Google has finished rolling out the September 2026 spam update. It started on September 24 and the Google Search Status Dashboard marked it complete on October 8: almost 14 days. The three previous spam updates this year (March, June and August) took between one and three days.

If your rankings have been jumping up and down for no obvious reason, you are not imagining it. Here is what happened, how to tell whether it really affected you, and what to do, with data we measured ourselves.

What a spam update is

It is an update to the automated systems Google uses to detect sites that break its spam policies, including SpamBrain. It does not reward anyone: it demotes or removes pages Google considers spam. So if your site follows the rules, in theory you do not need to do anything.

This one rolled out worldwide and in every language. Google did not say which kind of spam it targeted or what share of searches it affected.

Why this one was different

Length. About 13 days and 16 hours, versus 1-3 days for the March, June and August updates. It is the longest spam update of 2026.
Waves. Search Engine Roundtable reported strong movement on September 25-27, September 30 and October 4-6. Google has not confirmed those dates, but they match what we saw in our own measurements.
More manual actions. Several SEOs reported an increase in manual actions over the same weeks, which suggests a wider push against spam beyond the algorithm.

A real example: same search, two different results

This is what is confusing local businesses the most. We repeatedly ran the same search, "abogado penalista murcia" (criminal defense lawyer, Murcia), from Murcia, Spain, for a local criminal defense law firm.

On October 5, in the middle of the rollout, the same search returned up to four different versions of the results page. Some did not even look local: LinkedIn profiles, job listings and results from other towns.

On October 12, four days after Google declared the update complete, we ran 12 identical searches (8 on desktop, 4 on mobile). The junk versions were gone, but two versions still alternated almost evenly:

Version A: the firm ranks #10, and Google shows one of its inner pages (personal injury), not the homepage.
Version B: the firm ranks #7, and Google shows the homepage.

Same day, same search, same place, and a three-position difference plus a different landing page depending on which version you get. The firm had not changed anything on its site.

If you are tracking your rankings right now, do not draw conclusions from a single check. A drop from #7 to #10, or Google switching which of your pages it shows, may just be the version of the results you happened to get.

What real users saw

Was that instability just an artifact of measuring with automated tools? To check, we looked at the same firm's Search Console data, which reflects searches made by real people. This is its average daily position on Google during the update:

September 27 to October 1: steady, between 8.0 and 9.1.
October 2 to 5: it drops to 11.2, 14.0, 14.5 and 13.6, matching the update's waves of impact.
October 6 to 10: it gradually recovers: 11.1, 12.1, 9.9, 8.9 and 9.4. Google declared the update complete on the 8th.

The drop was real and users saw it. Once the rollout ended, the site's average position moved back close to where it was, without the firm changing anything. Even at the worst point, clicks did not collapse: 455 in the week of October 4-10 versus 524 the week before, 13% fewer, part of which may simply be normal week-to-week variation.

Careful, though: a site's average returning to normal does not mean Google has settled. As you will see below, results are still changing from one search to the next. If your business is going through something similar, the sensible move is not to change anything yet.

Directories are affected too

It is not only your website's rankings. When searching Google for a business's listing inside a business directory, the same query repeated nine times on October 11 found the listing only twice. The listing existed the whole time.

That means that, for a few weeks, any tool relying on "what Google shows right now" can give you results that change from one day to the next. In RankuTracker, the NAP Audit now remembers the listings it has found and checks them directly instead of searching for them again every time.

How to tell whether the update really hit you

Look at Search Console, not just rankings. Compare clicks and impressions for the rollout weeks (September 24 - October 8) with the weeks before. If rankings move but clicks hold steady, you were probably not penalized.
Break it down by page and by query. A drop concentrated in one type of page (for example, all your "service + city" pages) tells you far more than an across-the-board dip.
Check for manual actions. In Search Console, go to "Security & Manual Actions" → "Manual actions". If Google penalized you by hand, it says so there explicitly.
Rule out other causes. A recent site change, a technical problem, seasonality or a competitor improving can also explain drops.
Measure more than once. As the example above shows, one search is not enough while Google keeps serving different versions.

