September 2026 Spam Update Is Complete: A Step-by-Step Guide to Understanding Traffic Drops and What to Do About Them

On October 8, 2026, Google closed out the September 2026 Spam Update — the fourth spam update of the year and the longest of them. A second line appeared on the Search Status Dashboard: "The rollout was complete as of October 8, 2026." From the September 24 launch to the finish, it ran 13 days and 16 hours — no other spam update in 2026 lasted more than about three days.

While the update was rolling, there was only one sensible thing to say: don't break anything, and wait. Now the rollout window is shut. Add the roughly one-week settle period Google recommends, and mid-October is the first clean stretch of data you can read without the waves overlapping. So this isn't a rehash of the news. It's a working manual for site owners: how to read your drop by its symptoms, figure out which losses have nothing to do with the update at all, and decide what to do with a site — or a whole network — next.

What's actually confirmed

The official part fits in a few lines, and it matters to keep it separate from the interpretations already circulating.

• Start — September 24, 2026, 09:15 Pacific (16:15 UTC). Global, all languages and all regions from day one, with no English-first pilot.
• End — October 8. The rollout used almost the full "up to two weeks" allowance: 13 days, 16 hours.
• No targets named. Not a single policy, not one site type. It was not a link spam update — Google specifically noted it wasn't targeting link spam.
• No new named rule. Google described it as a normal spam update and said it would run periodic refreshes.
• No explanation for the length. The most anyone got was a shrug: yes, likely longer than the earlier ones.

Hence the key caveat. Everything you read about "the anti-AI-content update" or "the anti-PBN update," including the popular six-policy list (expired domain abuse, scaled content abuse, site reputation abuse, doorway abuse, back button hijacking, and fake reviews), is interpretation. Those policies are always in force; they weren't declared as the aims of this particular release. Google's spam systems apply the whole set continuously. The only open question is which part got tuned this time — and Google didn't say.

Why this update matters more than any single one before it

The dry 2026 timeline:

• March 2026 — started March 24, rolled out in ~19.5 hours, then a 92-day gap.
• June 2026 — started June 24, ~2 days, then 55 days.
• August 2026 — started August 18, ~3 days, then 37 days.
• September 2026 — started September 24, rolled out in 13 days 16 hours.

First to fourth: exactly six months. For comparison, all of 2025 had a single spam update (August), and it took nearly 27 days. By spam-update density, 2026 is the busiest year since at least 2021, and each gap has been shorter than the last: 92 → 55 → 37 days.

Now the counterintuitive part: a two-week rollout is not the anomaly. The fast 2026 updates were. The dashboard history is full of long spam rollouts — October 2023 at about 15 days, March 2024 at nearly 15, the December 2022 link spam update at about 19, August 2025 at nearly 27. A long rollout is closer to the historical norm for spam updates, one Google returned to after three short iterations in a row.

First takeaway: short and long spam updates look like different kinds of event, and you should treat them differently. A short one is a threshold tweak run against an index that's already built. A long one, like September's, usually means the system has to go back over sites from scratch.

Why 14 days and two waves

There's no official explanation, so from here fact and interpretation are kept clearly apart.

What's known. The short 2026 updates closed in hours or a couple of days. The most instructive long precedent is March 2024: that's when Google folded scaled content abuse, expired domain abuse, and site reputation abuse into its spam policies, and that rollout ran nearly 15 days. In the past, a long rollout coincided with new signals appearing, not with old ones being nudged.

How to read it. A fast update is explainable this way: you change the thresholds on an already-trained system and run it over a ready index — push the button, and by evening everything has shifted. A long one usually means the system has to re-crawl sites, re-score templates, and recompute domain-level signals. That can't be done overnight, and it isn't done evenly — hence the waves: one group of sites feels it first, another a few days later. There's no direct confirmation of this, but it fits the observed picture best.

And here's what was observed. The first wave landed September 25–27: many owners logged sharp drops across several verticals and countries at once. Then a brief lull — and on September 30 it heated up again. The second wave hit Discover and Google News particularly hard: some publishers reported their traffic from those surfaces vanishing again, with Discover behaving erratically that day — fine for half the day, then almost nothing.

A caveat on Discover. Scary figures like −70% are floating around, but complaints about Discover collapsing and ad revenue dropping were on the forums before the update even started. From the outside you cannot separate the update's effect from the volatility that preceded it, so don't take "Discover −70% because of the update" as a conclusion — those are isolated posts. What matters is the fact that the second wave reached Discover and News at all: spam signals travel to those surfaces too. For anyone living on Discover traffic from news networks, that's a distinct risk you can't wave off as the algorithm just being moody.

