Summary
Google’s September 2026 spam update started on 24 September and finished on 8 October, a rollout of about 13 days and 16 hours. It was a “normal” spam update, which means it targets sites that break Google’s spam policies, not sites that are simply average. For online stores, the usual culprits are mass-produced product or category pages, thin affiliate pages, copied manufacturer text, hacked pages and spam in reviews or comments. There is no reconsideration request for an algorithmic spam update, so the only route back is to fix the problems and wait. This guide shows you how to confirm whether you were hit, what to fix first, and what a realistic recovery looks like.
Introduction
If your store’s organic traffic slid at the end of September or the start of October, you are probably wondering whether Google just penalized you. The short answer: it might have, but you should not guess. Spam updates and core updates look similar in a traffic chart, yet they need very different fixes.
Our main guide, Google Algorithm Updates: What Changed From 2018 to 2026, walks through the full history. This post goes deeper on one question that guide only touches: what do you do when a spam update is the likely cause? We will cover the September 2026 rollout, how to diagnose it from Search Console in plain steps, which spam policies catch online stores most often, and a recovery plan you can follow without writing a line of code.
Table of Contents
- How is a spam update different from a core update?
- What happened in the September 2026 spam update?
- What did site owners actually see?
- How do you know if your store was hit?
- Which spam policies catch online stores most often?
- How do you recover from a spam update?
- Should you file a reconsideration request?
- Is AI-written product content a spam risk?
- Will a core update follow?
- How can Virtina help?
- People also ask
- Conclusion
- Frequently asked questions
How is a spam update different from a core update?
A spam update is aimed at pages and sites that break Google’s published spam policies. A core update is a broad re-evaluation of how Google judges relevance and quality across the whole web. One punishes specific bad behavior. The other re-ranks everyone.
That difference matters because the fix is different. After a spam update, you look for violations and remove them. After a core update, you improve the overall usefulness of your pages. Mixing the two up is the most common reason stores waste weeks fixing the wrong thing.
| Spam update | Core update | |
|---|---|---|
| What it targets | Pages that break spam policies | Overall relevance and quality |
| Who is usually affected | A smaller group of sites with clear violations | Many sites, with winners and losers |
| Typical 2026 rollout | 19 hours to 13 days | About 12 days |
| What you do | Find and remove violations, then wait | Raise the quality of key pages |
| Appeal option | None for the algorithmic part | None |
Google’s official Search Status Dashboard is where rollout dates are confirmed.
What happened in the September 2026 spam update?
Google began rolling out the September 2026 spam update on 24 September 2026 at about 9:15 a.m. Pacific time and marked it complete on 8 October 2026. Google called it “a normal spam update” that applies globally and to all languages. It did not say how many queries were affected or give details of what it targeted, and it announced no policy changes alongside it.
The length is the unusual part. Google said the rollout could take up to two weeks, and it used almost all of that. Here is how it compares with the other spam updates of 2026:
| 2026 spam update | Started | Rollout length |
|---|---|---|
| March | 24 March | About 19.5 hours |
| June | 24 June | About 2 days |
| August | 18 August | About 2 days 16 hours |
| September | 24 September | About 13 days 16 hours |
Four spam updates in one year is a clear change in pace. Industry trackers count one in 2025 and three in 2024. Two spam updates in back-to-back months, August and September, is the part worth pausing on. It suggests Google is enforcing its spam policies more often, so a quick clean-up once a year is no longer enough.
What did site owners actually see during the rollout?
Most of what we know about the impact comes from third parties, and Google has confirmed none of it. Reports describe uneven drops in three waves and a small overall shift in organic search share. Still, the patterns are useful:
- Uneven timing. Search Engine Roundtable logged noticeable movement on 25 to 27 September, again on 30 September, and again on 4 to 6 October. A long rollout means a store can drop, partly recover, and drop again.
- A small but measurable shift. Analytics firm Diib, looking at 32,569 sites, reported that the median share of visits coming from unpaid Google search fell from 34% to 31% over 24 to 26 September compared with a week earlier. Overall traffic also dipped that week, so treat this as a signal, not proof.
- Rank trackers can mislead. SEOmonitor reported that many rank trackers showed sudden changes from 26 September that real searchers never saw. Real spam-update effects tend to last several days and show up in Search Console.
The takeaway: do not react to a rank tracker alone. Your own Search Console data is the evidence that counts.
How do you know if your store was hit by the spam update?
Compare 24 September to 8 October against the two weeks before, in Google Search Console, and look for a drop that lasts several days in both clicks and impressions. If the drop is concentrated in certain page types, a spam policy problem is far more likely than a general quality issue. Here is the click-by-click version:
Step 1: Set up the comparison
Open Search Console, click Performance in the left menu, then Search results. Click the Date filter, choose Compare, and pick the custom range 24 September to 8 October against the previous period. Make sure Clicks and Impressions are both ticked.
Step 2: Find where the loss sits
Scroll to the table below the chart and click the Pages tab. Sort by the biggest click loss. Ask yourself: are the losers mostly one type of page, such as filtered category URLs, tag pages, blog posts, or a batch of product pages added recently? A cluster is the strongest clue you will get.
