Google's September 2026 Spam Update: How to Tell If Your Small Business Website Was Affected

Google began rolling out its September 2026 spam update on 24 September 2026, at 17:15 UK time. It applies globally and in all languages, so UK websites are included. Google says the rollout may take up to two weeks to complete. As of 27 September, the Google Search Status Dashboard still shows only the launch entry. The rollout has not been marked as finished.

Most small business websites don't need to do anything drastic. Google hasn't said what this update targets. If your traffic has moved, the sensible first step is to check Search Console carefully and rule out other causes before you change anything. This guide shows you how.

What is Google's September 2026 spam update?

A spam update is a notable improvement to the automated systems Google uses to detect content and tactics that break its spam policies. Those systems run all the time. Google calls it a spam update when it makes a significant improvement to how they work, and it logs these on its public list of ranking updates. One of the systems involved is SpamBrain, Google's AI-based spam-prevention system, which Google periodically improves to catch new types of spam.

What Google has confirmed about this update:

• It started on 24 September 2026 at 09:15 US Pacific time and is classed as an incident affecting ranking.
• It applies globally and to all languages.
• The rollout may take up to two weeks. If it runs the full window, that would take it to around 8 October.
• It is the fourth confirmed spam update of 2026, following updates in March, June and August. Those three finished in between roughly 19 hours and under three days.

What Google has not disclosed:

• There was no blog post, no new policy, no list of what the update targets, and no figure for the share of searches affected.
• Why the rollout window is longer this time. A longer window doesn't necessarily mean the update will take the full two weeks, or that it is larger or more consequential.

Does the September spam update affect UK small businesses?

UK websites are in scope, because the update is global. Being in scope is not the same as being affected, though. Google's position is that sites violating its spam policies may rank lower or not appear at all. A local business that has never used manipulative tactics shouldn't expect to be a target.

That doesn't make ordinary websites automatically safe. Small business sites can end up hosting spam without the owner realising, and these three situations are worth ruling out:

• Your site has been hacked. Attackers sometimes add new spammy pages to a site through security flaws, while the existing pages look completely normal.
• Visitors have added spam. Google treats spam posted through comment sections, forums and similar user areas as a policy issue, and notes that site owners are often unaware of it.
• Someone published content in bulk on your behalf. Examples include a previous supplier, a plugin or an AI tool producing dozens of near-identical pages or low-value blog posts.

What is Google targeting with this spam update?

Google hasn't said. Its announcement simply called this a normal spam update that rolls out for all languages and locations. Any article claiming to know the specific target is speculating.

It is useful to know what Google's spam policies already cover. These are Google's standing rules, not a list of what this particular update targets. The policies most relevant to small business websites are:

• Scaled content abuse. This means producing many pages mainly to manipulate rankings rather than to help people, typically large amounts of unoriginal content with little value, however it was created.
• Doorway abuse. An example is having multiple pages aimed at specific towns or regions that all funnel visitors to the same place.
• Scraping. This covers republishing content from other sites without adding original value, including lightly reworded copies.
• Link spam. This includes buying or selling links to influence rankings, excessive link swaps, and automated link-building.
• Hacked content and user-generated spam, as described above.

Does Google's September 2026 spam update target AI content?

Google has not said that it does. Google hasn't confirmed AI-generated content as a specific target of this rollout.

Google's published guidance also doesn't treat using AI as spam in itself. Google's guidance on generative AI content describes it as particularly useful for researching a topic and adding structure to original content. What may break its scaled content abuse policy is using AI or similar tools to generate many pages without adding value for users.

Three different things tend to get lumped together here:

1. AI-assisted content. You use a tool to help draft, then check, correct and add your own knowledge. Google's guidance doesn't object to this.
2. Low-value automated content. These are pages that are generic, repetitive or inaccurate, however they were made. They may simply fail to rank well.
3. Scaled content abuse. This is producing many pages primarily to manipulate search rankings. It is a spam policy violation, and Google says the policy applies no matter how the content is created.

The question to ask isn't "Did we use AI?" It's "Does this page genuinely help the person who lands on it?"

How can I tell whether Google's update affected my website?

You can't be certain yet. The rollout is still running, and Google doesn't notify sites that were affected by an automated spam update. What you can do is use Google Search Console to see whether there's a real change worth investigating, and where it is. Google's own guide to debugging drops in Search traffic underpins the steps below.

1. Open the Performance report. In Search Console, go to Performance, then Search results. Tick Total clicks, Total impressions and Average position above the chart.

2. Look at the long view first. Set the date range to the last 16 months so you can see whether a dip happens every year at this time. Many businesses have seasonal patterns they've never noticed.

3. Compare like with like. Use the Compare tab. Compare the days since 24 September with the same number of days immediately before, and with the same dates last year. The most recent day or two in Search Console can be incomplete, so don't read too much into them.

4. Keep the search type consistent. Also from 24 September, Search Console splits Web results into "Text-based" and "Multimodal". The multimodal view covers searches that start from an image, such as Google Lens. This is a reporting change and has nothing to do with the spam update. Multimodal data has no earlier history to compare against, so make sure both periods use the same view.

