A dip in your traffic near a reported Google spam update is not a penalty notice, and treating it as one is how small sites spend money they did not need to. Google runs a spam update as an improvement to the automated systems that spot search spam. Nothing in Google’s own description of one involves a message to you. A manual action, which is the thing that really does push a site down, is different in the ways that matter: a person at Google decides it, and Google tells you about it in a report you can open in a minute. So the question is not whether the update hit you. It is whether anyone at Google has taken an action against your site, and that has its own answer, and it is free.
- Spam update
- Google’s name for a notable improvement to the automated systems that detect search spam. It changes how spam is caught. It is not a rule you have broken.
- Core update
- A separate and much broader change to the ranking systems themselves. Google calls these “significant, broad changes to our search algorithms and systems”. Google dates them on the same dashboard, in separate rows, and the fix for one has nothing to do with the fix for the other.
- Manual action
- A decision by a human reviewer at Google that part or all of your site breaks a spam policy. It comes with a notice and a way to ask for a review.
- SpamBrain
- Google’s name for its AI-based spam prevention system, which is the machinery a spam update improves.
What a Google spam update actually is
Start with the one in the headlines. Google released the September 2026 spam update on 24 September 2026 at 09:15 Pacific time. It applies globally and to all languages, and Google’s own note says the rollout may take up to two weeks to complete. Two weeks from 24 September is 8 October.
Here is how Google describes the thing, in its own words: “While Google’s automated systems to detect search spam are constantly operating, we occasionally make notable improvements to how they work. When we do, we refer to this as a spam update.”
That paragraph settles the first question. A spam update is not aimed at your site. It is Google improving a filter, and it is announced in advance on a public list, which is why the next section can put dates on it.
It also settles the second. Google’s page says what a site should do if it sees a change, and what it should not do, and it does not describe a message to the site owner. Hold on to that, because the report that does carry a message is the whole of step three.
What Google does say is this: “Sites that see a change after a spam update should review our spam policies to ensure they are complying with those.” And it states the consequence as a possibility rather than a certainty: “Sites that violate our policies may rank lower in results or not appear in results at all.”
That word “may” is doing real work. Google is not saying that every site which moved down broke a rule. It is saying that a site which broke a rule might have moved down. Those are two different sentences, and only the second one is a penalty.
Step one: get the dates from Google’s own incident list
Google runs several of these a year, so this is a question with a permanent answer rather than a question about this month. Each ranking incident Google dates is listed on the Search Status Dashboard, one row each, with the date it began and how long it ran. That page is the only place Google dates them, which is why it is where you go first.
Here is what the Ranking history on that page showed on 2 October 2026.
| Incident | Started | Length Google posted |
|---|---|---|
| September 2026 spam update | 24 September 2026 | No length posted |
| August 2026 spam update | 18 August 2026 | 2 days, 16 hours |
| June 2026 spam update | 24 June 2026 | 2 days, 1 hour |
| May 2026 core update | 21 May 2026 | 11 days, 21 hours |
| March 2026 core update | 27 March 2026 | 12 days, 4 hours |
| March 2026 spam update | 24 March 2026 | 19 hours, 30 minutes |
| February 2026 Discover update | 5 February 2026 | 21 days, 17 hours |
Two lines in that table matter more than the rest.
The first is that 2026 holds four spam updates and two core updates, and the dashboard keeps them in separate rows. They are not the same event. Google describes a core update as “significant, broad changes to our search algorithms and systems”, says these changes “don’t target specific sites or individual web pages”, and adds that “In general, most sites don’t need to worry about core updates and may not even realize one has happened.” A spam update improves the spam filters, and that is a narrower thing aimed at a narrower pattern. Match your drop to the right row, because the two need different work and only one of them is about your site’s own quality.
The second is the September row itself. Every other row on the page carries a length. The September row’s length column read “Information” instead of a number on 2 October 2026, which is how that page shows there is no end date yet. Set that beside Google’s note that the rollout may take up to two weeks, and the window could still have been open on 2 October 2026. If your drop sits inside it, you are reading a number that is still moving, and the honest thing is to wait for that row to fill in before you judge anything.
