Google's longest spam update of the year is over: 14 days, three waves, no explanation. Here is what the field saw

On October 8 at 4:37 am ET Google marked the September 2026 spam update as complete. It started on September 24 and took 13 days and 16 hours. The three spam updates before it this year took 19.5 hours (March), two days (June) and under three days (August). Google's entire commentary on the longest one: “this is a normal spam update,” it “does not target link spam,” no percentage of affected queries, no policy named. Everything else below comes from the people who watched their own charts.

Three waves, one update

Wave one, September 25–27. Glenn Gabe on Monday morning: the update “really showed itself” over the weekend, “big drops across a number of sites”, across verticals and countries. Nothing new in the targeting, he said, just more of what August hit: scaled content abuse, programmatic scaling, thin affiliate pages. Lily Ray saw the same thing from a different angle: “highly templated, programmatic, (probably) AI-generated pages”, her example being a site with one page per phone number or area code. Her other example is a site with 143 county service pages built from one template: traffic rose fast, plateaued, fell just as fast. She calls it the mountain pattern.

Wave two, September 30. Gabe received emails from several site owners who saw a large drop on exactly that date, and read it as evidence that a two-week update has stages, each touching a different set of sites. On WebmasterWorld the same day read as one message copied many times: Discover vanished, News vanished, “traffic dead.” We covered that wave in the Discover piece.

Wave three, October 4–6. The last spike and the angriest thread. “Total garbage today.” A news site reporting earnings down about 80%. One owner summing up the whole fortnight: “Spam is increasing, and quality results are becoming harder to find.” Discover kept doing what it had done all month, “brief and teasing spikes”: fine for half a day, then practically dead.

The only numbers anyone measured

Google published nothing, so the dataset of record is Diib's early read of 32,569 sites with connected Google Analytics. Comparing September 24–26 with the same days a week earlier: the median share of visits coming from unpaid Google search fell from 34% to 31%, and the share of sites that lost half or more of that traffic doubled, from 5% to 10%. Diib's own caveat applies: an early read, not a verdict, and it cannot tell which sites Google actually flagged.

The self-reported figures are wilder. PPC Land collected operator reports of Discover down 70% and overall traffic down 48–80%. None of that can be separated from the September 4 and 15 turbulence that preceded the update, and the people who were fine mostly did not post.

What came back

Two recoveries matter more than the drops, because they show how the system actually works.

First: a site Gabe had watched get flattened by the August spam update went, during this rollout, from close to zero to roughly 8,000 clicks a day, and reappeared in AI Overviews and AI Mode. His reading: Google re-scores spam signals when it re-evaluates a site, and when the score flips, the traffic comes back at once. Not a slow climb. A switch.

Second: Reddit. Its machine-translated threads in Italian, German, Portuguese and French, the textbook case of scaled content, were hit in the May core and June spam updates. During this one they are climbing again in Italy, Germany, Brazil and France, and Semrush estimates Reddit's organic traffic at an all-time high. Same tactic, different owner, opposite outcome. We said it a week ago and nothing in the final rollout changed it.

The rank trackers broke in the middle of it

A detail that explains half the panic. From around September 13 Google started blocking scrapers far more aggressively. Nozzle reported being able to retrieve about 80% less data, and later put the cost of resolving a single five-page ranking at 500 to 1,000 requests. Sistrix confirmed slower collection, Ahrefs posted a notice that some SERP data may be inconsistent, Charles Floate found his suites out of sync with live results, first pages full of forums and YouTube that real users did not see. SEOmonitor's conclusion: many of the “sudden ranking changes” on September 26 were Google returning incomplete results to automated queries, not changes searchers experienced.

Practical consequence: for this update, a tracker chart is not evidence. A drop that lasts several days and shows up in Search Console impressions and clicks is. Barry Schwartz's 14-tool volatility panel is useful for timing the waves and for nothing else.

