Google's September Spam Update Is Taking Two Weeks: What to Do While It Rolls

Google began rolling out its September 2026 spam update on 24 September at 9:15 a.m. Pacific time, applying globally and in all languages, and said the rollout "may take up to two weeks to complete". That last clause is the only genuinely new information in the announcement, and it is the part worth planning around.

Every other spam update Google has announced this year finished quickly. March took 19 hours and 30 minutes. June took two days and one hour. August took two days and 16 hours. A fortnight is a different kind of event — not necessarily a bigger one, but one that changes how you are allowed to read your own analytics for the next two weeks.

What Google said, and what it did not

Google described this as a spam update rather than a policy change. No new spam policies accompanied it, and the company has not said what the update targets. Its stated advice for sites that see movement is to review the search spam policies, and it notes that where changes are made, its automated systems may take months to learn that a site now complies.

So there is no new rule to comply with. There is an improvement to the systems that enforce rules which already existed. The list of those policies is public and short enough to read in a sitting:

• Cloaking, sneaky redirects, doorway abuse and hidden text or link abuse — the classic deception patterns.
• Scaled content abuse: "many pages generated for the primary purpose of manipulating search rankings and not helping users".
• Site reputation policy: third-party content published on a host site mainly because of that host's already-established ranking signals.
• Expired domain abuse, scraping, thin affiliation, link spam, keyword stuffing, user-generated spam, hacked content, machine-generated traffic, misleading functionality and malicious practices.

Two of those deserve a second look in 2026, because they are the two most easily triggered by a well-intentioned content programme rather than by a bad actor. Scaled content abuse does not require a spam farm; it requires volume produced for rankings rather than readers. The site reputation policy does not require a hacked subfolder; it covers the sponsored-content deal your commercial team signed last quarter.

Why the length changes your reporting, not your strategy

A two-week rollout means that for two weeks, any traffic change you observe has at least two plausible causes and no clean way to separate them. A drop on day three may be the update arriving. It may also be the update having not yet arrived, and something else entirely moving your numbers. Neither reading can be confirmed until the rollout is called complete.

The practical consequence is that this is the worst fortnight of the quarter in which to ship a large site change. If you deploy a template rewrite, a URL migration or a bulk metadata pass during the rollout, you will not be able to attribute the result of either the deployment or the update. Where a release can wait, let it wait. Where it cannot, record the deployment date prominently in whatever document your next performance review reads from.

What to check now

The useful work during a rollout is the work that is worth doing regardless of the outcome. Four checks qualify.

1. Inventory what was published at volume

List every page published in the last 12 months in batches of more than about 20 at a time: programmatic location pages, product-variant pages, glossary entries, AI-assisted drafts. For each batch, answer one question in writing — what does a reader get here that they could not get from one better page? If the answer is thin, that batch is what scaled content abuse describes, whether or not a model wrote it.

2. Audit third-party content on your domain

Guest posts, sponsored sections, partner microsites, coupon subfolders and any subdomain a third party controls. The site reputation policy is about why content sits on your domain rather than its own. If the honest answer is "because our domain ranks and theirs does not", it is in scope.

3. Separate AI assistance from AI volume

Google's position has been consistent: how content is produced is not the issue, and scale produced for rankings is. A team using a model to draft faster is not in the policy's sights. A team using one to publish 400 pages a month is, and the difference is visible in the output. This is the same distinction that governs whether your work earns citations in AI answers, which we covered in our guide to generative engine optimization.

4. Fix your measurement baseline before you need it

Note today's organic sessions, impressions and clicks by template, not just site-wide, and keep the note. A site-wide figure cannot tell you that one directory lost half its traffic while the rest held. Search Console's own reporting has already become harder to read where AI surfaces are involved, which we wrote about when its AI Overviews report arrived.

If your traffic falls

Google's stated recovery path is slow by design: make the site comply, then wait for automated systems to learn that it does. Its own wording is that this may take months. That rules out the tactic most teams reach for first, which is to change something visible and look again on Monday.

1. Confirm the timing against the rollout dates rather than against a feeling. Match the drop to a date, and check whether Google has declared the rollout finished.
2. Segment before you diagnose. Which templates, which countries, which query types. A spam update that hits one content type looks like a site-wide problem in a site-wide chart.
3. Read the policies against the pages that actually lost, not against your best pages.
4. Remove or consolidate rather than rewrite, where a page exists for a query and not for a reader. Fewer, better pages is the only remedy the policy language actually points at.
5. Write down what you changed and when. The recovery signal arrives months later, and by then nobody remembers which of the four changes was live first.

The part that does not change

Spam updates are enforcement, not strategy. They move the floor, not the ceiling: they can remove competitors who were ranking on mechanics, and they can remove you for the same reason, but they do not reward anything new. Nothing in this update creates an opportunity that did not exist on 23 September.

Which is why the honest answer to "what should we do about the spam update" is usually "read the policies, check the two clauses that catch good-faith publishers, and keep the release calendar clear for a fortnight". If that sounds unambitious, it is worth remembering that the alternative — reacting to three days of noise inside a two-week rollout — is how sites acquire changes nobody can justify six months later.