Google's September 2026 Spam Update Is Complete: What to Check Now

On 8 October 2026, Google’s Search Status Dashboard posted a short completion notice for its September 2026 spam update: “The rollout was complete as of October 8, 2026.” The update had been released on 24 September at 09:15 Pacific time, and Google said it “applies globally and to all languages”. That includes Arabic and English results in Saudi Arabia, the UAE, Qatar, Egypt and the rest of the region.

It was Google’s fourth spam update of 2026 and the third since June. The rollout is over, so site owners now have a clean window of data to compare against the period before 24 September. This piece covers what Google has confirmed, what it has not, and how to work out whether a change in your traffic has anything to do with the update.

What Google has confirmed

The confirmed facts are few, and they all come from the dashboard incident and Google’s own documentation:

The dashboard history also puts the update in context. In 2026 Google has listed a February Discover update (5 February), a March spam update (24 March), a March core update (27 March), a May core update (21 May), a June spam update (24 June), an August spam update (18 to 21 August) and now the September one. The June and August updates each took two to three days. The September update ran for nearly two weeks, which is a longer window to account for when you read your reports. At the time of writing, no core update has been listed since the one that began on 21 May.

What Google has not said

Google did not say what the September update targets. The incident gives no policy name, no type of site and no example. Its spam updates page describes these updates in general terms only: Google occasionally makes “notable improvements” to its systems that detect spam, and calls those improvements a spam update.

Many SEO blogs and rank-tracking tools have published charts of volatility during the rollout. Those are third-party readings of their own keyword samples, not statements from Google. They may help you see whether search results in general moved on a given day. They cannot tell you why your site moved, and they rarely track Arabic queries in Gulf or Egyptian markets in any depth. Treat any article claiming the update “hit” a particular tactic as an opinion until Google says otherwise.

How to tell whether the update affected your site

Google’s guide to debugging drops in Search traffic lists several possible causes besides ranking updates: technical problems, security issues, spam issues, seasonality, site moves and reporting glitches. Before you link a drop to the spam update, rule the others out. The steps below follow Google’s method, set against the update’s dates.

1. Set the comparison windows. In Search Console’s Performance report, use the Compare option. Set a period starting 9 October against an equal period ending before 24 September. Leave out the rollout window itself, because rankings may have shifted from day to day while the update was rolling out.
2. Look at clicks and impressions together. Google notes that if impressions held steady while clicks fell, the cause is more likely your titles or snippets than your rankings. If impressions fell as well, a ranking change, including one from an update, becomes a more likely explanation.
3. Widen the range to 16 months. This shows whether the same dip happened at the same time last year. Late September and early October include public holidays in the region, along with the end of the summer slowdown. Saudi National Day falls on 23 September, the day before the rollout began, so keep it out of your “before” window. Egypt’s Armed Forces Day marks 6 October, but in 2026 the government moved the public holiday to Thursday 8 October, the same day the rollout completed. Holiday dates can shift from year to year, so check the official announcement for each year you compare. Seasonal demand can produce a curve that looks like an algorithm change.
4. Break it down. Compare by page, query, country and device. A drop limited to one country, such as Saudi Arabia only, or to one language folder points to a different explanation than a site-wide fall.
5. Check the Manual actions and Security issues reports. A manual action is a separate process: Google issues it when a human reviewer finds pages that do not comply, and it appears in the Manual actions report. A hacked WordPress site can lose clicks through warnings shown to users, whether or not an update is running.
6. Check Page indexing for site-wide drops. If everything fell at once, rule out technical causes such as robots.txt errors, server downtime or a theme or plugin change made during the same weeks.
7. Compare against Google Trends. Filter your main queries in Arabic and English and check them in Google Trends. If interest fell across the web, the cause is outside your site.

If none of these explains the change and the timing matches the rollout, the update becomes a reasonable explanation. Even then, Google’s guidance is to review your site against its policies, not to guess at what the update was aimed at.

If the timing matches: review against the spam policies

Google’s spam updates page says that sites which see a change after a spam update “should review our spam policies to ensure they are complying with those.” The spam policies list practices such as cloaking, doorway abuse, expired domain abuse, hacked content, hidden text and link abuse, keyword stuffing, link spam, scaled content abuse, scraping, breaches of the site reputation policy, sneaky redirects, thin affiliation and user-generated spam. Google says it detects violations “both through automated systems and, as needed, human review”.

For B2B and service companies in the region, a few of these deserve a closer look, because they tend to come from ordinary marketing decisions rather than deliberate spam:

For example, a contracting company that published one page per Saudi city, each with the same text and a different heading, may want to replace them with a single strong service page and a few genuinely local project pages. That is a content decision your team can make whatever any update did. Our earlier piece on Google’s guidance on AI-generated content covers the scaled-content risk in more detail.

What recovery looks like, according to Google

Google sets expectations plainly. On the spam updates page it says changes “may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies.” There is no button to press and no guaranteed date.

Link spam is a special case. Google says that when its systems remove the effect of spammy links, “any ranking benefit the links may have previously generated for your site is lost,” and those benefits “cannot be regained.” Making changes in that case “might not generate an improvement.” This is Google’s general guidance on link spam; it has not said the September update concerned links. If part of your past visibility came from bought links, expect to rebuild it through content and genuine mentions rather than to win it back.

A manual action works differently. It is reported in Search Console, and once all the listed issues are fixed you can request a review from that report. If no manual action is listed, you are dealing with automated systems, and the only path is to bring the site into line with the policies and wait.

What to do this month

• Record the dates. Add 24 September and 8 October 2026 to your marketing calendar or reporting dashboard, so later traffic reviews account for them.
• Run the comparison once, properly. Use the steps above and write down the result, even if it shows nothing changed. No change is a valid finding.
• Do not make panic changes. Deleting large parts of a site, changing URL structures without redirects or swapping themes in response to a chart on social media can cause more damage than the update did.
• Fix policy risks whether or not you lost traffic. Thin city pages, unreviewed translations and paid links are worth cleaning up before the next update, and Google has run three spam updates since June.
• Ask your agency what it did. If an outside provider handles your SEO, ask for a written list of links built and content published in the past year. You should be able to see where every link came from. Our guide to choosing an SEO agency lists the other questions worth asking.

For a fuller list of what a review should cover, see our technical SEO audit checklist; RX’s SEO and search visibility work runs that audit on both the Arabic and English versions of a site. If the review points to structural problems, such as duplicated location pages or a site your team cannot maintain, the fix is usually a website project rather than more SEO work.