Google’s September 2026 Spam Update: What Small Business Owners Should Do

On September 24, 2026, Google started rolling out its September 2026 spam update. It’s Google’s fourth spam update this year ” The update was applied globally and to all languages.  As usual with most updates, the rollout took two weeks to complete. Most small business websites have nothing to worry about. But if your site uses shortcuts, now is a good time to check. This is especially true if you inherited the site from a previous owner.

What Is a Google Spam Update?

Google uses spam updates to improve its automated systems for detecting search spam. Google defines spam as techniques used to deceive users or manipulate its systems into ranking content highly. That now includes attempts to manipulate the generative AI responses in Google Search. So spam tactics can cost you visibility in AI Overviews and AI Mode, not only in regular results. Sites that violate Google’s spam policies get hit with ranking penalties or end up not ranking at all.

What’s Different This Time

Google hasn’t said what this update targets or whether it focuses on a specific policy or tactic. The rollout took longer than the 3 previous 2026 updates. A longer update doesn’t mean have to be more volitarity in search results, But agencies should wait more than two weeks before looking for any concrete results.

Rankings have also been unstable for a while. Search Engine Roundtable tracked volatility spikes in early and mid-August, more movement after the August spam update, and more on September 23 and 24. An unconfirmed update also hit around September 4 and reversed on September 13 (Search Engine Roundtable). Don’t assume every drop is caused by this one update.

How to Tell If Your Site Was Affected

Business owners should check their Search Console data and compare the timing of any changes with the rollout dates.

Here’s how:

1. Open Google Search Console and go to the Performance
2. Compare date ranges. Look at the period after September 24 and compare it with the two weeks before. When the rollout finishes, compare a full week after it ends with a week before it started.
3. Look at clicks and impressions by page. A drop across the whole site points to a site-wide issue. A drop on only a few pages usually points to a problem with those pages.
4. Check Manual actions under Security & Manual Actions. If a human reviewer flagged your site, it will appear here.
5. Check Security issues in the same section. Hacked sites often get hit by spam systems, and owners are usually the last to know.
6. Rule out seasonal changes. For seasonal businesses like landscaping, pools, or HVAC, compare with the same weeks last year before assuming the update caused the change.
7. Market conditions change. Small changes and impressions or clicks, especially compared year to year, may also reflect market conditions.

Common Spam Problems on Small Business Sites

Most small business owners don’t try to spam Google. But these problems show up on local business websites all the time. They are often left behind by an old vendor, a plugin, or a hack. All of them are covered in Google’s spam policies.

Doorway and “City” Pages

Google names “multiple domain names or pages targeted at specific regions or cities that funnel users to one page” as doorway abuse. It also calls out “substantially similar pages that are closer to search results than a clearly defined, browseable hierarchy”. Town pages are huge An AI search and traditional search. But you must be more than just change the name of the town. You must indicate that the business is familiar with the town and the town is familiar with the business.

Red flag: 40 pages like “Plumber in Milford CT,” “Plumber in Orange CT,” and “Plumber in Stratford CT” where only the town name changes. Google has also warned that it can lose trust in a whole site because of programmatic SEO .

Keyword Stuffing

Google specifically lists “blocks of text listing cities and regions that a webpage is trying to rank for” as keyword stuffing.

Red flag: A footer that lists every town within 50 miles, or copy that repeats “best roofer in Connecticut” in every paragraph.

Paid or Swapped Links

Google counts buying or selling links for ranking purposes as link spam, including trading goods or services for links. It also counts excessive link swaps, low-quality directory links, and widely distributed footer links across other sites.

Red flag: A past SEO vendor built hundreds of directory links, or your web designer’s credit link appears on dozens of client sites with keyword-rich anchor text. Paid sponsorship and advertising links are fine if they’re marked with rel=”sponsored” or rel=”nofollow”.

Hacked Content

Hackers may add spam pages, inject hidden links, or redirect visitors coming from Google to shady sites. They often use cloaking so the owner never sees it. Outdated WordPress plugins and themes are a common way in.

Red flag: Pages in Search Console you don’t recognize, especially in other languages or about unrelated products. Also, visitors say your site sent them somewhere strange from Google, but it works fine when you type in the address.

Hidden Text

White text on a white background, text hidden behind images, or text pushed off-screen with code all count as spam. Accordions, tabs, sliders, and tooltips that improve the user experience are allowed.

Our Recommendations  to Avoid  a Penalty From A Spam Update

If Your Traffic Hasn’t Changed Due to a Spam Update

• Don’t make big changes during the rollout. Wait until Google says it’s complete.
• Run a quick self-audit using the checklist below.
• Update WordPress core, plugins, and themes. Remove plugins you don’t use. Plugins should be updated at least monthly.

If Your Traffic Dropped

• Wait for the rollout to finish before you draw conclusions. Rankings often move back and forth during an update.
• Find which pages lost traffic in Search Console and check them against the problems above.
• Fix the cause, not the symptom. Combine or remove thin city pages, rewrite stuffed copy, clean up hacked content, and get rid of paid or low-quality links.
• Be patient. Google says improvements can help, but its automated systems may take months to learn that a site now follows its spam policies.
• If you have a manual action, fix the problem and submit a reconsideration request in Search Console.

Quick Self-Audit Checklist

• [ ] No manual actions or security issues in Search Console
• [ ] No unfamiliar pages in Search Console’s Pages report
• [ ] Every city or service-area page has real, unique local content (projects, photos, reviews, local details), or it’s merged into a stronger page
• [ ] No long lists of towns or repeated keywords in footers or copy
• [ ] No hidden text or links
• [ ] Sponsored or paid links are marked rel=”sponsored” or rel=”nofollow”
• [ ] No link-swap “partner” pages or paid directory link packages
• [ ] WordPress core, plugins, and themes are up to date, and unused plugins are removed
• [ ] Every page exists to help a real customer, not just to rank

The Bottom Line on the Latest Spam Update

Spam updates target shortcuts. If your website is built for real customers, with honest service pages, real local content, and clean technical upkeep, this update is more likely to help you than hurt you, because it may push down competitors who take shortcuts.

If your site has leftovers from older SEO tactics, now is the time to clean them up.

Want a second set of eyes? Elvin Web Marketing can review your Search Console data after the rollout ends and flag any spam-policy risks on your site. Contact us for a free spam-risk review.