Google’s September 2026 Spam Update: What It Was, and a Checklist for Local Business Sites

What Google actually confirmed

The Search Status Dashboard entry is short. The rollout began September 24 at 9:15 a.m. Pacific, applied globally and to all languages, and was marked complete on October 8. That is almost two weeks, long for a spam update. For comparison, the March 2026 spam update finished in under a day, and the August 2026 spam update in under three.

That is the whole official record. The incident notes do not say which spam policy the update focused on, and Search Engine Journal’s completion report notes the same. Anyone telling you exactly what this update “targeted” is guessing.

The 2026 update calendar, so you can line up your own data

If your traffic dropped this year, the first job is to match the date to an event. These are the confirmed 2026 core and spam updates, from Google’s dashboard (Pacific time):

• March 2026 spam update: March 24 to March 25
• March 2026 core update: March 27 to April 8
• May 2026 core update: May 21 to June 2
• June 2026 spam update: June 24 to June 26
• August 2026 spam update: August 18 to August 21
• September 2026 spam update: September 24 to October 8

Open Search Console, go to Performance, set a custom date range that straddles one of these windows, and compare clicks and impressions for your most important pages, not just the site total. A drop that starts inside a window and does not bounce back within a couple of weeks is worth taking seriously. A drop that starts on a random Tuesday usually has a more ordinary cause, like a site change, a lost listing or a new competitor.

Why “still getting impressions” does not mean you are fine

A common pattern after an update: Search Console still shows impressions for your main keyword, but you cannot find yourself when you search. Both can be true. Impressions are counted when any of your URLs appears anywhere a person could have seen it, including deep pages of results, image results, or a link inside an AI Overview. Average position blends all of that together. Filter the Performance report by query and by page, and look at where each URL actually sits, before you decide whether you were hit.

The seven-point checklist for a local service business site

Google’s spam policies page was last updated August 28, 2026. These are the parts that most often match what small local business sites actually do. Work down the list on your own site.

1. City pages that are the same page. Google defines doorway abuse as sites or pages “created to rank for specific, similar search queries.” A set of city pages where only the town name changes is the classic local version. Read two of yours side by side. If they still make sense with the city names swapped, they are the same page. Our doorway page test and similarity checker walks through it.
2. Pages in places you do not really serve. A Denver plumber with a page for a city two states away is easy for a reader to see through, and easy for a classifier too. Keep pages for places you can show real work in.
3. Several pages chasing one phrase. “Plumber Denver,” “Denver plumbing company,” “best plumber in Denver” and “Denver plumbing services” as four separate pages with near-identical content is the same pattern pointed at one city. One strong page usually beats four thin ones.
4. Pages made in bulk. Google defines scaled content abuse as “many pages” generated mainly to manipulate rankings, however they were made. Fifty AI-written “service in suburb” pages published in a week is the shape to avoid.
5. Link swaps and partner pages. The link spam policy names “excessive link exchanges” and partner pages that exist only for cross-linking. If you own several websites, or you trade links with other local businesses, look at how many of those links sit in a footer or sidebar on every page.
6. Hosted content that is not yours. The policy now called the site reputation policy covers third-party content published on a host site mainly to borrow that host’s ranking signals. If you rent out a corner of your site to someone else’s coupons or reviews, take a hard look at it.
7. Review claims you cannot back up. Star ratings in your page code should match reviews a visitor can see on that page. A “5.0 from 47 reviews” badge with no reviews on the page invites a structured-data problem.

What recovery looks like

Google’s own guidance on spam updates is blunt. Sites that see a change should review the spam policies, and making changes “may help a site improve if our automated systems learn over a period of months” that the site complies. For links, it goes further: any ranking benefit those links gave you “cannot be regained.”

In practice that means three things:

• Fix, then hold still. Rewriting titles, adding and removing pages, and switching pages between indexed and noindexed week to week makes it harder for Google to see a stable, compliant site. Make the changes in one considered pass and then leave the site alone to be re-evaluated.
• Do not chase the update with more links. If links were part of the problem, more of the same will not replace what was discounted.
• Keep the business signals strong. Your Google Business Profile, your reviews and your phone calls do not depend on one organic ranking. They keep paying while the website recovers.

What not to conclude

Not every drop in late September was this update. Seasonal demand shifts in fall for many service categories (we wrote about when Denver customers actually search). Competitors publish, Google tests new layouts, and AI answers take clicks without changing your rank. Line up the dates first, check the checklist second, and only then decide whether the site needs surgery.

If you want a second set of eyes, our free audit covers the checklist above, your Google Business Profile and what AI assistants say about your category.

Keep going