Step 3: Check for a manual action
In the left menu, open Security & Manual Actions, then Manual actions. If it says “No issues detected,” your drop is algorithmic. If a message is listed, that is a different process with a reconsideration option. Also check Security issues in the same menu for hacked content.
Step 4: Rule out other causes
Check whether your paid, email, and direct traffic moved too. If everything fell together, the cause may be seasonal demand, a broken tracking tag, or a site change rather than Google. Also ask your team whether a plugin update, theme change, migration, or bulk product import happened in the same window.
If a hack or a bulk import is on that list, the fix is often quicker than you expect. If you cannot find a cause, our WooCommerce SEO guide covers the technical basics worth checking next.
Which spam policies catch online stores most often?
The policies most likely to catch an online store are scaled content abuse, thin affiliation, doorway abuse, scraping, hacked content and user-generated spam. Google publishes a list of spam policies, and several of them describe things that happen by accident on eCommerce sites. Stores rarely set out to spam. They end up in trouble through scale: thousands of pages created by a plugin, a feed, or an AI tool with nobody checking the result. Here is how the main policies tend to show up on a store, and what to do about each. The patterns below are based on what the policies describe and the kinds of problems we look for in store audits, not on a Google statement about this specific update.
| Spam policy | How it shows up on a store | What to do |
|---|---|---|
| Scaled content abuse | Hundreds or thousands of templated or AI-written product, category, or location pages with little unique value | Merge, rewrite, or remove the weakest pages. Keep only pages that offer something specific. |
| Thin affiliation | Affiliate product pages that copy the merchant’s description and add nothing | Add original photos, testing notes, and honest comparisons, or drop the page. |
| Doorway abuse | Near-identical landing pages for every city or keyword variation that lead to the same product list | Consolidate into one strong page per real need. |
| Scraping | Supplier or competitor descriptions published at scale with little change | Rewrite best sellers and top category pages first. |
| Hacked content | Injected pages, hidden links, or odd redirects added through an outdated plugin or weak password | Clean the site, update everything, change credentials, and add monitoring. |
| Sneaky redirects and cloaking | Visitors sent somewhere different from what Google saw, often by a script or compromised plugin | Test pages as a visitor and as Google, then remove the cause. |
| User-generated spam | Fake reviews, spam comments, junk product questions, or bot-created accounts with links | Turn on moderation, add spam filters, and delete the junk. |
| Keyword stuffing and hidden text | Footers or category text crammed with repeated phrases, or text hidden from shoppers | Rewrite in plain language written for the shopper. |
| Back button hijacking | Pop-ups or scripts that stop shoppers from leaving by pressing Back | Remove the script or plugin that causes it. |
One more store-specific trap deserves a mention: filter and sort URLs. A catalog with colour, size, price, and brand filters can generate tens of thousands of near-duplicate pages. They are not spam by intent, but when they flood the index they can look like exactly the low-value, scaled pages the policies describe. Ask your developer or our team to check how many of them are indexable.
How do you recover from a Google spam update?
You recover by removing the violations, replacing them with truly useful pages, and then waiting for Google to reassess your site. Google has said recovery can take months, and a case study published after the August 2026 update described a recovery that took around five months of sustained cleanup. There is no switch to flip and no form to submit.
Here is a working timeline we recommend. It is our own planning guide, not a promise from Google, because the real speed depends on how much needs fixing and when Google next reassesses your site.
| When | What to do | Done when |
|---|---|---|
| Days 1 to 3 | Confirm the drop and the date, check manual actions and security issues, stop any risky tactic | You know if it is spam, core, or something else |
| Weeks 1 to 2 | Audit every page type against the spam policies and label pages keep, improve, merge, or remove | A full list of problem pages exists |
| Weeks 2 to 6 | Remove or merge the weakest pages, fix hacks and redirects, clean up reviews and comments | No policy violations remain |
| Months 2 to 3 | Rewrite top categories and best sellers with original detail, add real photos, buying guides, and expert input | Your key pages are clearly better than competitors’ |
| Months 3 to 6 | Keep publishing carefully, earn real mentions, and track Search Console monthly | Impressions and clicks trend back up |
Fix the biggest page group first
Start with the page type that lost the most clicks in Step 2 above. If 3,000 programmatic city pages account for most of the loss, rewriting your home page will not help. Prioritize by damage, not by what is easiest.
Remove or merge instead of polishing weak pages
A hundred pages that say almost the same thing are better as one great page. Merge them and redirect the old addresses to the new one. Pages with no traffic, no links, and no purpose can usually be removed.
Add what only you can add
The pages that hold up are the ones with something a feed cannot supply: your own photos, sizing advice from real returns, how a product performs after months of use, delivery details, and honest “who this is not for” notes. That is also the content AI search tools prefer to cite. Our article on eCommerce SEO in the age of AI search explains how this builds visibility across both.
