Insights

Google ran four spam updates and three core updates in a year

Mari Luukkainen

1 Oct 2026

5–7 min read

Google started the September 2026 spam update on Thursday 24 September at 9:15 California time, which was 19:15 in Helsinki. It is the fourth spam update this year, and a week later it is still rolling out. The dashboard notice is two sentences: the update “applies globally and to all languages” and the rollout “may take up to two weeks to complete.”

I build programmatic SEO sites for clients and for myself, so every spam update is partly about me.

What we know about September

Almost nothing official. Google called it “a normal spam update”, named no target and announced no new policies. John Mueller confirmed the longer rollout on Bluesky: “it’s likely to take longer than some of the previous ones.”

The rank trackers saw it anyway. Barry Schwartz at Search Engine Roundtable put Semrush, Mozcast and the other sensors on one chart, and most of them spiked from Friday 25 to Sunday 27 September. SISTRIX US, Algoroo and Similarweb barely moved. Glenn Gabe and Lily Ray both report drops on sites with lots of templated, programmatic, probably AI-written pages. That is their reading. Google has confirmed nothing.

I found no tracker data for Finland. The readings above are from the US and Germany.

What August hit

Google called August a normal spam update too, so the only way to see what it did is to look at who fell. Glenn Gabe published four cases on 31 August:

A YMYL site, meaning a topic where bad information can hurt the reader’s health or finances, lost rankings for over 200,000 queries. Programmatic pages with AI text added.
An Amazon affiliate site lost over 14,000 queries. Fully automated, and the text at the bottom of its pages scored 97%+ in an AI detector.
A site with over 1.5 million indexed URLs, about 85% of them programmatic.
A site with 250,000+ URLs that redirected visitors to other risky sites. It dropped or lost rankings for close to 25,000 queries.

A template alone did not sink any of them. Each one paired scale with thin, AI-written or deceptive pages. In the third case, 85% of 1.5 million is roughly 1.3 million pages that probably exist because a spreadsheet had a row.

The test I run on my own sites is simple. Would this page exist if Google did not? If it answers something a customer actually asked, it stays. If the only reason it exists is a search volume column, it is the first page I would delete.

Every update of the past year

Google’s Search Status Dashboard lists eight ranking updates since the start of October 2025: three core updates, one Discover update and four spam updates. No reviews update, no helpful content update, no link spam update. Dates are Google’s, in Pacific time.

December 2025 core update: 11 to 29 December, 18 days.
February 2026 Discover update: 5 to 27 February, 21 days 17 hours. English-language users in the US only. Google said it would expand to other countries and languages, and I could not find any confirmation that it has.
March 2026 spam update: 24 to 25 March, 19 hours 30 minutes.
March 2026 core update: 27 March to 8 April, 12 days.
May 2026 core update: 21 May to 2 June, 11 days 21 hours.
June 2026 spam update: 24 to 26 June, 2 days.
August 2026 spam update: 18 to 21 August, 2 days 16 hours.
September 2026 spam update: started 24 September, still rolling out. Google’s estimate is up to two weeks.

Spam updates got slower during the year while core updates got faster. Core updates went from 18 days to about 12. The first three spam updates of 2026 finished in under three days each, and September got two weeks from the start. Nobody outside Google knows why. We will know more by 8 October, when the two-week window runs out.

This list is only what Google announced. In December Google added a line to its documentation saying it also makes smaller core updates it does not announce. Search Engine Roundtable reported ranking volatility almost every month of the year, and Google confirmed none of it.

Policy changes worth knowing

13 April: “back button hijacking” became an explicit spam policy violation, meaning a page that stops you from going back to where you came from. Enforcement started 15 June.
7 May: Google stopped showing FAQ rich results in Search. Your FAQ markup no longer puts questions in the result.
15 May: the spam policies now also cover Google’s AI answers. Manipulating those counts the same as manipulating regular results.
30 August: site reputation abuse manual actions stopped affecting results shown to people in the EEA. Google said this followed “discussion with the European Commission”.

The last one matters for Finland. Site reputation abuse is when a big trusted publisher rents a folder to someone selling casino reviews or coupon codes, and the folder ranks on the publisher’s name. A penalized section like that can now rank for a searcher in Helsinki and stay buried for a searcher in New York. For the EEA, Google says the section may be separated in its systems so that “over time, it ranks independently from the rest of the site.”

If you are a Finnish publisher with a partner section, this is not permission. The manual action still shows in Search Console, outside the EEA nothing changed, and the algorithmic spam updates still apply everywhere.

What I would do this week

Don’t change anything until September is done. Google marks it complete on the dashboard. Changes made in the middle make your own data impossible to read afterwards.
Compare per template, not per site. In Search Console, take 14 days before 24 September against 14 days after the rollout ends, and split by page type: templated pages, blog, service pages. If one group dropped and the rest held, you know where to look. Search Console also got a new multimodal search type filter around the same time, so check you compare the same search type in both periods.
Count your ratio. How many indexed URLs came from a template, and how many of those got zero clicks in the last 90 days. That number tells you more than the traffic chart.
Plan for months. Google’s documentation says a site can improve “if our automated systems learn over a period of months” that it complies. For link spam it is worse: “Any potential ranking benefits generated by those links cannot be regained.”

I will look at my own Search Console when Google marks September complete, and write it up here if something moved.

Sources: Google Search Status Dashboard, Google on spam updates, Google spam policies, Search Central changelog, Google on the site reputation policy change, Google on the February Discover update, Search Engine Roundtable on the August update, 24 September and 28 September, Glenn Gabe’s August case studies.

Mari Luukkainen

Slop Cannon

Ex-VC, full-time builder. Personal record: 349 GitHub commits in one day. Find me on GitHub and at mariluukkainen.com.