What Google said when nobody was quoting the dashboard

The real statement came not from the status page but from Search Central Live in Barcelona, in John Campbell's recap. Why four spam updates in a year after one in 2025: “there is so much more new content,” and “a high percentage of content is spam, and that is what the spam updates target.” The team is “now using AI to help catch more of it.” User reports are “what new spam filters are built from.” And the line that should be pinned above every content farm: Gary Illyes, “scaled content is now becoming more of a problem than link spam.” Campbell's closing summary: expect more spam updates and new spam thresholds.

The AI part is not hand-waving. Google published a three-page paper this year on SAFE, the Scaled Abuse Forensics Examiner: a root agent coordinating three specialised agents (content, behaviour such as synchronised publishing, shared infrastructure) to decide whether a cluster of channels is one operation. The paper is dated May 28, covers YouTube networks, and does not mention Search; its predecessor S-CTS terminated 50,000 clusters and 130,000 channels in six months. Nobody has confirmed SAFE runs inside the spam update. Nobody needs to. The architecture is the message: Google is no longer scoring pages, it is investigating networks.

What the forums concluded

BlackHatWorld's update thread is calmer than WebmasterWorld, and more useful. The observation that repeated most: nothing happened on sites with a proper link profile, while a content-only site was down about 20% by day two, and the pattern matched June. The question that poster asked, whether the dropped pages had any links pointing at them, is the question to ask of every drop in this update. The second most repeated line was procedural: wait until the rollout finishes, because anything you change mid-rollout you will not be able to attribute to anything. Both held up.

What did not happen is also an observation. After June, a BHW member noted that a spam update usually “leaves visible bodies in the link market” and asked which link sources got deindexed. Nobody could name any. After September the same question has the same answer. An update that Google says does not target link spam did not target link spam. The casualties were pages, not domains that link to them.

One more thing to leave alone: the disavow file. Early in September John Mueller answered a site that dropped right after disavowing links: the tool “does have effects, but it has its place & time”, and “disavowing a handful of links is not going to make your site drop out of search.” A spam update that is not about links is not the place or the time.

What comes next

Lily Ray's prediction that the next massive update is “a matter of when, not if” rests on the pattern Google has followed before: warn, rewrite the docs, then hit. The docs were rewritten on October 1 and 2. AI content guidance now calls it “critical to manually fact-check and review all AI-generated content,” metadata included. The helpful-content page gained a “main content” section listing effort, originality, skill and accuracy. Fabricated author profiles are now “a form of deception.” The gaps between the 2026 spam updates were 92, 55 and 37 days. Gabe and Marie Haynes both guess a core update in November. Google has announced nothing, as usual.

What to do if you buy links

1. Judge the damage in Search Console, not in a tracker. Export Performance now, compare September 24 onward against the three weeks before, and treat September 30 and October 4–6 as separate events. If the tracker says you fell and Search Console says you did not, you did not.
2. Look for the template, not the volume. Every confirmed casualty was a set of pages built from one mould: area codes, counties, product variants, translated threads. Publishing many pages was fine; publishing the same page repeatedly was not. If a section of your site fits that description, that section is what the next refresh will re-score.
3. Pages with links held. Again. It was the field observation in week one and it survived to week two. A money page with no external links is now the most exposed asset you own. That is the whole case for keeping a baseline of links on every page that earns, not only on the homepage.
4. Do not touch the disavow file because of this. See Mueller above. The update did not look at your links, so cleaning them cannot fix it, and it can make something else worse.
5. Recovery is a re-score, so finish the cleanup before the refresh. Google says many months. Gabe's 8,000-clicks-a-day example says it can happen in a day, once the site is re-evaluated. Either way the work has to be done before the next pass, and the next pass is likely weeks away, not quarters.

Bottom line

Fourteen days, three waves, one sentence from Google. The update punished templates and spared links, exactly as the first weekend suggested. The rank trackers broke, so most of the screaming was about data nobody could verify. And the company that ran it told a room in Barcelona that scaled content is a bigger problem than link spam, then rewrote its documentation the week it finished. Treat that as the announcement for the next one.