Do not undo the work
The case studies on the August update stress that recovery needs ongoing compliance, not a one-time cleanup. If a plugin or feed will regenerate the thin pages next month, switch it off or fix its settings first.
Should you file a reconsideration request?
Only if you have a manual action. An algorithmic spam update has no reconsideration process, so filing one when Search Console shows “No issues detected” will not help. If you do have a manual action, fix the problem first, explain what you changed in plain language, and submit the request from the Manual actions report.
Is AI-written product content a spam risk?
AI-written content is not banned, but publishing it at scale without human review is the risk. Google’s policy is about mass-producing low-value pages to manipulate rankings, not about the tool used. In the August 2026 case studies shared by SEO consultant Glenn Gabe, the sites that lost visibility combined large programmatic page sets with content that looked entirely machine-generated and added little original value.
A safe rule for a store: let AI help with a first draft, then have someone who knows the product add real details, correct mistakes, and decide whether the page deserves to exist at all. Ten reviewed pages beat a thousand unreviewed ones.
Will a core update follow, and how should you prepare?
Nobody outside Google can say when. Another core update is expected eventually, and the long gap since May makes one unsurprising, but Google has announced nothing. The last core update began on 21 May and finished around 2 June, and by early October more than 130 days had passed. Over 2022 to 2025 Google released roughly three or four core updates a year, so another one would not be a surprise. A spam update does not reliably predict a core update, and an active spam update does not seem to make one less likely.
The best preparation is the same work you would do for recovery: strong category pages, original product detail, and a clean technical foundation. If you also sell to businesses, make sure your catalog is not hidden behind a login, as we explain in why gated B2B catalogs are invisible to AI search.
How can Virtina help?
Virtina has been building and optimizing WooCommerce and other eCommerce stores for more than 14 years. For a suspected spam update hit, we can run a page-by-page audit against Google’s spam policies, clean up hacked or injected content, consolidate thin and duplicate pages, and rebuild your key category and product pages. We will also tell you plainly when your traffic drop is not Google’s doing. Talk to our team and we will start with your Search Console data.
People also ask
These are common questions based on search intent. They were not copied from Google’s live “People also ask” box.
Is a Google spam update a penalty?
Not in the manual sense. A spam update is an automatic change to Google’s ranking systems that demotes pages breaking spam policies. Nothing appears in Search Console, and you cannot appeal it. A manual action, by contrast, is a reviewed penalty that appears in your Manual actions report.
What is the difference between a manual action and a spam update?
A manual action is applied by a human reviewer, is listed in Search Console, and can be cleared with a reconsideration request. A spam update is algorithmic, shows no notice, and has no appeal. Both can come from the same kind of violation, so check the Manual actions report first.
How long does a Google spam update take to roll out?
Between about 19 hours and two weeks in 2026. The March update took roughly 19.5 hours, June and August took two to three days, and September ran for 13 days and 16 hours. Google usually says up to two weeks and confirms completion on the Search Status Dashboard.
Can a spam update make my pages disappear from Google?
Yes, in severe cases. Google says sites that violate its spam policies may drop in rankings or not rank at all. Check the Pages report in Search Console to see whether your pages are still indexed or have only lost visibility.
Does a spam update hit the whole site or only some pages?
It can be either. In the August 2026 case studies, one site with more than a million indexed URLs lost visibility across the whole site, while others lost rankings on specific programmatic page sets. Check which page types lost clicks before assuming the whole store is affected.
Conclusion
The September 2026 spam update was long, uneven, and only the latest in a busy year. If your store lost traffic between 24 September and 8 October, confirm it in Search Console, look for clusters of thin, scaled, copied, or hacked pages, and fix those before anything else.
Recovery is slow, but it is predictable when you remove the violations, add real value, and keep your catalog clean going forward. Start with the data, fix the biggest problem first, and resist the urge to change everything at once.
Frequently asked questions
Do I have to delete all my AI-written pages?
No. Remove or rewrite the pages that are thin, repetitive, or inaccurate, and keep the ones that are useful, reviewed, and unique. Quality and purpose matter more than how the first draft was written.
Can a rank tracker tell me if the spam update hit me?
Not reliably. Rank trackers can show sudden changes that real searchers do not see. Use Search Console clicks and impressions over several days as your evidence, and treat the rank tracker as a hint.
Should I stop publishing new content while I recover?
No, but slow down and raise the bar. Pause any bulk or automated publishing, then keep adding carefully reviewed pages with original detail.
Will fixing the problems bring my traffic back quickly?
Usually not. Google has said improvements can take months to be reassessed, and some recoveries only show after later updates. Small improvements in the first weeks are a good sign, but plan for months.
Does a spam update affect AI Overviews and AI Mode too?
It can. Spam-policy demotions affect how a site is treated in Google’s search systems, and industry observers expect visible changes across regular results, AI Overviews, and AI Mode. Cleaning up your site helps in all three places.
My store was hacked months ago. Could that still matter?
Yes, if injected pages or redirects are still live or still indexed. Check Search Console for security issues and search Google for your site name plus unusual terms. Cleaning and securing the site is the first step.
