What is a Google spam update and what should you do if your site is hit?

A Google spam update is an improvement to SpamBrain and the other automated systems Google uses to catch pages that break its spam policies, and the pages it catches rank lower or drop out of results. If your site is hit, find the specific policy you broke, fix or remove it, and expect Google's systems to take months to see that the site now complies.

Google's Search Status Dashboard lists four spam updates in 2026, in March, June, August and September. The first three finished in under three days. The September 2026 spam update started on 24 September and took 13 days and 16 hours. If you opened Search Console in October to a traffic drop and no message from Google, it is the first suspect.

A drop inside that window does not prove a spam problem. Core updates, manual actions, broken tracking and hacked pages all look alike on a traffic chart, and each needs a different fix. Treat a core update drop as spam, or the other way round, and you spend months fixing the wrong thing.

What does a Google spam update target?

Every Google spam update targets pages that break Google's spam policies for web search. Google lists 16 of them, from cloaking and keyword stuffing to link spam and scaled content abuse, and states that "sites that violate our policies may rank lower in results or not appear in results at all." The update changes how well the systems catch violations. The rules stay on that one public page, which makes it your audit checklist.

The seven below cover the tactics business sites use on purpose or inherit by accident. Google finds them "both through automated systems and, as needed, human review that can result in a manual action."

Teams that publish with AI should read scaled content abuse closely. The policy does name "using generative AI tools or other similar tools to generate many pages without adding value for users" as an example. The same list includes scraping, stitching other pages together and keyword-filled pages that make no sense to a reader. What gets caught is volume without value, rather than the tool that wrote the words.

Three of these policies are recent. Google announced expired domain abuse, scaled content abuse and site reputation abuse on 5 March 2024, and enforcement of site reputation abuse began on 5 May 2024. The spam policies page now heads that last section "Site reputation policy". If your site used one of these tactics before 2024 and nobody went back to check, start the audit there.

Four spam updates in 2026, and why September was different

Between March and October 2026, Google ran six spam and core updates, and two of them started three days apart. Each start date and rollout length is your first filter for any drop: a change that begins outside every window is unlikely to be either kind of update. Every date in the table is from Google's Search Status Dashboard.

The March overlap catches people out. The spam update finished in under a day, then the core update started on 27 March and ran for more than 12 days. A site that lost traffic in the last week of March could be looking at either one, and only the pages that fell, and the day they fell, can separate the two.

September also differs in reach. Google called it "a normal spam update" that applied globally and to all languages, so no market sits outside it. Search Engine Roundtable reported the rollout complete at 4:37 am ET on 8 October 2026. A two-week rollout can show up as a drop in stages, so compare full weeks, not single days.

Was it a spam update, a core update or a manual action?

A manual action comes with a notice. Spam updates and core updates do not. Open the Manual actions report in Search Console first: Google notifies you there, and in the Search Console message center, when a human reviewer has found pages that break its spam policies. A green check mark rules that out, and the timing and the pages that fell tell you the rest.

A spam update leaves a pattern. The drop starts inside a spam update window, no manual action is listed, and the losses cluster on pages that share a trait from the policy list: the programmatic location pages, the sponsored posts, the pages with bought links pointing at them. Pages outside that group hold steady or move a little.

A core update spreads wider. The drop lines up with a core update window and runs across many page types, with no spam pattern behind it. The advice for core updates is to wait "at least a full week after a core update completes" before analysing anything, then compare that week with a week before the rollout began. Google compares it to a top 20 restaurant list, where "restaurants that move down aren't necessarily 'bad'". Other restaurants made the list instead.

Outside both windows, check the plumbing. Google's guide to debugging Search traffic drops lists technical issues, security issues, site moves and changes in search interest as other causes. If the whole site fell, check the Page indexing report. If one group of pages fell, run a few of them through the URL Inspection tool.

How to check if a spam update hit your site

Work in this order: confirm the rollout dates, rule out a manual action, then compare Search Console data for the weeks before and after the rollout. A spam hit shows up as a step down that starts inside the rollout window and sits on particular sections of the site, rather than a slow slide across the whole site. You need only Search Console and your analytics tool.

1. Write down the start and end dates of every update since your traffic changed, from the Search Status Dashboard. For the September 2026 spam update, that is 24 September to 8 October.
2. Open the Manual actions report, then the Security issues report on the same visit. Hacked pages fall under the spam policies too.
3. In the Performance report, set the date filter to the last 16 months, as Google suggests, so a seasonal dip does not pass for a penalty.
4. Compare the two weeks before the rollout with the two weeks after it ended. For September, that means 10 to 23 September against 8 to 21 October.
5. Switch to the Pages tab, sort by the change in clicks, and list the 20 pages that lost the most. Look for what they share: a folder, a template, a content type or a link source.
6. Check your analytics for Google organic sessions over the same dates. If analytics fell and Search Console did not, the problem is your tracking, not Google.
7. Search a handful of the queries you lost and note who ranks now. If a competitor rose with the same kind of page you have, a spam demotion is less likely.

