Google Spam Update: Dates and a 28-Day Read-Out Sheet

The September 2026 spam update ran September 24 to October 8, 2026 (13 days 16 hours). That is about 2.5 times as long as the three earlier 2026 spam updates combined (132.5 hours). A spam update is a change to Google's automated systems that detect content and behavior breaking its spam policies.

Google's dashboard lists the September update as applying globally and to all languages, and says the rollout "may take up to two weeks to complete." These are the spam updates it lists since August 2025:

Lengths come from Google's Search Status Dashboard history. Two figures are our own arithmetic from those dashboard times:

• The three earlier 2026 updates add up to 132.5 hours (19.5 + 49 + 64). September's 328 hours (13 × 24 + 16) divided by 132.5 gives about 2.5.
• The 2026 updates started 92, 55 and 37 days apart (March 24 to June 24 to August 18 to September 24). The gaps are shrinking.

Our inference is that you cannot count on a quiet month before the next update. A 28-day baseline plus a 28-day after window may not fit between two updates, so write down your windows as soon as an update is announced.

Site owners reported traffic swings on September 25 to 27 and September 30, and again on October 4 to 6. These are anecdotal reports, not Google data. Do not pick one day as "the day it hit."

Compare two 28-day windows, one before the rollout and one after it ends, page by page. Call the change an effect only if it falls outside your normal week-to-week range. Google Search Console is Google's free report on how your site performs in Search. Use it for every step below.

The Read-Out Sheet

A traffic decline that overlaps an update is a reason to investigate, not a diagnosis. We would not label a 20% change, or any single percentage, as an update effect without checking the affected URLs, queries, markets, and channels.

A sitewide decline, a single directory decline, and a loss confined to a few pages are different problems, and each calls for a different first move. Sort the losses from your Read-Out Sheet into one of these rows before you touch any content.

Three Search Console checks recur in the table. A manual action is a penalty applied by a human reviewer at Google. A security issue is hacking or malware that Google flags. Indexing is whether Google has stored the page so it can appear in results.

For a group of pages you suspect, group the URLs by template, publishing method, topic, country, and device. Then check indexing, security issues, and manual actions before making broad changes. Our content refresh triage table is a way to decide which affected pages to improve, merge or leave alone.

Using AI to write is not itself a violation, but as of October 1, 2026 Google's guidance on using generative AI content says to manually fact-check and review all AI-generated content, including titles, meta descriptions, structured data and image alt text, before publishing. Pages made at scale without adding value are a violation.

Google's spam policies define spam as "techniques used to deceive users or manipulate our Search systems into featuring content prominently." That definition includes "attempting to manipulate generative AI responses in Google Search."

As of October 2026 the policies name 16 practices:

• cloaking, doorway abuse, expired domain abuse, and hacked content
• hidden text and links, keyword stuffing, and link spam
• machine-generated traffic, malicious practices, and misleading functionality
• scaled content abuse, scraping, and site reputation abuse
• sneaky redirects, thin affiliation, and user-generated spam

Google added back button hijacking to its malicious practices policy on April 13, 2026. Google's automated detection, which includes a system called SpamBrain, handles most enforcement. Human review issues manual actions where needed.

Scaled content abuse is the pattern that matters most for content teams. It means producing many pages mainly to manipulate rankings instead of helping users. The production method is not the deciding factor. Human-written, AI-assisted, and automated pages can all be acceptable or problematic depending on whether they add distinct value.

Repetitive location pages, lightly altered query variants, and stitched source material deserve closer review than content simply because it used AI assistance. For each page in a suspect group, ask three questions: does it hold original evidence, does it have a clear purpose, and does it still help the reader after the query match?

Add one line to your pre-publish gate. It passes when a named person has checked every claim, number, title, meta description, structured data field and image alt text against a primary source before publishing. It fails if any of those is unchecked. Our pre-publish gate for AI-generated content holds the rest of the checks.

As of October 14, 2026, rule out technical and manual causes, hold content changes and keep a change log. Draw conclusions only once the 28-day after window has closed, because a rollout this long and uneven makes early reads unreliable.

While the window is open

• Open the manual actions and security issues reports in Search Console, and check page indexing. Any problem there outranks every content theory.
• Freeze template and navigation changes where you can. Every change you ship during the windows muddies the comparison.
• Record the date, the URLs and the reason for each edit in your change log.

When the window closes

• Run the range test on each page group and apply the table above.
• Improve, consolidate, redirect, or remove pages only where the evidence supports it.
• Wait for enough data to evaluate each change, and avoid promising fast recovery. Google says changes may help a site improve if its automated systems learn over a period of months that the site complies with its spam policies.

Track the same pages in AI answers on the same windows, because Google clicks and AI citations can move separately. A page can lose Google traffic and stay cited, or keep its rankings and drop out of answers. Google's spam policy covers manipulation of generative AI responses, so the pages you clean up for Search matter there too.

At PageLens.ai we put both measurements on one page list. Our Analytics feature pulls clicks, impressions and average position from Search Console through one connection, with no tracking tag. It shows them beside the citations each page earns from ChatGPT, Perplexity and other engines, on 28-day rolling windows. Those windows match the Read-Out Sheet.

We track prompts, the questions a buyer would ask, on a fixed schedule:

• On Launch ($299 a month, or about 8% less when billed annually, as of October 2026) that means 100 tracked prompts weekly and 300 AI answers a week, across ChatGPT, Google AI Mode and Perplexity.
• Growth runs daily and adds Gemini and Grok.

AI answers change from run to run, so judge a page by repeated runs over a window, not one answer. Our AI citation tracking standard sets out how many runs we use. For a quick look at how ChatGPT, Gemini and Perplexity describe your brand before you set up page-level tracking, run our free AI Visibility Audit.

If you want your before-and-after windows and citation tracking set up for your own pages, Book a demo.