A Google spam update is a named, announced improvement to the automated systems Google uses to find and demote search spam. Google shipped its fourth one of 2026 on September 24. If you have never had to think about one, that is normal. Most sites never notice them.
The short version: Google’s spam detection runs all the time. A spam update is the moment Google makes a notable change to how that detection works, and says so publicly. Sites that break Google’s published spam policies can drop in rankings or vanish from results. Sites that follow the policies are not the target, though a few legitimate sites do get caught.
This piece walks through what a spam update is, what Google counts as spam, how a spam update differs from a core update or a manual action, which rules tend to catch nonprofits and small publishers, and how to check whether one affected you.
What a Google spam update actually is
Google’s own definition is short. From its spam updates documentation: "While Google’s automated systems to detect search spam are constantly operating, we occasionally make notable improvements to how they work. When we do, we refer to this as a spam update."
Three things follow from that.
First, a spam update is not a new rule. The rules are Google’s spam policies, which exist on their own page and change on their own schedule. A Google spam update changes how well the systems enforce those rules.
Second, it is automated. No person at Google reviews your site during a spam update. That is a separate process, called a manual action, covered below.
Third, it is announced. Google posts each one on the Google Search Status Dashboard with a start time. It posts again when the rollout finishes. Between those two posts, rankings can move.
Google does not usually say which kinds of spam a given update targets. The September 2026 spam update is a typical example. The announcement said it "applies globally and to all languages" and that "the rollout may take up to two weeks to complete." That was all. Google marked it complete on October 8, after 13 days and 16 hours.
SpamBrain: the system that gets updated
The main system behind these updates is called SpamBrain. Google describes it, in its guide to ranking systems, as one of "a range of spam detection systems" it uses "to deal with content and behaviors that violate our spam policies."
SpamBrain is a machine learning system. It looks for patterns that spam sites share, rather than checking pages against a fixed list.
Google has published a few numbers about it. In its webspam report for 2022, as reported by Search Engine Journal, Google said SpamBrain caught five times more spam sites than the year before. It said SpamBrain got ten times better at spotting hacked sites. It also said it found 50 times more link spam sites than in the previous link spam update.
Those are Google’s own figures, and they are a few years old. They are still useful for one reason. They show that a spam update is mostly about detection getting better, not about the definition of spam changing.
Spam update, core update, link spam update or manual action
Google makes several kinds of change that can move your rankings. They get confused constantly, and the difference decides what you should do.
| Google spam update | Link spam update | Core update | Manual action | |
|---|---|---|---|---|
| What changes | How well automated systems catch spam | How systems treat manipulative links | How Google ranks everything | A person reviews your site |
| Who is targeted | Sites breaking spam policies | Sites buying or trading links | Nobody in particular | Your site specifically |
| How you find out | Status Dashboard, then your traffic | Status Dashboard, then your traffic | Status Dashboard, then your traffic | Search Console message and Manual Actions report |
| Is something wrong? | Probably, if you dropped | Links you relied on stopped counting | Not necessarily | Yes, a reviewer found a violation |
| How recovery works | Fix it, then wait months | Lost link value does not come back | Improve content, wait for later updates | Fix it, then file a reconsideration request |
Core updates are the ones most people have heard of. Google’s core updates documentation calls them "significant, broad changes to our search algorithms and systems" made several times a year. A core update drop does not mean you broke a rule. Google says plainly that "most sites don’t need to worry about core updates."
Link spam updates are a narrower kind of spam update aimed at links built to manipulate rankings. Their effect is permanent in one specific way. Google’s documentation says that once its systems neutralize spammy links, any ranking benefit those links gave you is gone, even after you clean up.
Manual actions are the only human review
Manual actions are the only case where a human is involved. According to Google’s Search Console help, a manual action means "a human reviewer at Google has determined that pages on the site are not compliant with Google’s spam policies." You get a message in Search Console. You can fix the problem and ask for a review.
The practical rule: if you have no message in the Manual Actions report, you do not have a manual action, whatever else happened.
What Google counts as spam
Google keeps a public list of spam policies. It was last updated on August 28, 2026, and names sixteen practices. They fall into five rough groups.
Showing search engines something different from people. Cloaking, sneaky redirects, and hidden text and link abuse. The page a visitor sees is not the page Google was shown.
Pages made to rank rather than to help. Keyword stuffing, doorway abuse, scaled content abuse, scraping and thin affiliation. Scaled content abuse is the one that covers mass-produced pages, however they were made. Google defines it as "generating many pages for the primary purpose of manipulating search rankings and not helping users."
Borrowed authority. Expired domain abuse, where someone buys an old domain to use its reputation, and the site reputation policy, where a site hosts third-party pages that ride on its standing. We covered the August 2026 changes to that second one in site reputation policy enforcement.