Now the SERPs overall. The volatility trackers that sample thousands of US queries daily ran red during the update: a calm day for that kind of tracker is around 70 "degrees," and in the peak of late September readings pushed past 180 — the highest in their visible history and well above the previous (August) update's peak. One detail worth noting: in the average SERP temperature there's no pause between the waves — it climbed almost every day. The waves show up at the level of individual sites and specific surfaces, not in the market-wide average. That's another point in favor of the staged-reassessment theory: different groups of sites take the hit on different days while the whole SERP churns throughout.

And an important technical caveat about trackers. In mid-September Google tightened the screws on scrapers, and some services admitted to data-collection problems; a couple of trackers also recalculated their own formulas, so comparing their readings before and after is invalid. The simple conclusion: volatility trackers show the market's weather, not your site. Decisions get made from Search Console and server logs, not from someone else's "sensor."

Risk map: who got hit

Google named no targets, but the rollout observations plus the text of the policies themselves form a clear enough picture. Here's how it maps onto the typical stack of someone who earns from websites.

Mass generation and programmatic. The most recognizable pattern of the rollout was templated pages generated for every query variant: "one page per phone number / area code" in lead gen; "[brand] no-deposit bonus," "[brand] mirror," "[brand] casino [city]" across dozens of language versions in gambling. Alongside that, observers described an "up the mountain, down the mountain" pattern — sites that soar on generated content, then fall off that same peak. The rule of thumb is simple: if even a large AI project built on generation can't hold its positions through the volatility, a network review site certainly won't.

Networks. The scaled-content-abuse text has a clause many people skip: creating multiple sites to hide the scaled nature of the content is treated by Google as an aggravating factor, not a defense. Spreading your generation across twenty domains works against you. A shared template, shared hosting, identical author blocks, the same review structure — that's a footprint by which the whole network reads as a single site.

Expired domains. Expired domain abuse is a policy where the hit almost always lands on the whole domain, not a section. And the canonical example in the spam policies is practically about this audience: casino content on the domain of a former school. If your network includes sites on expired domains with unrelated histories, those are the first candidates to drop — and reviving them costs more than replacing them.

PBN. The update wasn't declared as link spam, and a PBN as a link source doesn't look like a direct target. But there's a subtlety: if your PBN sites themselves live on expired domains with generated content, they fall under the two points above — as sites, not as links. The network loses its index, and the links lose their value on their own. Keep the official wording in mind: the effect of spammy links that the system has already discounted can't be restored. What that means for your link strategy after the update is below, and in more depth in the PBN guide and the backlink strategy breakdown.

Doorways and back-button hijacking. Back button hijacking is a newer policy; enforcement began earlier in the year, and September's update is already the third spam update since. For doorways whose monetization rests on intercepting the back button and on push/pop networks, there's an unpleasant detail: Google explicitly says the interception may come from an included library or an ad platform, but removing it is still the site owner's responsibility. "It wasn't me, it's the network's script" doesn't hold up.

Parasite SEO. Here the picture is different. By the policy text, site reputation abuse is about manual review rather than an algorithm. In some jurisdictions the manual sanction under this policy is applied differently, with the section simply decoupled from the host domain's trust. The main risk of parasite SEO isn't the algorithm — it's a human with a button: a telling case saw spammers flood the index with thousands of public pages from one AI service, and the next day Google simply wiped the whole catalog from results by hand, no update involved.

Who grew instead. For completeness: large platforms that scale AI translations across dozens of languages were, in places, rising again after the update — exactly the kind of thing scaled content abuse lists as a technique. The cynical but honest takeaway: the policies apply to everyone; enforcement doesn't. A 30-language network shouldn't count on the leniency a giant platform gets.

The October 1 guidance edits: the human is back in the cost sheet

Mid-rollout, on October 1, Google quietly updated two documents — and for a site owner that matters more than the volatility itself.

First — the guide on using generative AI on your site. The accuracy section used to amount to a generic "focus on quality." Now it says plainly: generative models don't retrieve facts, they predict a likely sequence of words, so answers can contain inaccuracies (hallucinations), and all AI content must be manually checked and proofread for accuracy before publishing. It adds specifically that this review extends to metadata — titles, meta descriptions, structured data, and image alt text. Google explained the edit simply: the documentation was synced with the quality raters' guidelines.

Second — the helpful-content guide. It gained a section on a page's main content and four criteria raters are taught to judge it by: effort, originality, talent or skill, accuracy. The important one is the definition of effort: auto-generating pages from feeds, or producing large volumes of text with AI without manual oversight or curation, counts as "little to no effort." And, separately: citing sources does not substitute for your own effort. So a rewrite stamped "according to such-and-such aggregator" is no longer an argument.