Here is what that looks like in practice. Say an online furniture store got 18,000 clicks a month from Google before the September update and 11,000 after it. The Manual actions report shows a green check. The Pages tab shows that 6,100 of the 7,000 lost clicks came from 340 city pages such as "furniture store in Leeds" and "furniture store in Austin", all built on one template with one shared paragraph. Product and category pages barely moved. That pattern points to scaled content abuse rather than a core update reassessment.

What to do if a Google spam update hits your site

Fix the violation, rather than the symptoms. Google's guidance on spam updates tells affected sites to review its spam policies and make sure they comply, and says changes may help "if our automated systems learn over a period of months that the site complies with our spam policies." Rewriting pages that were fine does nothing for that.

Our advice is to start with the page group that lost the most clicks and keep a dated log of every change. That log is the only way to tell, three months later, which fix moved the numbers.

Paid and swapped links. Remove the links you paid for, traded or built with automated tools wherever you control them, and ask other site owners to remove the rest. Sponsored placements you sell or publish should carry rel="sponsored", the value Google gives for "advertisements or paid placements". Expect some of the loss to stay lost: once Google's systems remove the effect of spammy links, "any ranking benefit the links may have previously generated for your site is lost."

The disavow tool is for one narrow case. Google's disavow guidance says to use it only when a large number of spammy, artificial or low-quality links point at your site and they have caused, or likely will cause, a manual action. It also says most sites will not need the tool, and that used incorrectly it "can potentially harm your site's performance".

Scaled and thin pages. Sort the pages from your audit into three piles. Pages that answer a real question with original detail stay and get better. Near-duplicates merge into one stronger page with a 301 redirect, and pages that earn no visits and help no reader come down. For the furniture store above, that could mean 15 city pages for the cities it delivers to, each with real delivery times and showroom details, in place of 340 copies.

Third-party sections need an honest answer. If an outside team publishes coupons, reviews or sponsored articles on your domain, ask why the section exists. When the answer is your domain's ranking strength, it fits the site reputation definition, and the clean fix is to end the arrangement or remove those pages.

Hacked pages and user spam. Delete the injected pages, close the hole that let them in, such as an outdated plugin or a reused password, and recheck the Security issues report. On comments, forums and profiles, add moderation and mark user-posted links with rel="ugc", which Google recommends for "comments and forum posts".

Redirect and back button tricks hide in other people's code. Check third-party ad and popup scripts as well as your own templates. Visitors and Google judge what the page does, whoever wrote the script, so open your pages on a phone from a Google result and see where you end up.

If a manual action is listed, the route is different. Fix the issue on every affected page and make sure Google can reach those pages, with no login, paywall, robots.txt block or noindex in the way. Then select Request Review and describe what you fixed. Most reconsideration reviews take "several days or weeks", and link-related requests can take longer.

How long does spam update recovery take?

Plan for months. Google's spam update guidance gives no shorter timeline for algorithmic demotions, and they have no review request and no fast lane. A manual action can move faster, because you can ask for a review as soon as every listed issue is fixed.

Some traffic will not come back. A clean site ranks where its own pages deserve, so for a site that grew on bought links or 2,000 thin city pages, the realistic target is the traffic its useful pages earned, not the old peak.

Nothing in Google's documentation ties spam recovery to the next named release. Run the same Search Console comparison once a month and judge the trend across three to six months.

Five mistakes that make a spam hit worse

The mistakes that hurt most after a spam update are large changes made before the audit is done. Each one below feels like progress in the first week after a drop. Every one of them also removes good pages with bad ones or repeats the violation the update just caught, which pushes recovery further out.

• Deleting half the site in one weekend. Good pages go out with the bad, and you lose any way to tell which change helped, so work through page groups in the order your audit ranked them.
• Disavowing every link you don't recognise, the exact misuse Google's disavow warning describes.
• Replacing 500 thin pages with 500 AI-written pages: one scaled content example swapped for another.
• Buying links to make up the lost authority. Those are the links the update just discounted.
• Moving the content to a new domain to start fresh. Google's spam policies list policy circumvention among the practices that can lead to demotion or removal.

Who needs to act, and who can leave it alone

Act now if your traffic fell inside a spam update window and your site uses any tactic from Google's list: paid links, pages built at scale, a third-party section, an expired domain bought for its history, or open comment areas with no moderation. If your drop started outside every rollout window, look at technical, tracking and demand causes before you touch content.

For honest sites, spam updates work in your favour: copied pages and link-farm content lose ground in the same results you compete in. The cost sits on the diagnosis side: no notice, no list of affected pages and months between fix and result, so you carry the detective work. You also answer for content you did not write, because hacked pages, user spam and third-party sections all sit on your domain.

Take a consultancy blog with 60 posts, no ads and no bought links, that lost 15 percent of its clicks in October. The policy audit for a site like that takes an afternoon and will probably come back clean. Spend the rest of the time on the other causes in Google's traffic drop guide, and on whether search demand for those topics fell that month.

Whatever caused your drop, write down the policy you think applies, the pages involved and the date you fixed each one, then repeat the same before and after comparison every month. The policy page is your checklist, and the log is your proof. If you would like help with the audit or the clean-up, ask the Techno Mantra team for a quote through our contact page.