Google September 2026 Spam Update: What Small Business Sites Should Check

Google released the September 2026 spam update on September 24. It applies globally, across every language, and Google says the rollout may take up to two weeks. If you run a local service site, a storefront site, or a thin marketing site that grew through blog posts and city pages, start with diagnosis this week.

This is the fourth confirmed spam update of 2026 on Google’s Search Status Dashboard. The earlier ones in March, June, and August finished in roughly a day to under three days. A longer window changes how you read the charts: rankings will keep moving while the rollout is open, so daily dips are a weak reason to rewrite your homepage.

What Google actually confirmed

Primary source: Google’s Search Status Dashboard lists “September 2026 spam update” starting 24 Sep 2026. Google Search Central also posted that the update applies to all languages and locations and that the ranking release history page will be updated when the rollout completes. Search Engine Roundtable summarized the same announcement the same day.

Google has not published a target list for this update. It has not said which spam tactics were improved, which verticals move most, or what share of searches is affected. Treat claims of a secret target as speculation.

Google’s standing spam policies for Google web search are still the checklist. Spam updates improve the automated systems that enforce those policies. SpamBrain is one of the systems Google names when it talks about spam detection improvements.

Rule these out before you blame the update

Google’s own traffic-drop guidance separates causes. Work this order before you assume the spam update hit you:

1. Technical and indexing. Check Page indexing and Crawl stats in Search Console. A spam update does not invent crawl errors, blocked robots.txt rules, or accidental noindex tags.
2. Manual actions and security. Open Manual actions and Security issues. An algorithmic spam update does not leave a manual-action notice. A hacked site or a manual action is a different problem with a clearer fix path.
3. Seasonality and demand. Compare the same dates last year. Many service businesses have quiet weeks that look like an update if you only look at the last 14 days.
4. Snippet-level click loss. If impressions hold and clicks fall, titles and snippets may be losing the click to other results. That is not the same as a site-wide spam demotion.

Only after those look clean should you treat a wide drop after September 24 as a possible spam-update effect. And even then, wait for the dashboard to mark the rollout complete before you call the result final.

The three checks that matter most for SMB sites

Google’s spam policies page lists many practices. For typical US small business sites, these three are worth an afternoon:

1. Scaled content abuse

Google defines this as generating many pages primarily to manipulate rankings rather than help users, however the pages were made. Examples include mass AI pages with little added value, scraped or lightly rewritten feeds, and near-identical pages spun across sites.

On a service business site, this often looks like:

• Twenty “service in [city]” pages that only swap the city name
• A blog that published dozens of generic posts in a short window with no original process, photos, or answers
• Location pages that funnel everyone to the same contact form and never answer a local question

Fix clear duds. Merge pages that say the same thing. Improve the ones that still earn impressions. Do not mass-delete mid-rollout because one chart wobbled for three days.

2. Doorway-style city pages

Doorway abuse covers pages built mainly to rank for similar queries and push people toward a thin intermediate page. Multiple near-identical city domains or city pages that exist only to catch search traffic fit that pattern.

If your site has a real service area, keep the pages that add real local detail: neighborhoods you serve, licensing notes, photos of jobs, hours, and FAQs locals actually ask. Cut the shells.

3. Hacked content and user-generated spam

Google calls out hacked pages and spam left in comments, forums, and open upload areas. Owners often miss these because the homepage still looks fine.

Search site:yourdomain.com and scan for pages you did not publish (pharmacy, casino, foreign-language spam, odd PDFs). Check comment threads. Open Security issues in Search Console. Clean those before you rewrite marketing copy.

Does this update punish AI-written pages?

Google has not said that AI content is the target of the September 2026 spam update. Google’s generative AI guidance also does not treat AI assistance as spam by itself.

What the spam policies do call out is scaled content abuse: many pages made mainly to manipulate rankings, including pages made with generative AI tools when little value is added for users. The useful question for an owner is not “Did a model draft this?” It is “Would a real customer learn something specific here?”

Accuracy still matters in titles, meta descriptions, structured data, and alt text. If those fields were auto-filled with wrong services or cities, fix them now. That is maintenance, not a redesign.

When to measure, and what not to do this week

While the rollout is open, treat ranking charts as weather, not a verdict. Google says recovery after spam issues can take months as automated systems relearn that a site complies. A rewrite shipped on day two of a two-week rollout will not prove itself inside the rollout.

Do this week:

• Note September 24 in your reporting
• Confirm Manual actions and Security issues are clear
• Spot-check for hacked or spam pages
• Flag templated city pages and thin AI blog batches for a focused cleanup
• Hold big site-wide rewrites until the dashboard shows the update complete, then compare equal windows before and after

Skip this week:

• Buying a bundle of “recovery links”
• Republishing the same thin posts under new URLs
• Nuking ranking pages because position 3 became position 7 for two days

If Search Console shows a real slide

If Search Console shows a real, site-wide slide after you rule out technical and security issues, start with the pages that look most templated or least useful. Clean those first. Keep the pages that answer a real buyer question with specifics only you can provide.

If you want a second set of eyes on structure, indexing, and whether your service pages are helping people or just filling a sitemap, IntuiCo’s SEO services page outlines how we approach that work. For related reading on how local search surfaces are changing, see our note on Google local knowledge panels testing AI Overviews.

Sources: Google Search Status Dashboard, Google spam policies, Search Engine Roundtable on the September 2026 spam update.