And a second addition that lands straight on the review-site template: invented author profiles — generated avatars, made-up names, fake credentials to make content look expert-written — are now explicitly labeled deceptive by Google. And any deception, by its own wording, makes a page untrustworthy for both people and automated quality systems. Recognize the "expert with 10 years of experience" sporting a face from a generator who somehow writes on fifteen network sites at once? That's the one.

How to read this without paranoia. Google can't verify whether a human proofread the text, and raters don't affect rankings directly — it says so in the same document. But the rater guidelines are how Google checks whether its systems are working correctly. When a phrase migrates from there into a public guide, it signals that the systems are being trained to spot exactly that. From there it comes down to verifiable markers: wrong wagering terms, nonexistent licenses, mixed-up providers, the same "author" on ten domains. In a user's money, a hallucination isn't a style choice — it's direct harm, which is precisely the zone where Google demands heightened accuracy.

The practical upshot: author setup and author schema have gone from a "snippet checkbox" to a risk area. How to do it so you don't meet the definition of deception — real authors, correct markup, honest bios — is covered in the piece on author pen-names and author schema without penalties.

Did Google tie these edits to the spam update? No, there's no official link; the date coincidence was spotted by outside observers. But the vector is the same, and it isn't "no AI" — at the top of that same document Google states outright that generative AI is useful for research and structure. It's "no scale without a human."

The diagnosis playbook: why your traffic dropped

This is the core. The update finished on October 8, the waves no longer overlap, and for the first time you can investigate honestly. The logic mirrors what Google recommends for core updates: wait for the rollout to finish, give it another week, and only then analyze Search Console. For September's update, that window opens right about mid-October.

Step 0. Pick the right comparison windows

Don't compare "now" against the middle of the rollout — that's all mixed together. Take two clean windows: 7 days before the start (Sept 17–23) against 7 days after completion (from Oct 9 onward). Export by page, query, country, and search type. Export Discover and Google News separately if you have them — they're different surfaces with different rules, and you can't blend them with web.

Step 1. Identify the shape of the drop

The shape of the fall points almost unambiguously to the cause. This is the main diagnostic move.

Step 2. Separate web from Discover

The most common mistake is treating everything as a "search drop." If ordinary web traffic is steady but Discover collapsed (especially if it coincided with September 30), that's a separate problem, and it's fixed by Discover's requirements, not by mass-reworking content for spam policies. Get the diagnosis wrong and you'll spend weeks treating the wrong illness.

Step 3. Compare your network sites against each other

If you run a network rather than one site, the network is itself a ready-made controlled experiment. Build a matrix: which site is on an expired domain, which on a fresh one, where there's unedited generation, where fake authors, where back-button scripts, where parasite placements. Then overlay the drops:

• All sites with a shared template, author block, or host dropped → you have a footprint, and Google reads the network as one object.
• Only expired domains dropped → it's an expired-domain answer.
• Only auto-translated language versions dropped → scaled content abuse via translation.
• One site out of twenty dropped, all else equal → look for what's unique about it.

This table beats any third-party tracker: it compares your own sites against each other under identical conditions.

Step 4. Run your content against Google's new criteria

After the October 1 edits there are verifiable markers. Go through your money pages:

• Fact-check. Wagering, licenses, providers, limits, bonus terms — all must be correct. An error here is now read as untrustworthiness.
• Metadata. Titles, descriptions, structured markup, alt text are also subject to manual review — not just the article body.
• Authors. Real people or generated profiles? That's now a direct marker of deception. (See how to set up authors and schema without penalties.)
• Ratings and reviews. Fake and undisclosed incentivized reviews in review-snippet markup are prohibited.

Step 5. Rule out the technical stuff

This is the most-skipped step, and it cuts false alarms. Some of the drops blamed on the update are really indexing, redirects, canonicals, and server errors. Walk through Google's own "Debugging drops in Google Search traffic" guide: check index coverage, response codes, redirects, robots, and any fall in Googlebot crawl frequency. A crawl drop by template or by site often shows up in logs before positions fall — which is why you should save and review your server logs for the update period.

Step 6. Decide each site's fate: fix or bury

On scaled content, Google says it plainly: if you have it, remove it from Search. Recovery after a spam update is measured in months. So the decision is purely economic: if the repair takes longer to pay back than the gap to the next update (which in 2026 shrank to ~37 days), it's simpler to replace the site than fix it. Expired domains under expired domain abuse are almost always in the "bury" column: that's an asset that burns down whole and all at once.

