Google Spam Update (September 2026): What Agencies Should Check and Tell Clients

If a client's organic traffic fell in the last week of September, the first call you get will start with "what happened?" and the second will ask what you are doing about it. The likely answer this time is the latest Google spam update, which started on September 24, 2026, and as of October 2 it was still rolling out. The hard part for an agency is not reading the news. It is proving whether the update caused the drop, and explaining it without sounding defensive.

This guide covers what Google actually released (and what it did not), how to tell whether a client was affected, which spam policies to check first, and how to present all of it in the monthly report. It is written for agencies that have to answer to a client, not just fix a site, so every step ends with something you can show in the SEO report you send clients.

What Google actually released

The only source that settles this is Google's own Search Status Dashboard, which lists every ranking update with its start date and duration. For 2026 it shows the September 2026 Google spam update starting on September 24, with no end date yet. Before that came the August 2026 spam update (from August 18, under 3 days), the June 2026 spam update (from June 24, about 2 days), the May 2026 core update (from May 21, nearly 12 days), and the March 2026 core and spam updates.

A spam update is Google improving its automated spam detection, including the system it calls SpamBrain. Google's spam updates documentation says sites that see a change after one should review its spam policies, and that when its systems remove the effect of spammy links, any ranking benefit those links gave is lost. That is very different from a core update, which reassesses how relevant and helpful content is without implying anything is wrong.

Was your client hit by the Google spam update?

Traffic moves for many reasons, and blaming the update without evidence is how agencies lose credibility. Work through these checks in order, and keep screenshots for the report.

1. Manual actions. Open the Manual actions report in Search Console. A manual action is a reviewer's penalty with its own fix-and-request process; a spam update is not. If the report is empty, any drop is algorithmic.
2. The start date. In the Search Console Performance report, look at daily clicks and impressions. A drop caused by the update should begin on or after September 24, not before it.
3. The shape. A spam update tends to hit specific pages or patterns hard. If every page fell evenly, look at tracking, seasonality or a technical change first.
4. Rankings. Compare daily keyword positions for the week before and after September 24. Daily data matters here, because a weekly check can hide the exact turning point.

That last check is where daily data earns its keep. A weekly rank check might show a drop somewhere in the last fortnight of September; a daily one shows whether it began on the 24th. If the timing matches and no manual action exists, you have a reasonable case that the update is involved. Daily rank tracking for agencies makes that comparison a matter of reading a chart rather than reconstructing it from memory.

What to check, policy by policy

Google's spam policies list 16 named practices, from cloaking to user-generated spam. For most agency clients, a handful are worth checking first, because they come from ordinary marketing decisions rather than deliberate spam.

Write down what you find for each one, including the ones that are clean, and attach the evidence from your site audit and backlink checks. A client report that says "we checked these six policies, five are clear, and here is the plan for the sixth" is far more reassuring than one that says "Google updated its algorithm". It also gives you a record to compare against next month, which matters because recovery is slow and you will be asked about progress repeatedly.

How to explain it in the client report

Clients do not need the mechanics of SpamBrain. They need to know whether the problem is understood, whether it is being handled, and when things should improve. Structure the update section of the report around those three questions.

• What happened: a chart of clicks and rankings with September 24 marked, plus one sentence naming the Google spam update and its status.
• What we found: manual actions (none, or the details), the policies checked, and anything that needs fixing.
• What we are doing: the specific changes, such as removing thin pages, disavowing only the links that genuinely need it, or cleaning up a hacked section.
• What to expect: Google's own guidance, that improvement can take months as its systems learn the site complies.

Keep the section in the report every month until the numbers recover, even when nothing changes. Clients worry more about silence than about bad news, and a consistent section lets them watch recovery happen. Reports that go out on a fixed schedule help here, because the update section arrives without anyone remembering to add it, and automated branded PDF reports keep the format identical from month to month.

What recovery looks like

Google is direct about this: making changes may help a site improve if its automated systems learn, over a period of months, that the site complies with the spam policies. There is no recovery request for an algorithmic drop, unlike a manual action. Two practical consequences follow for agencies.

First, set expectations in months, not weeks, and say so in writing before the client asks. Second, separate what can come back from what cannot. If rankings were propped up by links Google has now neutralized, that lift is gone for good, and the plan has to replace it with links and content the site actually earns. Reporting that distinction honestly protects the relationship, because the client hears it from you first rather than discovering it in month three.

Finally, watch the dashboard. Google adds an end date when a rollout finishes, and only after that is it fair to measure the full effect. Keep the dated marker on every chart in the report, so anyone reading it later, including a new contact at the client, can see exactly when the change began and what the agency did next. That habit is worth building into every branded white label report you send, not just this one.

Google Spam Update FAQ

When did the September 2026 Google spam update start?

Google's Search Status Dashboard lists the September 2026 spam update as starting on September 24, 2026. As of October 2, 2026 it had no completion date, so it was still rolling out.

Was there a Google core update in September 2026?

No. Google's Search Status Dashboard lists no core update after the May 2026 core update, which started on May 21. Some articles described a September core update, but the only September ranking update Google lists is the spam update.

Can a site recover from a Google spam update?

Yes, but slowly. Google says that making changes may help a site improve if its automated systems learn over a period of months that the site complies with its spam policies. Ranking benefit that came from spammy links cannot be regained once those links are neutralized.

Is a spam update the same as a manual action?

No. A spam update is an automated change applied across Search. A manual action is a penalty issued by a reviewer and shown in the Manual actions report in Search Console. Check that report first: if it is empty, the drop is algorithmic.

How should an agency explain a spam update drop to a client?

Show the drop against the update's start date, say whether a manual action exists, name the spam policy the site may be close to, list what you are changing, and set a realistic timeline measured in months. Keep reporting the same metrics every month so recovery is visible.