From The SEO Playbook for 2027
Google's spam updates in 2026: four so far, one still rolling out
Google has run four spam updates in 2026, against one in 2025: March, June, August and September. The September 2026 spam update started on 24 September and had not been marked complete on 8 October. Google said it would take about two weeks to roll out, against the usual two days (Search Status Dashboard, read 2026-10-08 [Official]; Search Engine Roundtable, 2026-10-06 [News]).
| Update | Started | Finished |
|---|---|---|
| August 2025 spam update | 2025-08-26 | 2025-09-22 |
| March 2026 spam update | 2026-03-24 | 2026-03-25 |
| June 2026 spam update | 2026-06-24 | 2026-06-26 |
| August 2026 spam update | 2026-08-18 | 2026-08-21 |
| September 2026 spam update | 2026-09-24 | Not marked complete on 2026-10-08 |
The gaps are shrinking. Lily Ray counted "92 days from March to June, 55 from June to August, and 37 from August to September" (Substack, 2026-10-04) [Practitioner].
What they hit
Google says little about what any update targets. Its announcements state only that an update has started, that it applies globally, and how long the rollout may take. What is known about winners and losers comes from outside analysis:
- Templates and thin affiliates. Glenn Gabe's case studies of the August 2026 update include programmatic pages in a sensitive niche, a turnkey thin-affiliate site built from marketplace data, a 1.5-million-URL programmatic site hit across the whole domain, and a site using misleading redirects (GSQi, 2026-08-31) [Practitioner].
- Sites few would call spam. Marie Haynes noted that the August 2025 update hit sites that had published large amounts of content mainly for search (mariehaynes.com, 2025-10-20) [Practitioner].
The policies grew in 2026
- 15 May 2026: the spam policies were widened to cover attempts to manipulate AI responses in Search. Google's new guide to its AI features said the same day that writing content for every fan-out query to manipulate rankings is scaled content abuse (documentation changelog; AI optimisation guide, 2026-05-15) [Official].
- 13 April 2026: back-button hijacking became a spam violation, enforced from 15 June 2026 (documentation changelog).
- April 2026: Google's spam-report page says it may use a report to take manual action, and that the text of the report is sent to the site owner if one is issued (Report spam, updated 2026-04-23). In practice, a competitor's report can now start a review of your site.
The policies themselves target purpose, not volume: scaled content abuse is many pages produced primarily to manipulate rankings rather than to help users, however they are made (Spam policies, updated 2026-08-28).
Spam update or manual action?
A spam update demotes or drops pages and sites with no notification. A manual action is applied by a reviewer and appears in Search Console's Manual actions report with a reason, so it can be fixed and reconsideration requested (Google Search spam updates, updated 2025-12-10; Manual actions report, undated) [Official].
Before blaming an update, rule out your own side. The book's reading is that a sudden, site-wide drop is more often something that changed on the site than an algorithm: a stray line in robots.txt, a CDN bot setting (see whether Cloudflare is blocking Googlebot), a noindex carried over from staging [Our reasoning].
The disagreement: how long recovery takes. Glenn Gabe talks in months: recovery needs months of clean behaviour, typically at least several (GSQi, 2026-08-31). Marie Haynes, writing about core-update recoveries, was gloomier: recovery "generally takes a year or more of hard work", and may not come at all (mariehaynes.com, 2026-02-20) [Practitioner].
Google says only that a site that fixes the problem may improve once its automated systems learn, "over a period of months", that the site complies. And when its systems neutralise spammy links, any ranking benefit those links once gave is lost for good.
Source: Google Search Central, "Google Search spam updates", updated 2025-12-10.
Do this
- Mark the update dates on your traffic chart, with branded and non-branded queries as separate series.Done when: for each update you have noted whether non-branded clicks or impressions changed direction during or shortly after its rollout.
- Check Search Console's Manual actions and Security issues reports.Done when: both are checked and the result is written down with the date.
- Find templates that multiply without data. For each template, compare the number of pages with the number that receive impressions.Done when: every template with many pages and few impressions has a decision: add data, merge, or take out of the index.
- Check authorship and dates.Done when: every named person exists and did the work attributed to them, and every changed date reflects a substantial change.
- Search your templates for hidden text, prompts or markup aimed at AI systems, and for anything that interferes with the back button.Done when: none is found, or what was found is removed.
Where the book goes further
Chapter 11 explains each spam policy in plain terms, shows the four places where honest sites usually cross the line (templates that multiply faster than their data, bought or merged domains, third-party content, networks of similar sites), and gives an eleven-question self-audit to run every quarter and before any large launch.
The SEO Playbook for 2027 covers this in Chapter 11 (spam policies) and Chapter 1 (how search changed), with the evidence label, date and link behind every claim and numbered steps that each end in a check. It costs $39.
See what's in the book · Read Chapter 9 free: how to optimize your website for AI search