Manipulating links or Google itself. Link spam and machine-generated traffic, which includes sending automated queries to Google.
Deceiving or harming visitors. Malicious practices, misleading functionality, hacked content and user-generated spam.
The last two in that list matter more than they look. Hacked content and user-generated spam are the two policies you can break without doing anything on purpose.
The rules that catch legitimate organizations
Most Google spam update coverage is written for affiliate marketers and link sellers. Nonprofits, associations, colleges and small publishers usually get caught by something else.
Hacked pages you do not know about. An outdated plugin or theme lets an attacker add pages to your site, often selling drugs, gambling or counterfeit goods. They may be hidden from your navigation. Google counts them as spam on your site. Recent WordPress flaws such as the Click2Shell vulnerability are exactly how this starts.
Spam in comments, forums and member profiles. Open comment sections, community forums, event listings and public member directories fill up with links if nobody moderates them. That is user-generated spam, and it is your site’s problem.
Sponsored or partner sections. A "partner content" area, a coupon section run by a third party, or pages written by a vendor for their own ranking benefit can fall under the site reputation policy. This is the one most likely to catch a publisher trying to raise money.
Bulk-produced pages. Hundreds of near-identical location pages, program pages or AI-written articles made to capture search traffic can look like scaled content abuse. It does not matter whether a person or a model wrote them. It matters why they exist.
An acquired domain. If your organization bought or inherited an old domain and redirected or rebuilt it, be clear about why. Using an expired domain to carry unrelated content onto its old reputation is its own policy.
None of these require bad intent. All of them are fixable.
Every Google spam update since 2025
Here is the record from the Search Status Dashboard, with core updates included for context.
| Update | Started | Rollout took |
|---|---|---|
| September 2026 spam update | September 24, 2026 | 13 days, 16 hours |
| August 2026 spam update | August 18, 2026 | 2 days, 16 hours |
| June 2026 spam update | June 24, 2026 | 2 days, 1 hour |
| May 2026 core update | May 21, 2026 | 11 days, 21 hours |
| March 2026 core update | March 27, 2026 | 12 days, 4 hours |
| March 2026 spam update | March 24, 2026 | 19 hours, 30 minutes |
| December 2025 core update | December 11, 2025 | 18 days, 2 hours |
| August 2025 spam update | August 26, 2025 | 26 days, 15 hours |
Two things stand out.
The pace has picked up. Google ran one spam update in all of 2025. It has run four in 2026 so far. Google has given a reason, according to Search Engine Roundtable. At a Search Central event in Europe, Google said there are more spam updates because there is so much more new content. It also said "the team is now using AI to help catch more of it."
The rollout times vary a lot. The three spam updates before September each finished in under three days. The August 2025 spam update took almost 27 days. So the September 2026 update’s two weeks are long for this year. They are not new. Google’s John Mueller told Search Engine Roundtable only that it’s "likely to take longer than some of the previous ones."
The biggest change in recent years came in March 2024, when Google added three new spam policies: expired domain abuse, scaled content abuse and site reputation abuse. Those three now shape a large share of spam enforcement.
What happens to a site hit by a Google spam update
Google’s documentation says sites that break its policies "may rank lower in results or not appear in results at all."
In practice, that plays out in a few ways.
- Specific pages drop. The pages that break a policy lose rankings. The rest of the site may be fine.
- A whole section drops. A subdirectory full of third-party or mass-produced pages falls together.
- The whole site drops. This is rarer and usually means the problem is widespread.
- Links stop counting. If your rankings depended on paid or traded links, they lose their effect. Nothing on your site changed, but the support under it did.
Timing matters too. Changes usually appear during the rollout window. Google advises waiting until the rollout is complete before drawing conclusions, and the same advice applies to core updates.
How recovery works
Recovery from a Google spam update is slow by design. Google’s wording: "Making changes may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies."
Note the words "may" and "months." There is no form to file and no one to ask. The systems have to see, over time, that the problem is gone.
A few points follow from that.
- Fix the cause, not the symptom. Removing a few pages rarely helps if the practice that produced them continues.
- Link gains do not come back. If spammy links were neutralized, the ranking they gave you is gone for good. You rebuild with links you earn.
- There is no reconsideration request for algorithmic drops. That process only exists for manual actions.
- Later updates are where recovery shows. Improvements tend to appear gradually, or around later updates, not the day after you fix something.
This is why the Manual Actions report matters after any Google spam update. If you have a manual action, you have a clear path: fix, document, request review. Google says those reviews typically "take several days or weeks." If you do not have one, the path is simply to comply and wait.
How to tell whether a spam update affected you
Most traffic drops during a Google spam update are not caused by it. Traffic moves for many reasons. Before you assume anything, work through these steps in Search Console.
