Google September 2026 Spam Update: How to Read a Click Drop

Direct answer: The Google September 2026 spam update has finished. The Ranking incident began on 24 September 2026 at 09:15 Pacific Time, and the end field stops on 8 October 2026 at 01:00 Pacific Time. The history page lists a duration of 13 days, 16 hours. The three earlier 2026 spam updates finished in 19 hours 30 minutes, 2 days 1 hour, and 2 days 16 hours. Google said the rollout applies globally, to all languages, and may take up to two weeks. Google named no target policy.

Main condition: This reading holds when you have Search Console access for the correct property and you compare clicks and impressionsImpressionThe number of times your ad or page appeared on a screen. An impression is not a person and not a search.Open the glossary on the dates above. Limit: A click drop inside that window is not proof that this update caused it. Google published no affected-query percentage. This article promises no recovered ranking.

The incident page, incidents.json, Ranking history, spam updates page, spam policies, and the Search Console help pages were read on 11 October 2026. We opened the incident page in a browser the same day. We did not open a client Search Console property. The numbers in the simulation are dummy data. They are not a client record.

The problem: one chart, three different stories

A site owner sees clicks fall in late September and receives one sentence: the spam update hit you. That sentence mixes three mechanisms Google keeps apart.

The first mechanism is an automated system that already runs every day. A spam update is an improvement Google announces. It is not a switch installed on 24 September.

The second mechanism is a manual action. A human reviewer writes a finding, and Search Console places it in the Manual actions report. An update announced on the dashboard does not fill that report.

The third mechanism sits outside spam: an http property swapped with https, a season, a page that is not indexed, or a competitor whose page is more useful. traffic-drop guide places those causes first, before you blame an algorithm.

Mixing them is expensive. Some people send Request Review while the report is empty. Some delete half the site. Some buy new links to "replace" links that fell. the risks of a cheap SEO service shows the link-network pattern the spam policies already reject.

What you lose is not one site total. What you lose is a URL pattern. The homepage can sit still while a cluster of city pages falls. what an SEO audit checks separates that kind of finding from a ranking promise. how to read an SEO report shows how to match a vendor's numbers to your own Search Console.

How it works: the guard was already on patrol

spam updates page says Google's automated spam systems operate constantly, and Google occasionally makes a notable improvement. That announced improvement is a spam update. The list lives on Ranking history.

The same page gives SpamBrain as an example, not as the name of the September update. SpamBrain is Google's AI-based spam-prevention system. Google says it improves that system from time to time so it spots spam better, including new types of spam. The page was last updated on 10 December 2025 UTC. The September 2026 rollout did not publish a new explainer.

One analogy, then back to the dashboard. The spam systems are a guard who already walks the building. A spam update is the night the instructions change, with the time posted on the door. The building stays the same.

Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete.

That sentence is the 24 September 2026, 09:15 PDT row on September 2026 spam update incident. The "spam update" link in that row goes to the spam updates page, not to a new policy list. The completion row says: "The rollout was complete as of October 8, 2026." The table clock is 8 October 2026, 01:37 PDT.

There are two finish times, and both come from Google. The incident header says the incident ended at 01:00 PDT on 8 October 2026. The JSON file stores end at 2026-10-08T08:00:00+00:00, which is 01:00 PDT, and writes the completion note at 2026-10-08T08:37:09+00:00, which is 01:37 PDT. Do not treat that 37-minute gap as a second update.

In Jakarta, 09:15 PDT on 24 September is 23:15 WIB on the same date. 01:00 PDT on 8 October is 15:00 WIB. 01:37 PDT is 15:37 WIB. The calendar date does not shift. What shifts is the content of the day, because Search Console labels days in Pacific Time.

The three earlier launch notes, from incidents.json on 11 October 2026, say "may take a few days to complete." March 2026 began on 24 March at 12:00 PDT, and the history duration is 19 hours 30 minutes. June 2026 began on 24 June at 09:00 PDT, and the history duration is 2 days, 1 hour. August 2026 began on 18 August at 09:27 PDT, and the history duration is 2 days, 16 hours. The August JSON span is 2 days, 16 hours, 22 minutes. The history page rounds that label.

September changed the estimate to "up to two weeks", and the history page then listed 13 days, 16 hours. From the JSON begin at 16:15 UTC on 24 September to end at 08:00 UTC on 8 October, the span is 13 days, 15 hours, 45 minutes. To the 08:37 UTC note, the span is 13 days, 16 hours, 22 minutes. The history label sits near the note, not on the end field. We are not inventing Google's rounding rule. We are placing both clocks next to the label a reader sees.

On the same history page, the May 2026 core update ran for 11 days, 21 hours, and the March 2026 core update ran for 12 days, 4 hours. The September duration is close to a core-update duration. The label remains "spam update". A similar duration is not a change of type.

The mark on the launch row is Service information, not Service disruption and not Service outage. The completion row uses Available. The dashboard announced a ranking change. It did not announce that Search was down.

