, not evenly across the site.

Our rough test is this. Pull Search Console clicks and impressions for the four weeks before the announcement and the two weeks after. Break the site into folders. Blog, product pages, docs, glossary, location pages, and anything programmatic. Then look for a folder that moved while the rest held steady.

If everything moved a little, that is noise or seasonality. If one folder fell off a cliff and the others did not, you have a lead. We wrote more about separating the causes in our guide to diagnosing an SEO traffic drop, and the same order of operations applies here.

One more check that saves a lot of arguing. Confirm the pages are still indexed. A ranking change and a page dropping out of the index look identical in a traffic chart and have completely different fixes.

Which Spam Policies Catch Real B2B Sites by Accident?

Three of the sixteen catch normal companies doing normal things. Scaled content abuse, the site reputation policy, and expired domain abuse. None of them require bad intent. Each one describes a pattern that a well-meaning marketing team can drift into over a year or two.

Google defines scaled content abuse as when "many pages are generated for the primary purpose of manipulating search rankings and not helping users," and adds that this applies "no matter how it's created." That last clause is the one people miss. A human writing three hundred thin location pages is in the same bucket as a script doing it.

The site reputation policy covers third-party content published on a host site "mainly because of that host's already-established ranking signals." If you sold a section of your domain to a partner, or you host a guest-post program that exists to rank, that is the policy in question. We went deeper on this in our piece on the site reputation policy.

Expired domain abuse applies when an "expired domain name is purchased and repurposed primarily to manipulate search rankings by hosting content that provides little to no value to users." Companies do buy expired domains during acquisitions and redirect them. The test is what you put on it and why.

Is a Spam Update the Same Thing as a Manual Action?

No. A spam update is algorithmic and silent. A manual action is a human decision at Google and shows up as a message in Search Console. If your Manual Actions report is clean, no person at Google has reviewed and penalised your site, whatever your traffic chart looks like.

Google's own wording is that it detects violations "both through automated systems and, as needed, human review that can result in a manual action." Two paths, two experiences. The algorithmic path gives you no notification and no reconsideration request to file.

This matters because the fixes differ. A manual action has a defined process and a reply from Google at the end. An algorithmic demotion has neither. You change the underlying pattern and wait for the systems to re-evaluate, with no confirmation that anyone noticed.

What Should You Actually Change if Your Traffic Dropped?

Change the pattern, not the page elements. Google's guidance is direct about this. It tells site owners to "avoid doing 'quick fix' changes (like removing some page element because you heard it was bad for SEO)." Deleting a meta tag will not fix a scaled content problem.

In our work the useful move is almost always subtraction. If a site has four hundred near-identical pages and forty that earn links and conversions, the answer is rarely to improve all four hundred. It is to keep the forty, merge what can merge, and remove the rest. We laid out that process in our guide to pruning old blog posts.

Second, look at who wrote the pages and why. If a page exists because a keyword tool said the term had volume, and nobody at your company would send it to a prospect, that is your answer. That test is cruder than any audit tool and it is right more often.

Third, resist the urge to do all of this in one week. A single large change makes the next measurement useless. We prefer one clear change, then a wait, then a read.

How Long Until You See Recovery?

Longer than anyone wants. Google's own ranking updates guidance says "some changes can take effect in a few days, but it could take several months for our systems to learn and confirm that the site as a whole is now producing helpful, reliable, people-first content." Plan for months, not weeks.

The same page adds that if improvements have not shown results after several months, you may need to wait for the next core update. Given that Google ran core updates in March and May of 2026, the gap between them can be long. That is the real cost of a demotion.

Google is also plain that outcomes are not promised. Its wording is that "there's no guarantee that changes you make to your website will result in noticeable impact in search results." We repeat that line to clients because it sets honest expectations before anyone commits a quarter to a cleanup.

Does AI Search Visibility Move With a Spam Update?

We do not know, and we will not pretend otherwise. Google's guidance page on ranking updates discusses Search results and does not break out AI Overviews or AI Mode citations. Any claim that a spam update specifically changes who gets cited in AI answers is unconfirmed speculation today.

What we do is measure both separately. Classic clicks and impressions in Search Console, and AI answer citations tracked by hand across ChatGPT, Perplexity, Claude, and Google's AI surfaces for a fixed set of prompts. When the two move together, that is a signal. When they do not, that is a more interesting signal.

Our working view is that the same underlying quality patterns matter in both places, because thin duplicated pages are a weak citation target for any system. But a view is not a measurement, and we label it that way.

What Will We Be Watching Over the Next Few Weeks?

Three things. The completion time Google posts for the September 2026 spam update on its status dashboard. Whether any client folder shows a sustained change that survives the rollout. And whether anything lands in a Manual Actions report, which changes the response entirely.

Everything else can wait. The sites that come out of these updates well are the ones that were already built around pages a human would send to a prospect, and that keep a clean technical base underneath.

If your traffic moved this week and you are not sure whether it is real, we are happy to look at the data with you before anyone starts rewriting. You can find us at phoenix.studio. Let's talk.