In RankuTracker you can connect Search Console and see the real clicks and impressions for each keyword next to its position in RankTracker, so you can tell a harmless ranking wobble from a real traffic loss.

What kind of practices it targets

Google documents concrete examples in its spam policies. These are the most common:

Scaled content with no value. Producing dozens or hundreds of near-identical pages, by hand or with AI, just to rank. In local SEO the typical pattern is "plumber in [neighborhood]" pages that only swap the neighborhood name.
Site reputation abuse. A trusted site hosting unrelated third-party content to borrow its rankings. The classic case is coupon or betting sections inside news sites.
Expired domain abuse. Buying a domain with history and filling it with off-topic content to inherit its authority.
Link spam. Buying links or exchanging them at scale.
Hidden or deceptive text, and pages that show Google one thing and users another.

What's new: fake authors and AI content

In early October Google also updated its helpful content guidance:

It focuses on the main content: whatever actually helps the page do its job (text, images, tools, reviews…), judged on effort, originality, skill and accuracy.
It warns that fake author profiles (AI-generated headshots, invented names, credentials that don't exist) count as deception.
It asks publishers to manually review AI-generated content before publishing it, including titles, descriptions, structured data and image alt text.

For a local business that is good news: your real reviews, real photos and real experience are exactly the kind of content Google says it values.

What to do if you lost visibility

Don't rebuild your whole site in a hurry. Rankings are still settling, and big changes now make it impossible to know what worked.
Fix, don't disguise. If you have repetitive or thin pages, improve or remove them. If you have bought links, stop.
If you have a manual action, fix the problem and submit a reconsideration request explaining what you changed.
Be patient. Recovery after a spam update is not immediate (more on that below).
Look after your Google listing. In local searches the map depends mostly on your Google Business Profile: reviews, photos, category and consistent details across directories.

How long recovery takes

If your site lost rankings because it broke the policies, fixing it does not give you your position back the next day. Google puts it this way in its spam updates documentation: changes may help a site improve if its automated systems learn over a period of months that the site now complies.

There is one important exception: link spam. If your rankings relied on bought or exchanged links, Google warns that any benefit those links gave you is lost and cannot be regained. Removing them avoids bigger problems, but that boost does not come back.

Google still hasn't settled

Google declared the update complete on October 8, but results have not recovered: volatility is still very high. Two examples we measured after that date:

October 12, "abogado penalista murcia". In 12 identical searches from Murcia, the first firm was still alternating between position 7 (with its homepage) and position 10 (with an inner page), almost evenly.
October 13, "abogado penal murcia". Another law firm in Murcia: in 6 identical desktop searches, it ranked first or second in three of them and was not even in the top 50 in the other three. On mobile it did not appear in the top 50 either.

In other words, depending on which version of the results you get, the same firm is either at the very top or gone. Both cases share the same pattern: one version of the results page favors local firms, and another, more generic one, buries them.

This affects every rank tracking tool equally: they all query the same Google, so if Google serves different versions, all of them will see that variation. Until things settle, trust the trend across several checks and your real Search Console clicks more than any single position.

Is a core update coming?

There is speculation in the SEO community: the last core update started on May 21, almost five months ago. Google has not confirmed anything. It is a good moment to review the quality of your content and keep an eye on traffic.

The bottom line

The September 2026 spam update was the longest of the year, and as of October 13 Google's results still have not settled, even though Google considers it complete. If your site follows the rules, it most likely did not penalize you, even if your rankings moved around. Before you change anything, measure more than once, look at your real clicks, and check whether you have a manual action.

Sources: Google Search Status Dashboard, Google's spam updates documentation, Search Engine Journal, Search Engine Roundtable. The Murcia measurements are our own, taken on October 5, 11, 12 and 13, 2026; the position and click data come from the same firm's Search Console (September 27 - October 10).

Google's September 2026 Spam Update: What Changed and What to Do If Your Local Business Dropped