The spam updates page states the effect for a site that violates policy: it may rank lower, or it may not appear at all. Making changes may help if automated systems learn, over a period of months, that the site complies. The words "may" and "months" belong to Google. They are not a promise for next week.

The exception on that page applies only to an update that specifically deals with link spam. When systems remove the effect of spammy links, the ranking benefit from those links is lost and cannot be regained. The September incident is titled "spam update", not "link spam update". The last "link spam update" title we saw on the Ranking history we read was December 2022. The lost-credit sentence does not automatically apply to September 2026.

Four 2026 spam updates, in one table

The durations come from Ranking history. The start times come from begin in incidents.json. Both were read on 11 October 2026. Every clock in the table is PDT.

Google wrote no spam type, no site count, and no query percentage on those four rows. What changed in September was the time estimate and the duration that was later recorded. The policy text at spam policies stayed the same page.

What you need before you read the chart

• Search Console user or owner access for the property whose URL matches the site, including http or https. traffic-drop guide lists the wrong property as reason number 1 for traffic that looks missing.
• The Performance report for Search results, not the Discover report and not an ads report.
• A note of two finish times from September 2026 spam update incident: 09:15 PDT on 24 September, plus 01:00 PDT and 01:37 PDT on 8 October.
• A list of pages that earn money, from the business owner, at most 10 URLs. A site total hides the pattern.
• One person who may decide which pages get fixed. Without that person, a findings table does not become an action.

Step 1: Write down two finish times, not one

Open September 2026 spam update incident. Copy the launch sentence and the completion sentence as written. Record 24 September 2026 at 09:15 PDT, 8 October 2026 at 01:00 PDT from the header, and 01:37 PDT from the table row.

Add the Jakarta equivalents in the same note: 23:15, 15:00, and 15:37. The Jakarta calendar date does not shift for those three times. The note stops someone from dropping 24 September because it "started at night", or from treating all of 8 October as inside the window.

This step is done when the note holds three times and the incident link. A third-party chart does not replace the dashboard row. Google did not publish a daily volatility series on this incident.

Step 2: Compare 15 days, then repeat without the partial days

Open Performance, then Pages. traffic-drop guide tells you to lock the range to the start and end of the drop, open the Compare tab, and use the identical preceding span. comparison help adds this: Weekly or Monthly granularity neutralizes the day-of-week effect. Days in the report, except the 24-hour view, are labeled in Pacific Time, according to Performance discrepancy help and About the data.

Apply that method to the dashboard dates, not to a date that feels right on a chart. Outer window: 24 September through 8 October 2026 against 9 September through 23 September 2026. Both are 15 days. The 24 September and 8 October edges are partial. The update starts at 09:15 PDT, so the Pacific day of 24 September holds about 9 hours before the update and about 15 hours after it. The end field at 01:00 PDT means the Pacific day of 8 October holds about 1 hour inside the incident.

Repeat with full days inside the rollout: 25 September through 7 October against 11 September through 23 September. Both are 13 days. Use this pair when the 15-day pair moves only because of 24 September or 8 October.

About the data says the newest data is sometimes preliminary, shown with a dotted line, and may change within a few hours. Performance discrepancy help says collected data is usually available in 2 to 3 days. On 11 October 2026, the window after 8 October is still shorter than 15 days and still touches preliminary days. Do not call a recovery, or a second hit, from 9, 10, or 11 October.

Sort the Pages table by the click difference. traffic-drop guide tells you to look for rows with a large difference, then to separate a one-page drop, a few pages, and a site-wide drop. Export both date pairs. This step is done when the export holds clicks and impressions, not only average position.

Step 3: Separate the human reviewer from the automated system

Open Manual actions. Manual actions help says Google issues a manual action when a human reviewer decides that pages do not comply with the spam policies. If the site has no manual actions, you see a green check mark and an appropriate message. Also open Security issues. That report is for a hacked site or behavior that could harm a visitor, such as phishing or malware. Those pages can carry a warning label.

A green check does not prove the September update missed your site. A spam update is a change to automated systems. A manual action is a human review. Both reports can be empty while clicks on a URL cluster still fall, and both can hold a finding that has nothing to do with 24 September.

If Manual actions lists a finding, read the type, fix every URL pattern it names, then select Request Review. Manual actions help says most reconsideration reviews take several days or weeks, and link-related requests can take longer. Do not resubmit before there is a decision. If the report shows only the green check, do not send Request Review. There is no manual finding to review.

This step is done when the note records both reports on 11 October 2026 or on the day you check. Keep a capture that hides email addresses and user names.

Step 4: Match one URL pattern to one policy

Take the URL pattern that holds most of the click difference. Read the one section of spam policies that the pattern resembles. Do not "clean up" every policy. Google did not write that September targeted any row in the table below. The table is a reading map, not a target announcement.