Step two: compare your own clicks per day across those dates
Now line your own numbers up against the window. Open the Search Console performance report, set the dates to run from a week before the incident’s start date to the end of the window, and read clicks per day rather than totals for the two sides.
Per day matters for a quick read, because months are not the same length, and a 28-day month read against a 31-day month will tell you a story about your site that is really about calendars. For a careful comparison of two periods, Google points you the other way. Its words: “When comparing two date ranges, consider using the Weekly or Monthly granularity option.” Google gives the reason: “Aggregating by week or month neutralizes the ‘day-of-the-week’ effect (for example: comparing a Monday from one period to a Saturday from another period in a daily comparison) and provides a clearer, more accurate comparison of true long-term performance trends.” So read per day for the quick look, and switch the report to weekly or monthly before you decide anything.
Then filter. Two filters do most of the work, and both are worth the minute they cost.
By page. A site-wide change and one page that fell are two different problems, and the Pages tab separates them in seconds. This is the first filter we reach for on a client’s report, because a single page falling out of a thousand is invisible in a site total.
By query. In our own reports a seasonal dip and a lost page do not look the same, so the shape of the change is the first clue about which one you have. Look at which queries moved with the number, not only at how far the number fell.
What you are reading for is a step, not a slope. A change that lands inside the window and holds afterwards is one story. A decline with no step in it is another, and the next section is a real example of the second, taken from our own data.
A drop that is not the update: one site’s own numbers
Our own site is a small one, so we ran the same checks on it rather than describing them. Across the four months to September 2026, the deep end of our results drained while the top of them grew. Impressions at positions 51 to 100 fell from 401.6 a day in June to 220.1 a day in September. Impressions at positions 1 to 10 rose from 50.6 a day to 82.4 a day over the same window.
| Position band and month | Impressions a day |
|---|---|
| Positions 51 to 100, June | 401.6 a day |
| Positions 51 to 100, Sep | 220.1 a day |
| Positions 1 to 10, June | 50.6 a day |
| Positions 1 to 10, Sep | 82.4 a day |
Two dates do the work here. Our September data ran to 19 September 2026, the last day it covers. The September spam update began on 24 September 2026, five days later. Nothing that happened on the 24th can explain a fall that was already four months old.
The earlier 2026 spam updates, on 24 March, 24 June and 18 August, do fall inside those four months, and we have not verified them against this site’s data. What these numbers rule out is a different thing. A slow slide across the whole range of positions is not the shape of a filter being sharpened, and page-one impressions rising while deep ones fall is the opposite of a site being pushed down.
If your own numbers look like that, the update is not your first question. Which queries stopped, which pages stopped, and whether one page or one template is behind it is the question, and that is an ordinary SEO problem with ordinary answers.
Step three: read the Manual actions report
This is the report that separates an update from a penalty, and it is the one worth opening even when everything else looks fine.
Google’s own definition of a manual action: “Google issues a manual action against a site when a human reviewer at Google has determined that pages on the site are not compliant with Google’s spam policies.” A person, looking at your site, deciding it breaks a rule. Nothing automated about it.
And it comes with a notice, which is the sentence the whole check rests on: “If your site is affected by a manual action, we will notify you in the Manual actions report and in the Search Console message center.” Google’s page for spam updates describes no notice of that kind. So an update leaves no trace in this report, and a manual action always does.
Where to find it: in Search Console, open Security and Manual actions, then Manual actions. If your site has none, “you’ll see a green check mark and an appropriate message”. That is the answer you are after, and it takes about a minute.
If it is not clean, two things are worth knowing before you panic. The first is that a manual action can be narrow. The pages it covers “can be a subset of your site, or the entire site”, so a fall in one section of your site is a different job from a fall across all of it. The second is that the fix is written on the same page, action by action, and Google is blunt about the usual mistake: “Fixing the issue on just some pages will not earn you a partial return to search results.”
When every listed issue is fixed on every affected page, select Request Review in the report and describe what you did. Google says a good request does three things: it explains the exact quality issue, describes the steps you took, and documents the outcome. Then be patient with the timeline: “Most reconsideration reviews can take several days or weeks, although in some cases, such as link-related reconsideration requests, it may take longer than usual to review your request.”
