Google’s September 2026 Spam Update: 6 Checks for Your Site
On this page
Google started rolling out its September 2026 spam update on September 24, and it can take up to two weeks to finish.[1] If your traffic dropped since then, don’t only look at your own content. Spam that visitors or attackers put on your site, like comment links, fake profiles or hacked pages, breaks Google’s spam policies too.[4]
Most coverage of this update is about AI content farms and link schemes. That matters, but many small sites get into trouble for a simpler reason: their forms and comment sections let spam onto public pages. Here’s what happened, and six checks you can run this week.
What happened
Google posted the update on its Search Status Dashboard at 9:15 a.m. Pacific on September 24. It applies globally and to all languages.[1] It’s the fourth spam update Google has announced in 2026, after one in August.[8]
Google didn’t say what this update targets. Rank-tracking tools showed heavy movement from Friday, September 25 through Sunday, September 27, with Saturday the most volatile day.[2] SEO consultant Glenn Gabe reported big drops across a number of sites, and early reports pointed at AI-generated and programmatic content sites.[2] Those are early observations from third parties, not Google’s own explanation.
| Date | What we know |
|---|---|
| Sep 24 | Google releases the September 2026 spam update, global, all languages.[1] |
| Sep 25 to 27 | Rank trackers show big swings, peaking Saturday.[2] |
| Up to ~Oct 8 | Rollout may take up to two weeks from Sep 24.[1] |
Why the September 2026 spam update matters for your site
Spam updates are improvements to Google’s automated spam detection, including SpamBrain, which Google calls “our AI-based spam-prevention system.”[3] Google’s advice to affected sites is short: review the spam policies and make sure you comply.[3]
Two of those policies are about content you didn’t write. User-generated spam is spam that visitors add through channels meant for them, like comments, forums or profiles. Hacked content is anything put on your site without permission through a security hole.[4] Both show up on your domain, so they’re yours to prevent and clean up.
That’s why the “it’s not our content” argument doesn’t help. A contact form that publishes testimonials, a membership site with public profiles, or an old blog with open comments can all fill up with casino, pharma or crypto links without anyone on your team noticing.
6 checks to run this week
Work through these in order. The first two take ten minutes and rule out the most serious problems.
1. Check Search Console for manual actions and security issues
Open Google Search Console and look at two reports under “Security & Manual Actions”. The Manual Actions report shows problems found by human reviewers. If there’s a manual action, some or all of your site won’t show in Google results.[6] The Security Issues report flags hacked content, malware and pages that trick visitors into risky actions.[7]
An empty report is good news. It means the drop, if any, is more likely algorithmic, which has no notice to respond to.
2. Search Google for spam on your own domain
Google suggests using the site: search operator or Google Alerts to spot spam on your pages.[5] Try a few searches like these, replacing example.com with your domain:
site:example.com casino
site:example.com viagra OR cialis
site:example.com crypto OR bitcoin
site:example.com "buy cheap"
site:example.com inurl:author OR inurl:profileIf you find pages you didn’t create, especially in odd folders or in languages you don’t publish in, treat it as a possible hack. Our write-up on Comment2Shell shows how one anonymous comment could run script in an admin’s browser this month.
3. Clean up comments, profiles and reviews
Look at your approved comments, member profiles and any page where visitors can post. Delete spam you find, and don’t just unpublish it if the URL stays public. Pay special attention to user profile pages with a website link and a bio full of keywords. Google lists commercial usernames and off-topic links as typical user-generated spam.[6]
4. Make links in user content untrusted
Google recommends adding a nofollow or ugc rel attribute to all links in untrusted content.[5] That tells Google you don’t vouch for them. It won’t stop spam, but it removes the main reward spammers want. Check one comment link on your site with your browser’s “Inspect” tool to confirm the attribute is there.
5. Slow down brand-new accounts
Google’s own list of fixes for user-generated spam includes:[5]
- Manual approval for some user actions, so spam can’t go live instantly.
- A
noindextag on posts from new users who haven’t built any reputation yet. - A verification step like reCAPTCHA or a similar tool to keep out scripts.
- Banning IP addresses that create several spammy profiles.
For most WordPress sites, the easiest win is holding first-time comments for approval and turning off public profiles you don’t need.
6. Block spam before it’s posted
Cleanup is the slow part, so stop the flow at the form. Google suggests watching for suspicious form patterns, repeat requests from the same IP ranges, and odd usernames or form values.[5] A spam filter on comments, registrations and contact forms does that automatically. Our guide to stopping WordPress contact form spam without a CAPTCHA walks through the options.[9]
If you were hit: what recovery looks like
Be patient, and don’t make big changes while the rollout is still running. Google says fixes may help, but only after its systems learn over a period of months that the site now complies.[3]
If the problem was bad links pointing to your site, there may be nothing to recover. Google says that once its systems remove the effect of spammy links, the ranking benefit they gave is lost.[3]
If you have a manual action or a security issue, fix every affected page first. Then use “Request Review” in the matching report and explain what went wrong, what you changed and the result.[6][7] Reviews can take several days or weeks, and Google asks you not to resubmit before you hear back.[7]
| What you found | What to do |
|---|---|
| Manual action | Fix all pages, then Request Review.[6] |
| Security issue (hacked) | Remove injected content, close the hole, then Request Review.[7] |
| Spam comments or profiles | Delete, add ugc/nofollow, moderate new users.[5] |
| No notice, traffic down | Review the spam policies and wait for the rollout to end.[3] |
Where Zero Spam fits
Zero Spam won’t fix rankings or remove pages that are already hacked, and it doesn’t replace Search Console. What it does is check comments, registrations and form submissions against known bad IPs and emails before they post, through the free WordPress plugin or the API. That covers check 6. If that’s useful, start on the free Explorer plan. For a wider plan, see our guide to preventing website spam.
FAQ
Frequently Asked Questions
Google said on September 24 that the rollout may take up to two weeks, so expect it to finish around early October.
They can. Google’s spam policies cover user-generated spam, which includes spammy comments, forum posts and profiles that visitors add to your site. Google publishes guidance for site owners on preventing it.
Open the Manual Actions report in Google Search Console. If it lists an issue, some or all of your site won’t appear in Google results until you fix it and request a review.
Google says fixes may help after its systems learn over a period of months that your site complies. If the drop came from spammy links losing their value, that lost benefit doesn’t come back.
Google recommends either one on links in untrusted content like comments and forum posts. Both tell Google you don’t vouch for the link.
Sources & References
- Google Search Status Dashboard: September 2026 spam update released, global, all languages, up to two weeks (Sep 24, 2026)
- Search Engine Roundtable: big ranking volatility Sep 25-27, early reports of drops (Sep 28, 2026)
- Google Search Central: Spam updates, SpamBrain, recovery over months, link spam (updated Dec 10, 2025)
- Google Search Central: Spam policies, user-generated spam and hacked content (updated Aug 28, 2026)
- Google Search Central: Prevent user-generated spam, ugc/nofollow, moderation, noindex, site: monitoring (updated Dec 10, 2025)
- Search Console Help: Manual Actions report and review requests (accessed Sep 30, 2026)
- Search Console Help: Security Issues report, hacked content and review timing (accessed Sep 30, 2026)
- Search Engine Land: fourth Google spam update of 2026, after August (Sep 24, 2026)
- Zero Spam: Stop WordPress contact form spam without a CAPTCHA (accessed Sep 30, 2026)
