Google's 2026 Spam Updates, Explained for Business Owners
Google's 2026 Spam Updates, Explained for Business Owners Google has now run four spam updates this year, and most business owners have not noticed any of them.
That is partly because spam updates are not aimed at them. They are aimed at the sites that have spent years gaming the results. But the cost of a spam update does not fall only on the people it targets: it falls on anyone whose site looks, to an automated system, a little like one of those sites. If you have a blog, a few service pages, a review widget or a freelancer who "does your SEO", that is worth ten minutes.
Here is what has happened in 2026, what the updates are actually looking for, and what a business with an honest website should do about it.
The short answer
A spam update is Google tightening enforcement of rules that already exist. It does not introduce new ranking factors, and it does not reward anyone. Sites that break the spam policies lose visibility; everyone else may see a small gain as those sites drop away.
In 2026 these updates have been more frequent and, in September, noticeably longer.
The 2026 timeline
Update | Dates | What we know |
March 2026 spam update | 24–25 March | Under 24 hours. Global, all languages. |
June 2026 spam update | June | About 48 hours. |
August 2026 spam update | 18–21 August | 2 days 16 hours. Google announced no new policies. Reports linked it to sites mass-publishing AI-generated content to manipulate rankings. |
September 2026 spam update | From 24 September | Announced as taking up to two weeks, the longest of the year. Fourth of 2026. |
Two things stand out. First, Google said nothing new about policy at any point: these are enforcement runs. Second, the September rollout was announced as a two-week window, against hours or days for the earlier ones. Google has not said why, and nobody outside Google can tell you for certain, so treat any confident explanation with suspicion.
For whether the September update has finished, check Google's Search Status Dashboard rather than a blog post, including this one.
What spam updates actually target
The systems doing the work are collectively called SpamBrain, Google's machine-learning spam detection. They apply Google's published spam policies, and the ones most relevant to a business website are these.
Scaled content abuse. Producing large volumes of pages primarily to rank, with little original value. Google's policy is explicit that it does not matter how the content is made. Hand-written pages churned out at scale are covered, and so is AI-generated text published in bulk.
Site reputation abuse. Hosting third-party content on a respected site to borrow its ranking power, with little oversight from the host. Think of coupon sections, "best of" reviews or payday-loan guides on an unrelated news or university site.
Expired domain abuse. Buying an old domain with a good history and filling it with content that has nothing to do with what it used to be.
Doorway abuse. Many near-identical pages targeting slight variations of a query, such as the same service page repeated for fifty neighbourhoods, each funnelling to the same place.
Back button hijacking. Interfering with the browser's back button so a visitor cannot return to the previous page. Google added this as an explicit policy with enforcement from 15 June 2026. We cover it properly later this month, because it is a design failure as much as an SEO one.
Fake or undisclosed incentivised reviews. Reviews written by or for the business, or paid for without disclosure.
None of these will surprise anyone who has read the policies. What changes year to year is how well Google detects them.
Who gets caught who didn't mean to be
The sites we worry about are not spammers. They are ordinary businesses that inherited a habit.
The agency that built fifty city pages. One service, fifty "Web Design in [Town]" pages with the town name swapped. It felt like good local SEO in 2019. It reads as doorway abuse now.
The blog written entirely by a tool. Forty posts in a month, none with an author, none saying anything the first page of Google does not already say.
The review section nobody examined. Customers were offered a discount for a five-star review, or the reviews were collected by a vendor with no disclosure.
The "helpful" guest-post section. Third-party articles on your domain about topics unrelated to your business, published for a fee.
The pop-up that traps people. An exit-intent overlay that interferes with navigation.
If any of these sound familiar, the answer is not panic. It is to review and remove.
What recovery looks like
Google's documentation is blunt about this: recovery from an automated demotion can take months, because the systems need time to see that a site now follows the rules. That is the main reason to act before a problem appears. There is no quick appeal for an algorithmic demotion, and no reconsideration request unless a manual action is involved.
If your traffic dropped sharply in the window of an update, the sensible approach is slow and dull. Compare Search Console data from before the update started with data from after it finished, find which pages lost the most, and look honestly at what those pages have in common.
What an honest business should do
There are five sensible steps, and none needs a specialist.
Find your thin pages. Anything under about 300 words that exists only to catch a search, and any set of pages that are near-copies of each other.
Put a person behind your content. A named author, a real bio, and a reason they are qualified to write it.
Audit your reviews. Remove anything you cannot defend as a genuine customer experience, and disclose any incentive.
Remove third-party content you did not commission or oversee. If it does not belong on your site, it is a liability.
Check your UX for traps. Open your site on a phone, click through three pages and press back. If anything unexpected happens, fix it.
We have turned these into a 12-point self-check you can run in an afternoon.
What not to do
Do not rewrite your whole site in a panic, and do not pay for a "spam update recovery" package before you have diagnosed anything. Most traffic losses in an update window have ordinary causes: a competitor improved, a seasonal pattern, or a technical regression. Establish that it is the update before treating it as one.
And do not read the absence of an announced policy as the absence of a change. If your business model relies on volume content, doorway pages or borrowed authority, assume the direction of travel is against you.
Frequently asked questions
What is a Google spam update? It is an enforcement run of Google's automated spam detection against its published spam policies. It does not add new ranking factors. Sites that break the policies lose visibility, and the effect can be partial or site-wide.
Is AI-generated content banned by Google? No. Google's policy targets scaled content abuse, meaning content produced in volume primarily to manipulate rankings, regardless of whether a person or a tool wrote it. AI-assisted content with real editorial oversight and original value is not the target.
How long does recovery take after a spam update? Google says it can take months, because its systems need time to see that the site now follows the policies. There is no way to speed it up beyond fixing the underlying problem.
How do I know if a spam update affected my site? Compare Search Console performance from before the update began with performance after it finished, and look for a sharp, sustained drop in specific pages or sections rather than a general dip.
Do I need to do anything if my site is clean? Not urgently. But a review once or twice a year costs little and catches the inherited habits that cause trouble later.
Not sure how your site looks to Google? Our free audit checks the technical and content issues that spam systems and ordinary visitors both notice, and tells you plainly what to fix first. Request your Free Website Audit →
