Google started rolling out its September 2026 spam update on 24 September 2026, the fourth spam update this year and the second in just over five weeks, according to the Google Search Status Dashboard. Search Engine Journal reports that Google says the update applies globally and to all languages and may take up to two weeks to complete. Google has given no detail on which spam tactics it targets.
For a UK small business doing its own marketing, that last point is the one that matters. Nobody outside Google knows exactly what this update is aimed at, so the useful question is not "what is Google targeting?" but "which of the things I have done to my own website could look like spam to an automated system?" This analysis works through that question with a checklist, a worked example and a plan for the next week.
What exactly did Google announce on 24 September?
The Search Status Dashboard lists the September update alongside the August 2026 spam update (18 August, 2 days and 16 hours), the June 2026 spam update (24 June, 2 days and 1 hour) and the March 2026 spam update (24 March, 19 hours and 30 minutes). The same dashboard shows two core updates this year, in March and May. Search Engine Journal notes that Google gave no specifics about which tactics are in scope.
The two week window is notable. The three earlier spam updates this year each finished in under three days. A longer stated window does not prove this one is bigger, but it does mean rankings could keep shifting into October, so any judgement made this week is premature.
What is a spam update, and how is it different from a core update?
Google's spam updates documentation explains that its spam detection systems run constantly, and that it calls it a spam update when it makes a notable improvement to how they work. It names SpamBrain as its AI-based spam prevention system and says it improves that system from time to time to make it better at spotting spam and to help ensure it catches new types of spam.
The practical difference for an owner is diagnosis. If a core update moves you down, the answer is usually "a competitor's page is more useful than yours". If a spam update moves you down, the answer is usually "something on your site matches a pattern Google classes as manipulation". The second is often more fixable, because you can find the pattern and remove it.
Which UK small businesses are most at risk from this update?
Most UK small businesses have never knowingly done anything spammy. The risk usually comes from work bought from someone else: a cheap SEO package from a few years ago, a web designer who "added 50 location pages for coverage", or a content subscription that published four generic posts a week without anyone reading them. Owners inherit these patterns without seeing them.
Reading Google's spam policies (last updated 28 August 2026) against a typical local business site, five policies stand out as the ones UK SMBs most often trip over:
- Doorway abuse, which explicitly includes "multiple domain names or pages targeted at specific regions or cities that funnel users to one page".
- Scaled content abuse, which includes "using generative AI tools or other similar tools to generate many pages without adding value for users", and applies "no matter how it's created".
- Link spam, including buying links, excessive link swaps, "low-quality directory or bookmark site links" and links in guest posts or press releases with optimised anchor text.
- Keyword stuffing, including "blocks of text that list cities and regions that a web page is trying to rank for", the classic "we cover Leeds, Bradford, Wakefield, Harrogate..." footer.
- Hacked content, where injected pages or hidden links sit on your site without your knowledge.
Is my business at risk? A UK owner's if/then checklist
Use this as a decision framework rather than a to-do list:
- If you have more than about ten town or area pages and the text on them is mostly identical, then rewrite the top five by enquiry value with real local detail, and consolidate or noindex the rest. Pages with no real local content are the clearest doorway risk.
- If you published more than a handful of AI-written posts in a month that nobody edited, then pull the list, keep the posts that bring traffic or enquiries, improve them with your own prices and examples, and remove or merge the rest.
- If you have ever paid for links, "SEO packages" with guaranteed backlinks, or directory bundles, then stop and do not buy more. Google's documentation says ranking benefits from spammy links cannot be regained once its systems remove them, so there is nothing to protect.
- If you have a service area footer listing twenty or more towns, then replace it with a short line naming your main area and a link to a single, useful coverage page.
- If your site runs on WordPress and has not been updated in the last six months, then search Google for
site:yourdomain.co.ukand look for pages you did not create, especially in other languages or about pharmacy, casinos or loans. Those are signs of injected content. - If none of these apply, then do not change anything because of this update. Making reactive edits mid-rollout mostly muddies your own data.
What does a spam hit cost a small business? A worked example
The numbers here are a hypothetical illustration, not data from any source. Swap in your own figures.
Take a plumbing and heating firm in West Yorkshire with 40 town pages written from one template. Say those pages bring 30 enquiries a month from organic search. The firm converts one in three enquiries into a job, and the average job is worth £280.
- Monthly revenue from those pages: 30 enquiries × 1/3 × £280 = £2,800.
- If the pages were treated as doorways and lost most of their visibility, say 70% of that traffic, the monthly loss is about £1,960.
- Google says improvement may come "over a period of months" after fixes. If it takes four months from fix to recovery, the total cost is roughly £7,840, plus the time spent fixing.
Now compare the cost of prevention. Rewriting the ten highest value town pages with genuine local proof, such as two recent jobs, one local review and access notes, is a few evenings of the owner's time. If you would rather pay a writer, assume a figure such as £80 a page for this example: ten pages is £800. Consolidating the other 30 into one strong coverage page is an afternoon.
The point is proportion. If your exposure is £500 a month, a quick cleanup is enough. If it is £3,000 a month, the rewrite pays for itself if it avoids even one month of lost visibility.
What should I do this week while the update rolls out?
A concrete plan for the next five working days:
- Day one: save a baseline. In Search Console, open the Performance report, set the date range to the 28 days before 24 September, and export pages and queries. You will need this to compare later.
- Day two: check for manual actions and security issues in Search Console. The spam policies note that human review "can result in a manual action", which appears there and is a separate problem from an algorithmic update.