1. Check the dates. Open the Search Status Dashboard and note when the update started and finished. Then open the Performance report and compare the same period before and after. A drop that started weeks earlier has another cause.
2. Wait for the rollout to end. Google’s core update guidance recommends waiting at least a week after an update finishes before judging the impact, and the same logic applies here. Mid-rollout numbers move around.
3. Check the Manual Actions report. It is under Security and Manual Actions. If it says no issues were detected, you are dealing with an algorithmic change, not a human review.
4. Check the Security Issues report. It sits in the same section. If Google has found hacked content, it will usually tell you there.
5. Look at which pages fell. Sort the Performance report by page. A drop concentrated in one section points at that section. A drop spread evenly across the site points at something broader, often a core update.
6. Search your own site. Try site:yourdomain.org alongside words like "casino," "pharmacy" or "loan." Unfamiliar pages in the results are a sign of hacked content.
7. Rule out AI Overviews and other changes. Many small sites have lost clicks this year to AI answers in search results, not to penalties. We looked at that pattern in the small publisher traffic collapse. A steady slide in clicks with stable rankings points there, not at spam enforcement.
What to do while a Google spam update is rolling out
If you follow the policies, the right answer during a Google spam update rollout is mostly to do nothing drastic. A few low-cost checks are still worth doing.
- Update your CMS, plugins and themes. Hacked content is the easiest spam policy to break by accident.
- Moderate or close old comment sections, forums and open directories. Remove the spam that is already there.
- Review any partner, sponsored or vendor-written sections. Ask whether each page exists to help your readers or to help someone else rank.
- Look at pages made in bulk. If you have hundreds of near-identical pages, ask whether each one serves a real visitor. Our guide to content pruning covers how to decide.
- Do not buy links, and do not panic-disavow. Disavowing links you did not build rarely helps and can hurt.
Then check again after the rollout ends. For most organizations, the answer will be that nothing happened.
The September 2026 spam update, in brief
Google began the September 2026 spam update on September 24 at 9:15 a.m. Pacific time. It applies worldwide and in every language. Google said it may take up to two weeks to complete. It finished on October 8.
Google did not name a target, did not announce a new policy and did not describe it as a link spam update. It is the fourth Google spam update of 2026.
Google has not described any phases. Search Engine Roundtable has, based on ranking tools and site owner reports. It reported on October 1 that a first wave likely hit sites September 25 to 27. It said September 30 "may have been the second wave." On October 6 it reported a third spike, October 4 to 6.
The dashboard lists the end as 1:00 a.m. Pacific time on October 8. Google’s final post there reads: "The rollout was complete as of October 8, 2026."
Frequently Asked Questions
What is a Google spam update?
A Google spam update is a notable improvement to the automated systems Google uses to detect search spam, announced publicly on the Google Search Status Dashboard. It changes how well Google enforces its existing spam policies. It does not add new rules.
How is a spam update different from a core update?
A spam update targets sites that break Google’s spam policies. A core update is a broad change to how Google ranks all results and does not mean anything is wrong with your site. If you lose rankings in a core update, you have not necessarily broken a rule.
What is SpamBrain?
SpamBrain is the machine learning system Google uses to detect spam. Spam updates are largely improvements to SpamBrain and related detection systems.
Will I be notified if a Google spam update affects my site?
No. Spam updates are automated, so there is no individual notice. You would only see changes in traffic and rankings. A notice in Search Console only comes with a manual action, which is a separate, human review.
How do I know if I have a manual action?
Open the Manual Actions report in Google Search Console, under Security and Manual Actions. If it says no issues were detected, you do not have one.
How long does a Google spam update take to roll out?
It varies. The three spam updates earlier in 2026 each finished in under three days. The August 2025 spam update took almost 27 days. The September 2026 spam update took 13 days and 16 hours, according to the dashboard.
How long does it take to recover?
Google says improvement may come “over a period of months” once its systems learn your site complies with its spam policies. There is no request to file for an algorithmic drop.
Can a legitimate nonprofit or publisher be hit by a spam update?
Yes, usually through hacked pages, unmoderated comment or forum spam, third-party sponsored sections, or pages produced in bulk. None of these require bad intent, and all of them can be fixed.
Does Google penalize AI-generated content in spam updates?
Not because it is AI-generated. Google’s scaled content abuse policy covers pages made in bulk “for the primary purpose of manipulating search rankings,” however they were produced. The reason the pages exist matters, not the tool.
Should I disavow links after a spam update?
Usually not. If you never bought or traded links, disavowing rarely helps. Link spam updates simply stop counting manipulative links, and any lost value from those links does not come back.
How many spam updates has Google run in 2026?
Four so far: March, June, August and September. Google ran one in 2025, in August.
Where can I see when updates happen?
The Google Search Status Dashboard lists every announced ranking update, including spam and core updates, with start and end times.
