Is your website at risk from Google's September 2026 spam update?

For most businesses, no. Google's September 2026 spam update has been rolling out since 24 September 2026, it adds no new rule, and it aims at sites already breaking Google's published spam policies — the same systems sharpen, they do not widen. Google says the update applies globally and to all languages, and gave it a window of up to two weeks, so movement will continue into early October. No target, no industry and no share of searches affected was disclosed.

Summary

Google's Search Status Dashboard opened the incident at 09:15 US Pacific time on 24 September 2026, noting the rollout may take up to two weeks to complete.

It is the fourth spam update of 2026, after March, June and August. The first three finished in 19 hours 30 minutes, 2 days 1 hour and 2 days 16 hours respectively, and the August 2025 spam update took 26 days 15 hours. Two weeks from 24 September points to about 8 October.

The cost to sites that are not the target is measurable. SE Ranking found that during the August 2026 update, 16.71% of URLs which had ranked in the top 10 fell beyond position 100 for the same keyword, against 9.2% in a quiet period — an 82% increase (Search Engine Land, 27 August 2026).

In Singapore, IMDA's Singapore Digital Economy Report 2025, released on 6 October 2025, found AI adoption among SMEs more than tripled in a year, from 4.2% in 2023 to 14.5% in 2024.

In short

Google's September 2026 spam update began on 24 September 2026 and may take up to two weeks to finish, so about 8 October is the outer limit.
It is the fourth spam update of 2026 and introduces no new policy — it enforces ones that were already published.
In the August 2026 update, 16.71% of top-10 URLs dropped beyond position 100, against 9.2% in a quiet period.
Google disclosed no target, no industry and no share of queries affected; sites that see a drop are told to review its spam policies.

What Google actually announced

The whole announcement is two sentences long: the September 2026 spam update applies globally and to all languages, and the rollout may take up to two weeks. There was no blog post, no new policy and no list of targets — Google Search Central's post on LinkedIn called it a normal spam update.

What it enforces is already written down. Google's spam policies describe spam as techniques used to deceive users or to manipulate its search systems into featuring content prominently, and that now explicitly includes attempts to manipulate generative AI answers in Search. The list covers scaled content abuse, doorway abuse, scraped content and site reputation abuse, and Google warns a correction can take months to register once its systems demote a site.

The two-week window is the real change

Each of the year's three previous spam updates was expected to take a few days and finished inside three. This one carries a fortnight, so a drop on any single day is hard to attribute: Search Engine Roundtable recorded waves of movement on 25 to 27 September and again on 30 September, both inside the stated window. Google has not said how many searches are affected.

Which policies catch an ordinary business site

Most small business sites are not the target, but two policies catch firms that did nothing dishonest. Scaled content abuse is generating many pages mainly to manipulate search rankings rather than help users, and Google names generative AI tools as one way that happens — about volume and intent, not about whether a machine helped you write. Doorway abuse covers near-identical pages aimed at different suburbs or service names that funnel visitors to a single page.

Thin affiliate pages and hidden text sit in the same list. AI-assisted writing is not itself a violation; manufacturing fifty pages nobody needed is.

What to check in the next fortnight

Wait until Google marks the rollout complete on the dashboard before reading anything into a bad week. Then compare the seven days before 24 September with seven days after the finish date in Search Console, look at impressions before clicks, and sort by page rather than site total: this is a page-level event far more often than a whole-site one.

If a page has moved, read Google's spam policies against it rather than rebuilding the site. There is no reconsideration request for an algorithmic demotion: the fix is the correction itself, and the systems re-assess over months.

Where Singapore fits

Nothing here is Singapore-specific: the rollout covers every country and language, so a site here is judged by the same policies as one in Germany. The local relevance is volume. IMDA's report put AI adoption among SMEs at 14.5% in 2024, up from 4.2% in 2023, with larger firms at 62.5% — cheap publishing tools now sit in most small firms' hands, which is the condition the scaled content policy was written for.

One figure worth keeping in proportion: SMEs using AI-enabled solutions under the Productivity Solutions Grant reported average cost savings of 52% in 2024, from the same IMDA release. Efficiency is not the risk; publishing without a reader is.

Our take

We think the alarm is louder than the update. Google changed no rule and named no target; the sites at risk were already breaking a published policy. If your site is a normal business site with a handful of pages you update when something changes, the most likely outcome of this fortnight is nothing at all.

Where we are unconvinced is the reporting that follows. A two-week rollout with no stated target means any wobble this month will be blamed on it, and some of that will be ordinary churn. We would rather a client wait for the completion note than act on one bad Tuesday.

The habit worth keeping is a dull one: publish fewer pages, each with a reason to exist, and use AI to say a thing clearly rather than fifty times. If you want one action this month, open your thinnest pages — written for a search term rather than a customer — and improve them or take them down.