Google began rolling out the September 2026 spam update on 24 September at 09:15 PDT. Its statement on the Search Status Dashboard is short: the update "applies globally and to all languages" and "may take up to two weeks to complete". That puts the finish line as late as early October. If your organic traffic moves over the next fortnight, this is the first thing to rule in or out.
What is unusual about this one
It is the fourth confirmed spam update of 2026, after March, June and August. What stands out is the length of the window. According to Search Engine Journal, the earlier ones finished quickly:
March 2026: 19 hours 30 minutes.
June 2026: 2 days 1 hour.
August 2026: 2 days 16 hours (Search Engine Roundtable dates it 18 to 21 August).
A two-week estimate is not a guarantee it will take two weeks — Google often gives itself slack — but it is a much longer stated window than anything else this year. It also comes barely five weeks after the August update, so some sites will be absorbing two spam updates close together.
Google has not said what this update targets. Anything you read claiming it is aimed at a specific tactic is inference, not confirmation.
What a spam update is, and is not
Spam updates are improvements to Google's automated spam-detection systems, measured against its published spam policies. They are separate from core updates, which re-rank sites more broadly on quality and relevance. Practically, that means a drop during a spam update is more likely to be tied to a specific pattern on your site — scaled low-value pages, link schemes, doorway pages, hosted third-party content trading on your domain — than to a general quality judgement.
Google's standing guidance for sites hit by a spam update is to review its spam policies and fix what violates them. Search Engine Journal notes that improvements can take months to register as the automated systems recognise the changes. There is no quick recovery switch.
What SaaS sites should check now
Annotate 24 September. Mark the start date in your analytics and Search Console so any movement over the next two weeks is read in context rather than blamed on a deploy or a campaign.
Wait for the rollout to finish before judging. Rankings wobble mid-rollout. Watch the Search Status Dashboard for the completion note, then compare a full week after it against a full week before 24 September.
Audit programmatic pages honestly. Integration pages, "alternatives to X" pages, city or industry landing pages generated from a template — these are common in SaaS and useful when each page has genuinely distinct content. If hundreds of them differ only by a swapped noun, that is the pattern scaled-content policies are written about.
Look at what else lives on your domain. Partner content, guest posts and subdirectories you have let third parties use can drag down the whole domain if they break the rules.
Check your backlinks from the last year. If an agency or tool bought links on your behalf, find out now. Paid links that pass ranking signals are a spam policy violation.
Check manual actions. Search Console's Manual actions report is separate from algorithmic updates, but worth a look while you are in there.
If traffic drops
Separate the pages that fell from the ones that did not. If the losses cluster on one template, directory or content type, that is your lead. If they are spread evenly across the site, a spam update is a less likely cause than a technical problem or a wider demand shift — check indexing, crawl errors and any recent site changes before rewriting anything.
Do not mass-delete content in the middle of a rollout. Wait for completion, identify the pattern, fix or remove what is genuinely low-value, and give it time.
The bottom line
Google's September 2026 spam update started on 24 September and may run until early October, a much longer window than the March, June and August spam updates took. Google has not said what it targets. Note the date, wait for completion before drawing conclusions, and use the time to audit templated pages, third-party content and bought links — the places SaaS sites most often cross the line without meaning to.