Google's September 2026 Spam Update: 14 Days, No Policy Named

Introduction

On October 8, 2026, Google closed its September 2026 spam update. It had been running for 13 days and 16 hours — the longest spam rollout in more than a year, longer than any of the three other spam updates Google ran during 2026, and roughly seventeen times the duration of March's. In its closing notes, Google named not a single policy it had targeted.

For anyone whose work depends on keyword rankings, that combination — an enormous rollout with no explanation — is the story of the quarter. But it is only half of it. Over the same two weeks, the tools that keyword researchers and SEO teams rely on to measure rankings quietly stopped telling the truth.

This is what happened, why your rank tracker reports may not reflect what real searchers saw, and how to adapt your keyword research and reporting routine while the dust settles.

What Happened: The Longest Spam Update of 2026

Google logged the start of the September 2026 spam update at 09:15 Pacific on September 24, 2026 — around noon Eastern — with a dashboard note saying the update applied globally and to all languages, and that the rollout "may take up to two weeks to complete."

The completion note carries a timestamp of 01:37 Pacific on October 8, 2026. Google's own ranking update history lists the run at 13 days and 16 hours, or roughly 98% of the stated allowance. Search Engine Roundtable logged the finish at 4:37 a.m. Eastern.

The comparison with the rest of the year is what makes the length conspicuous:

• March 2026: 19 hours and 30 minutes
• June 2026: 2 days and 1 hour
• August 2026: 2 days and 16 hours
• September 2026: 13 days and 16 hours

The previous August 2025 spam update ran roughly 27 days, from August 26 to September 22, 2025. Among the fifteen spam updates Search Engine Roundtable has documented since June 2021, September 2026 ranks sixth longest — behind the July 2021 link spam update (29 days), August 2025 (27), the December 2022 link spam update (19), and October 2023 and March 2024 (15 each).

At a talk this month, Google's Gary Illyes showed internal timing data putting spam rollouts at one to two days — which makes the September run close to seven times the top of Google's own range.

Google has not explained the gap. On LinkedIn, Google Search Central called it "a normal spam update" covering all languages and locations. Barry Schwartz, who documented the rollout at Search Engine Roundtable, said he did not know why that label fits a two-week rollout rather than a two-day one. Google declined to say what share of queries was affected, named no targeted policy, said no policy changes accompanied the release, and said link spam was not the target. It repeated that recovery "can take many months."

What is a matter of record is what sits in the live spam policies: expired domain abuse, scaled content abuse, site reputation abuse, doorway abuse, back button hijacking, and fake or undisclosed incentivized reviews. SpamBrain, the AI-based spam-prevention system Google names in its documentation, is described as a component refined over time — its architecture, training data and thresholds have never been published. Since May 15, 2026, the spam policies have also covered generative AI responses in Search, including AI Overviews and AI Mode, which makes September the third spam update under that extension. And since August 30, 2026, manual actions for site reputation abuse no longer affect rankings for searchers inside the European Economic Area — making this the first confirmed ranking update after that carve-out.

What the Data Showed: Three Windows of Movement

Algorithmic demotions arrive without notice. That is the structural difference from a manual action, which shows up in Search Console and can be appealed. A site demoted by this update learns about it from traffic data or a third-party tracker — which is exactly why the volatility readings mattered so much this time.

Barry Schwartz recorded three windows of elevated movement: September 25–27, September 30, and October 4–6, aggregating fourteen tools — AccuRanker, Algoroo, AWR, CognitiveSEO, DataForSEO, Mangools, Mozcast, Semrush, Serpstat, SimilarWeb, Sistrix, Wincher, Wireboard and Zutrix. The early tremors peaked over the weekend of Friday September 26 to Sunday September 27, prompting a wave of alarmed posts from respected practitioners. PPC Land logged elevated movement from about September 22, which Schwartz said was not the update.

The most useful independent read came from Diib, which published an early analysis on September 29 drawn from 32,569 websites with connected Google Analytics. Comparing each site's share of visits from unpaid Google search during September 24–26 against the same days a week earlier:

• The median share fell from 34% to 31%.
• 10% of sites saw a drop of half or more, compared with 5% in the earlier period.

Diib deliberately described the findings as "an early read, not a verdict," and noted the data cannot reveal which sites Google identified as spam. That caution is the correct posture — and it applies to your own dashboards too.

Why Rank Tracking Broke

Here is the part that should change how you interpret every chart you looked at in late September.

Google began testing goto redirects in its search results in July 2026 to identify and block scrapers, and confirmed in late August that it routes result links through google.com/goto addresses. Nozzle measured 500 to 1,000 requests to resolve a single five-page ranking once those redirects are in play. The goto redirects, however, turned out to be the easy part for tracking tools to handle.

Derek Perkins of Nozzle has been the most transparent about the wider problem, describing a three-pronged approach by Google:

1. Super-wide IP blocking, targeting major residential proxy networks.
2. A significant increase in the use of CAPTCHAs.
3. Injecting bad data into suspect SERPs so that when tools scrape the results, they receive the wrong data in some cases.

That third element is the dangerous one. In a deep dive titled "Poisoned Google SERPs," published on October 12, Nozzle reported: "Since September 2026, Google has been poisoning the SERPs it serves rank trackers: complete, normal-looking pages whose results have been swapped out. Nothing on the page gives it away. Each keyword's own history does."

Independent of Nozzle, SEOmonitor reported that from September 26, industry-wide rank trackers observed sudden ranking changes that people searching on Google did not see — which it attributes to incomplete and inaccurate data returned by Google to automated search tools.