5. Read the pattern. A few rules of thumb from Google's guidance:

• If impressions hold steady but clicks fall, the issue may be how your result appears, such as your title and snippet, or other sites showing more appealing results.
• A small slip, such as position 2 to 4, is normal and can reverse without you doing anything. Google recommends avoiding radical changes to pages that are already performing well.
• A large drop out of the top results across a wide range of searches is the point where Google suggests assessing your whole site against its helpful, people-first content guidance.

6. Find out where the change is. Open the Pages tab and sort by clicks difference. This tells you whether the drop is site-wide, affects a group of pages, or is concentrated on one important page. For a site-wide drop, check the Page indexing report. For a group of pages, inspect a few with the URL Inspection tool.

7. Check whether demand changed. Filter to your top queries one at a time and look them up in Google Trends to see whether interest fell across the web, not just for you.

8. Check the two reports that give definite answers. Open Manual actions and Security issues in Search Console. A spam update is automated, so it won't produce a manual action. If either report shows a problem, though, you have a clear lead to follow.

What you can't conclude. A fall since 24 September does not prove the spam update affected you. Google lists many other causes of traffic drops, including technical issues, security problems, seasonality, changing search interests, site moves and reporting glitches. Competitors improving their pages and wider changes to how Google displays results can also shift your clicks. We covered how to separate real drops from noise in our guide to Google search volatility in August 2026.

My website traffic dropped after 24 September. What should I do?

Diagnose before you change anything. Work through these steps in order:

1. Confirm the drop is in Google organic search. Check Search Console, not just your analytics tool, since tracking problems can look like traffic loss.
2. Rule out technical causes. Check the Page indexing report and think about anything that changed recently: a redesign, new plugins, migrated URLs or a stray "noindex" tag.
3. Check Manual actions and Security issues.
4. Identify the affected pages using the Pages tab comparison.
5. Review those pages honestly against Google's spam policies. Are they thin, duplicated, or written mainly to rank rather than to help a customer?
6. Fix clear problems, but don't mass-delete or rewrite. Removing dozens of pages because rankings wobbled for a few days can do more harm than good.
7. Re-check after Google confirms the rollout is complete. Google says that if a site makes changes, it can take months for its automated systems to learn that the site now complies with its spam policies.

What if my website or content was created using AI?

Many small businesses now use ChatGPT, Claude, Gemini or AI website builders, and that isn't a problem in itself. What matters is the quality of what's published. Use this quick audit on your key pages:

• Accuracy. Are prices, opening hours, services, qualifications and any legal or regulatory statements correct?
• Usefulness. Would a customer learn something here they couldn't get from any competitor's page?
• Originality. Does the page include things only you know, such as your process, real examples, photos of your work or local detail?
• Duplication. Do you have many near-identical pages, such as "[service] in [town]" repeated for 20 towns with only the place name changed?
• Repetition. Do the same generic phrases appear across page after page?
• Freshness. Is anything out of date, like old offers, discontinued services or last year's prices?
• Purpose. Would you still publish this page if Google didn't exist?
• Hidden details. Google's AI guidance also asks for accuracy in page titles, meta descriptions, structured data and image alt text when content is generated automatically, because these can appear in search results.

If your whole site was built with an AI tool, there are separate questions about security, forms and maintenance. We cover those in Vibe Coding vs Real Engineering.

5 things small businesses should check this week

1. Open Manual actions and Security issues in Search Console. It takes two minutes, and anything listed there needs dealing with regardless of the update.
2. Run a like-for-like comparison in Search Console. Use the same search type, equal date ranges either side of 24 September, and a year-on-year check for seasonality.
3. Search Google for site:yourdomain.co.uk and scroll through the results for pages you don't recognise, such as casino, pharmacy or foreign-language pages. These can be a sign of hacking. While you're there, check comment sections and any user-submitted areas for spam.
4. Review your most templated pages. Look especially at location pages and any content produced in bulk, by AI or by a previous supplier. Merge, improve or remove pages that add nothing.
5. Make a note of 24 September in your reporting, and look again once Google's dashboard confirms the rollout has finished.

Should I change my website while the spam update is still rolling out?

Fix obvious problems now. Hold off on large changes until you have better evidence.

Obvious problems include hacked pages, comment spam, accidental "noindex" tags and pages you already know are thin or copied. These are worth fixing whatever the update does. Rewriting your whole site or deleting large sections because of a few days of movement mid-rollout is a different matter. You risk making changes you can't evaluate properly, and Google notes there's no guarantee any change will produce a noticeable effect in search results. Once the rollout completes, compare equal periods again and decide from there.

Need help checking whether your website has been affected?

If you'd like a second pair of eyes, Harri Digital can review your Search Console performance, indexing, technical SEO and content quality, and flag anything that could raise spam policy concerns. We'll give you a straight answer, including when the answer is "wait and see".

For a quick starting point, run a free check on your site. It scores speed, search basics, AI readiness, and accessibility and trust. It can't tell you whether a Google update affected you, because that needs your Search Console data. It will show you technical issues worth fixing either way. You can also request a free review by a person, or read more about our SEO and marketing support.