- Day three: run the if/then checklist above. List every town page, every blog post from the past year, and every link-building service you have ever paid for.
- Day four: stop and fix. Cancel any link-building subscription. Remove or rewrite the worst ten pages. Delete a stuffed footer. Small, clean changes beat a panicked rebuild.
- Day five: strengthen what cannot be faked. Ask three recent customers for reviews, add real job photos to your Google Business Profile, and write one genuinely useful page from your own experience.
If you want a sense of how content work should be done without tripping scaled content rules, the trade-offs are set out in this comparison of AI content services and hiring a writer.
How do I tell whether this update hit my site or something else did?
Late September is a noisy time to read data. School term has restarted, some seasonal trades are winding down, and many owners change their websites before the autumn. That makes it easy to blame Google for a drop caused by something closer to home.
Three questions help separate the causes. First, does the drop line up with 24 September or later, or did it start earlier? Second, is it concentrated on a type of page, such as all location pages or all posts from one content batch, or spread across the site? Third, did you, your web designer or a plugin change anything in the same fortnight? If the answers are "earlier", "spread out" and "yes", look at your own changes first.
Also check that tracking is intact. A broken analytics tag after a website update looks like a traffic collapse in GA4 but will not show in Search Console clicks, which is why Search Console is the better source for judging an algorithm update.
What are the trade-offs if I delete or rewrite pages?
There is a real cost to overreacting. Some thin town pages do bring genuine enquiries, and removing all of them can lose business that was never at risk. On the other hand, keeping forty weak pages in the hope that Google does not notice is the exact bet spam updates are designed to lose.
A sensible middle path for a UK service business:
- Keep and improve pages that brought at least one enquiry in the past three months.
- Merge pages for neighbouring towns into one area page where the service is identical.
- Redirect removed pages to the nearest relevant page rather than leaving dead links.
- Let your Google Business Profile service area do more of the geographic work, since the profile, not a stack of thin pages, is what appears in the map results for local searches. There is more on this in local SEO services.
For AI-written content the same logic applies. Keep posts that answer questions customers ask, add your own experience to them, and retire the ones written only to fill a calendar.
Will Google keep releasing spam updates this often?
The Search Status Dashboard shows the August 2026 spam update on 18 August and the September one on 24 September, 37 days apart. Whatever the reason, the practical effect for owners is that each improvement to SpamBrain is another chance for an old shortcut to be caught, so the gap between using a tactic and paying for it is getting harder to predict.
The durable approach has not changed. Pages that show real work in real places, reviews from real customers, and links that exist because someone chose to mention you are what spam systems are designed to leave alone. Everything else is a bet against the next update.
The September 2026 spam update should finish within the next couple of weeks. Use the time to find your own risks, fix the biggest one, and judge the result on clean data once the rollout completes, rather than on this week's noise.
Google September 2026 Spam Update — FAQ
When did the Google September 2026 spam update start and when will it finish?
Google's Search Status Dashboard lists the September 2026 spam update as starting on 24 September 2026. Search Engine Journal reports the start time as 9:15 a.m. Pacific time, which was late afternoon on 24 September in the UK, and quotes Google saying the rollout may take up to two weeks. That puts the latest likely finish around the second week of October. Earlier spam updates this year finished much faster, the March one in 19 hours and 30 minutes, so the two week window is a ceiling, not a forecast. Judge your own site on data from after the dashboard marks the update complete, not on day to day wobbles during the rollout.
My traffic dropped this week. Does that mean I have been hit by the spam update?
Not necessarily. A dip in the last week of September can come from seasonality, a tracking fault, a competitor improving, or normal ranking movement. A spam update hit tends to look different: a sharp step down on a specific date that lines up with the rollout, often concentrated on a group of pages that share a pattern, such as all your town pages or all the blog posts produced in one batch. Compare the same pages in Search Console for the seven days before 24 September against the seven days after the rollout finishes, and check whether the drop is spread evenly or clustered. Clustered drops on pages that match a spam policy are the ones to act on.
Are location pages for each town I cover against Google's rules?
Location pages are not banned. Google's spam policies define doorway abuse as pages created to rank for specific, similar search queries that funnel users to a less useful destination, and they give the example of having multiple domain names or pages targeted at specific regions or cities that funnel users to one page. A page for each town is fine when each one carries something true and specific to that town, such as jobs completed there, local reviews, parking or access notes, or a named engineer who covers it. It becomes a risk when forty pages share the same text with only the town name swapped.
Can I still use AI to write blog posts for my business website?
Yes. Google's scaled content abuse policy targets many pages generated for the primary purpose of manipulating rankings, and it says this applies no matter how the content is created. Its examples include using generative AI tools to generate many pages without adding value for users. The test is value and intent, not the tool. An AI draft that you edit with your own prices, photos, job examples and opinions is a different thing from 200 unedited posts published in a month to chase keywords. If a batch of posts on your site would embarrass you if a customer read them, improve them or remove them.
How long does it take to recover from a Google spam update?
Google's own documentation says that making changes may help a site improve if its automated systems learn over a period of months that the site complies with the spam policies. So recovery is measured in months, not days, and it only starts once the problem is fixed. For link spam the picture is harsher: Google says any potential ranking benefit generated by spammy links cannot be regained once its systems remove their effect. That means if your rankings were propped up by bought links, the fix is to build genuine reasons for people to link to you and to strengthen your Google Business Profile, not to wait for the old positions to return.