Tools have acknowledged the disruption to varying degrees. Sistrix commented on the issue; DataForSEO posted a notice on its status page; SE Ranking said it was "missing positions for some keywords" before reporting most of the issue resolved; Advanced Web Rankings and Morningscore posted about it too. On October 8, Lily Ray put it plainly: rank trackers were "too unreliable at the moment."

A concrete example made the rounds: a site hammered on September 29 — confirmed by its owner — was picked up accurately by Ahrefs, while Semrush registered the drop late before eventually catching it. Two tools, one event, two different versions of the truth.

Even Google's own reporting wobbled. The Search Console performance report fell more than 64 hours behind in mid-October, an unusual delay for that particular report, before returning to normal on October 12. The last comparable delay was in December 2025.

Why This Matters for Keyword Researchers

Your rank tracker is now a noisy instrument, and that has three consequences for keyword research work.

First, apparent ranking changes may never have happened for real users. If a tool's data was swapped or incomplete during the rollout, its volatility chart can show a cliff that no human searcher experienced. Chasing that phantom drop with content edits or redirects is worse than doing nothing.

Second, Search Console is your closest thing to ground truth. Spam updates typically produce changes that hold over several days and show up in Search Console impressions and clicks. If a late-September drop appears in your rank tracker but not in Search Console, treat the tracker as the suspect.

Third, the measurement gap is widening at exactly the wrong moment. The Search Console generative AI report, which reached every property on August 31, 2026, shows impressions but neither clicks nor queries. As AI Overviews and AI Mode absorb more of the search results page, the free, first-party data you can trust is getting thinner — even as third-party data gets noisier.

How to Adapt Your Strategy

1. Freeze during an active rollout. While an update is rolling out, hold off on code changes, URL redirects, page titles and bulk content adjustments. Weekend crashes during an active spam rollout are a weather report, not a post-mortem.

2. Triangulate three sources. Compare your rank tracker against Search Console impressions/clicks and your own analytics or server logs. Trust the source that reflects what a person would have seen.

3. Use the fixed window. With the rollout complete, September 24 to October 8 gives you a defined period to compare Search Console performance before, during and after the update as more data arrives. That is a far better basis for a decision than any single day's tracker reading.

4. Budget for months, not days. At Search Central Live Deep Dive Europe in Barcelona on October 2, Gary Illyes showed timing ranges — captured in a recap by John Campbell of ROAST — that put a typical site move at one to three months (six months to over a year at the slowest) and core update recovery at about three to six months typical (six months to a year in the slowest cases). The recap does not define "typical," so treat these as ranges, not deadlines — but they are a useful yardstick when a client asks whether a recovery is still in progress.

5. Audit the policies that are actually enforced. Rather than guessing what the September update targeted, review the documented areas: expired domain abuse, scaled content abuse, site reputation abuse, doorway abuse, back button hijacking, and fake or undisclosed incentivized reviews. Google also added a line to its content guidance calling fabricated author profiles a form of deception — worth a look if you publish at scale.

6. Do not over-index on a single reading. Update your baselines to account for the fact that late-September tracker data is suspect. If you rely on historical tracking exports for content forecasting, annotate the September 24 – October 8 window rather than treating it as clean signal.

Key Takeaways

• Google's September 2026 spam update ran 13 days and 16 hours, ending October 8 — its longest in over a year and the sixth longest of fifteen documented since 2021.
• Google named no targeted policy, said link spam was not the target, and declined to quantify the impact.
• Rank trackers returned poisoned or incomplete data from around September 26, so many reported ranking swings were never visible to real searchers.
• Search Console (impressions and clicks) is the more trustworthy signal now — but its generative AI report still shows impressions without clicks or queries.
• Recovery and recovery-adjacent timelines are measured in months: 1–3 months for a typical site move, about 3–6 months for typical core update recovery.
• Freeze changes during rollouts, triangulate your data sources, and wait for a settled baseline before acting.

FAQ

Q: Was the September 2026 spam update a core update?

No. Google labelled it a normal spam update, and spam updates generally target specific policy violations rather than the broad site-quality reassessment a core update performs. That said, several practitioners noted the volatility felt more core-update-like than usual — a reminder that labels describe Google's intent more than the measured outcome.

Q: How long did the September 2026 spam update take?

It ran from roughly noon Eastern on September 24 to 4:37 a.m. Eastern on October 8, 2026 — 13 days and 16 hours, according to Google's ranking update history. It used about 98% of the "up to two weeks" window Google announced at launch.

Q: Is my rank tracker wrong?

Not necessarily wrong — but treat it as degraded. During the rollout, some tools received swapped or incomplete results. If your tracker shows a drop that Search Console impressions and clicks do not corroborate, check the tracker before changing your site.

Q: How long does recovery take after a spam update?

Google has consistently said recovery can take many months. For recovery-grade timelines, Gary Illyes' Barcelona figures put typical core update recovery at about three to six months, extending to a year in the slowest cases.

Q: What should I do if I was hit?

Audit the enforced policy areas first — scaled content abuse, site reputation abuse, doorway abuse, expired domain abuse and undisclosed incentivized reviews — and fix genuine violations. Then wait for a settled baseline before making further changes. Chasing phantom data during a rollout is how good pages get damaged.

Conclusion

The September 2026 spam update will be remembered for two things: how long it ran, and how little Google said about it. For keyword researchers, the practical lesson is about data discipline. In a window where the official rollout ran 13 days, where the industry's trackers served partially fabricated results, and where even Search Console fell more than two days behind, the teams that came out ahead were the ones that resisted reacting to a single chart.

Measure with more than one instrument, wait for the baseline to settle, and use the September 24 – October 8 window as a labeled anomaly rather than clean history.

If you want to build your keyword research workflow around signals that survive updates like this, start with the tools and guides at Social Keyword Generator — practical keyword research for a search landscape that keeps rewriting its own rules.