What to do about links after the update

Links deserve their own note, because panic does the most self-inflicted damage here.

This wasn't a link spam update, so mass link moves are contraindicated right now. Don't buy links "to pull it back up," and don't rush into mass disavow: in a panic, disavow cuts the living more often than the spammy, and the link effect the system has already discounted won't come back anyway. If your PBN dropped, in most cases it isn't that "the links stopped working" — it's that the donor sites themselves got caught by scaled content or expired domain abuse as sites, and then it's the donors you fix, not the recipient's link profile. How to rebuild a donor network and a link strategy for a frequent-update regime is in the PBN guide and the backlink strategy breakdown.

Refreshes and recovery: what comes next

Two things that are easy to miss.

First, Google said it would run periodic refreshes of the spam update. So the story didn't close on October 8: a site that got away with it may catch its drop on the next refresh, and a fixed one may only be reassessed then. Don't plan on being left alone until the next big update.

Second, recovery timelines. Google itself measures them in months, not days. That means sudden moves in hope of an instant bounce almost never pay off. The right sequence is: diagnose → make targeted fixes against the identified cause → wait patiently for a refresh or the next update, rather than poking the site daily.

Network economics at four updates a year

The most dangerous thing about 2026 isn't the force of any single update — it's the frequency. And that changes the arithmetic of any network.

Survival rate. Say each update knocks out a fraction p of a network's sites. The share surviving a year is (1 − p) to the power of the number of updates. At one update a year, a 20-site network at 20% risk loses 4 sites. At four updates, as in 2026, 8 of 20 remain. Same risk per update — and you've lost 12 of 20. At 30% risk, 5 of 20 remain. Frequency hits harder than force.

Payback vs. the gap. The 2026 gaps shrank like this: 92 → 55 → 37 days. If an organic site breaks even in 4–6 months, it has to survive 2–4 updates to get there. At 20% risk per update, that's roughly a 64% down to 41% chance of making it. The expected return on a new site is nearly halved before it earns a cent.

The human is back in the cost sheet. For two years, generation-based networks ran on "content is nearly free, the money goes to domains, hosting, and links." The October 1 edit flips that: if Google's norm is manual fact-checking of all AI content, an editor re-enters the cost of every page. Even 15–20 minutes of proofing per page raises content cost several-fold, sometimes by an order of magnitude. Scale stops being free — and so stops being the main lever.

Even survivors lose clicks. AI Overviews increasingly show above branded queries, including commercial ones. For an affiliate that means surviving the update and keeping the position isn't a traffic guarantee: an AI answer on top still eats CTR.

What follows for the model, in short — an antifragile network instead of a cheap one:

• Fewer sites, each stronger. Five that survive updates beat twenty that dwindle to eight by December.
• Drop expired domain abuse. An expired domain with someone else's history is the one asset that burns down whole and instantly.
• Diversify footprints, not just domains. Different templates, hosts, real authors.
• Manual work on money pages. Reviews, bonuses, terms tables — with fact-checking. Keep generation for research, structure, and drafts — exactly where Google permits it.
• Diversify by traffic source, not by geo. The update was global and all-language from day one; 30 language versions of one network don't hide from it.
• Losses as a budget line. Build attrition on each update into the model as a recurring cost, not a force majeure.

Bottom line: what changed and what to do this week

Formally, nothing new: same rules, no named targets, no separate policy. In practice, three things changed.

First — frequency became the governing parameter. Four updates in six months, the gap down from 92 to 37 days. You can no longer run a network on "we'll slip through between updates": there's now less time between them than a site needs to pay back.

Second — the long rollout is back. Two weeks and at least two waves mean the early days say nothing about the outcome: whoever celebrated on September 26 could have caught their wave on the 30th. And with refreshes promised, the story doesn't close after October 8 either.

Third — the human is back in the cost sheet. Manual fact-checking of AI content, the effort criterion, and the ban on invented authors moved into public guides on October 1. Generation stays a tool, but scale without editing is now officially "little to no effort."

What to do right now, step by step:

1. Pull two clean windows in Search Console: Sept 17–23 vs. the period from Oct 9.
2. Identify the shape of the drop using the symptom table above.
3. Separate web from Discover.
4. Compare your network sites against each other and find the footprint.
5. Run money pages against the new criteria: fact-check, metadata, authors, reviews.
6. Rule out the technical stuff with Google's debugging guide, and review your logs.
7. For each site, decide: fix or replace — based on whether the repair pays back before the next update.

A network used to be a bet that Google wouldn't notice. Now it's a bet that Google won't have time. And it's finding the time roughly every 37 days — with refreshes in between.