The spam policies a small site breaks by accident
If the Manual actions report is clean, the update is the least likely explanation and you can stop reading here. If it is not clean, or you simply want to know what you would be looking at, four of the practices on Google’s spam policies page are the ones a small business site runs into without meaning to.
Hacked content. Google’s words: “Hacked content is any content placed on a site without permission, due to vulnerabilities in a site’s security.” Nobody chooses this one, which is why an afternoon a month spent updating whatever runs your site and looking at its file manager is worth having.
Scaled content abuse. “Scaled content abuse is when many pages are generated for the primary purpose of manipulating search rankings and not helping users.” Google’s own examples include “Using generative AI tools or other similar tools to generate many pages without adding value for users” and “Creating many pages where the content makes little or no sense to a reader but contains search keywords”. The word to hold on to there is value. A page written for a person is fine. Forty pages that differ only in a product name is our version of the same thing.
Link schemes. “Buying links or participating in link schemes in order to manipulate ranking in Google Search results is a violation of our spam policies.” This is the one that arrives with a contract attached. A cheap package that promises page-one rankings in thirty days is buying links, and Google names that as a violation rather than a grey area.
Expired domain abuse. “Expired domain abuse is where an expired domain name is purchased and repurposed primarily to manipulate search rankings by hosting content that provides little to no value to users.” If a domain has been offered to you, ask what it was before, because the history is the policy.
None of the four requires you to do anything dishonest. That is what makes them worth knowing: they are the four ways a site that is trying to run a business ends up in a spam filter by accident.
What to do while the rollout is still running
The short answer is: check, then wait.
Check, because the three reports above cost nothing and they tell you whether you have a problem or a coincidence. Then wait, because Google’s own timescale for this is long. “Making changes may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies.” Months is Google’s word, not a marketing one, and a site that rewrites itself in a week has not given those systems time to learn anything.
There is one case where tidying up cannot help, and it is worth knowing before you pay anyone to do it. In a link spam update, “when our systems remove the effects spammy links may have, any ranking benefit the links may have previously generated for your site is lost. Any potential ranking benefits generated by those links cannot be regained.” If the links came from a package you bought, the benefit that package paid for cannot be recovered afterwards.
Some sites would rather have these three reports read every month than read them themselves. That is the part of our SEO service, and we publish what it covers on that page.
Otherwise the order is simple: run the three checks, fix what a report actually names, and leave everything else alone until the dashboard row carries an end date.
How long does it take to recover from a Google spam update?
Google’s own answer is in months, and it is conditional. Google’s spam updates page says that “Making changes may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies.” If the problem was links, the answer is different and worse: the page says any ranking benefit those links produced “cannot be regained”. A manual action has its own clock, where Google says “Most reconsideration reviews can take several days or weeks”.
Does a Google spam update show up in Search Console?
Not as a notice. Google’s spam updates page describes an improvement to its automated systems and does not describe a message to the site owner. What Google does describe is a notice for manual actions, in the Manual actions report and the Search Console message center. The visible effect of an update is in your own numbers, not in a report that names your site.
Will my rankings come back if I do nothing?
Google’s pages do not promise it, so neither will we. What they say is that fixing a policy breach may help, over a period of months, and that link benefits cannot be regained. Google’s core updates page adds that most sites need not worry about core updates and “may not even realize one has happened”. Google makes no such statement about spam updates. The honest position is that waiting is reasonable, and that rewriting a site in a panic is not a recovery plan.
Should I change my content while the update is still rolling out?
Not for the sake of it. The systems that judge a spam update learn “over a period of months”, so a week of rewriting does not give them time to see anything. The changes worth making are the ones a report names: a manual action, a hacked page, a policy breach you can point at. Those are worth doing while you wait, because they are real. The rest is churn.
What to read next
Run the three checks in your own Search Console, in this order: the dates on the dashboard, your clicks per day across that window, then the Manual actions report. Ten minutes, and you will know which of the three situations you are in.
Then read our guide to Google’s own SEO documentation, which is where the spam policies sit in full. Every rule quoted above comes from pages Google writes and maintains itself, and they are free.