Read scaled content abuse when the URL pattern is large and the text is thin, including pages produced by AI. Google says: if you are hosting such content, exclude it from Search. Google does not say that every use of AI is spam. The violation is many pages whose main purpose is to manipulate rankings and that do not help users.

Site reputation abuse is not "you have freelance writers". Google says third-party content alone is not a violation. It is a violation when that content is published mainly because of the host site's ranking signals. Press-release sites, syndicated news, forums, opinion columns, and coupons taken directly from merchants are listed as examples that are not violations.

For links, do not conclude that September removed backlink credit. This incident is not titled a link spam update. Still fix paid links that do not use rel="sponsored" or rel="nofollow", because that is a policy violation regardless of the incident title. the risks of a cheap SEO service shows how to read a link network from the links report.

Do not answer this update by sending automated queries to Google to check ranks. spam policies names machine-generated traffic, including scraping results for rank checking, as a violation of the spam policies and the Google Terms of Service. The legitimate numbers for this window are in Search Console.

This step is done when you write one policy name, or you write "no match" and move to season, indexing, or the query list. traffic-drop guide separates a CTRCTRClicks divided by impressions, as a percentage. CTR shows how often people press the ad or the search result they saw.Open the glossary drop without an impression drop, a drop in both, and a position drop. Those three patterns are not a spam diagnosis.

Step 5: Fix the matching pattern, then lock the reread date

If the URL pattern did not fall in the 13-day window, stop. Do not rewrite pages whose numbers sat still. The click change you felt may sit outside the window, or in the wrong Search Console property.

If one policy matches, fix that pattern on every URL in the pattern, not on one sample page. For scaled content that does violate the policy, exclude it from Search as the policy page says. For doorways, leave a hierarchy a person can browse. For third-party content placed for ranking signals, take it off the host site.

Do not move the same pages to a new subdomain so they look like another site. Manual actions help says, in the manual-action fix steps, that moving to a subdomain or subdirectory may be read as an attempt to circumvent policy, and the action can widen. That sentence is not a September announcement. It is a reason to skip that shortcut.

Lock a reread date. An after window as long as the 15 dashboard days is 9 October through 23 October 2026. Data for the last day is usually available 2 to 3 days later, so read on or after 26 October 2026. Ignore a dotted line. Before that date you do not have a matching after window.

spam updates page says changes may help if systems learn over a period of months that the site complies. how long SEO results take covers timing for ordinary SEOSEOThe work of making your page easy to find and easy to choose in search results, without paying for ads.Open the glossary work. Do not place that month into one export next week. This step is done when 26 October is written in the note, with the policy you fixed or the sentence that says stop.

A simulation: a shop with city pages

Simulation with dummy data. Not a Rama Digital client. The fictional property is https://toko-contoh.example/. In this simulation, Manual actions shows a green check. Security issues is empty.

The homepage barely moves. The city-page group loses most of its clicks and impressions. That pattern resembles Google's doorway example: many city pages that funnel visitors to one destination. The next step in this simulation is to read 10 city URLs, not to send Request Review.

This simulation does not prove the September update was the cause. A seasonal query for city names can draw the same pattern. The next check opens the Queries tab for that URL group. If the queries are city name plus service, and the page only swaps the city name, the doorway policy is the first read. If the queries are the shop's brand, the cause is somewhere else.

Checklist before you change the site

1. The owner keeps the incident link plus 09:15, 01:00, and 01:37 PDT. The evidence is one dated note.
2. The owner exports Pages for 15 days and for 13 days. The evidence is two files, with clicks and impressions.
3. The owner opens Manual actions and Security issues. The evidence is both results, with no email visible.
4. The owner writes the URL pattern that holds the click difference. The evidence is a short list, not the whole sitemap.
5. The owner matches one policy, or writes no match and then checks season and indexing. The evidence is one policy section name, or one cause from the traffic-drop guide.
6. The owner does not send Request Review while the green check remains. The evidence is no new request in the message center.
7. Stop when the pages that earn money did not fall in the 13-day window. If they fell and one policy matches, fix that pattern, then read again on or after 26 October 2026. Before that date, do not say the pages have recovered.

When to do it yourself, and when to use an audit

Do steps 1 through 3 yourself when Search Console access sits on your email. Those three reports do not need an outside tool. A third-party chart does not replace the Pages export.

Ask for an audit when a URL pattern has fallen and you cannot point to one policy, or when Manual actions holds a finding that touches a directory which earns money. Do not ask for an audit only because a sensor wrote "volatility" on 25 September. Google did not publish a volatility figure for this incident.

Rama Digital recommendation: lock the 13-day window and the two report results first. Bring those to the conversation, not a chart capture with no date. An audit checks pages, queries, and AI answers. An audit does not raise rankings. On 11 October 2026, the service page lists a price starting at Rp 2.52 million. The scan finishes in 3 working days. The audit finishes in 2 weeks. You receive a gap list and a repair order.

Questions that follow a click drop

When did the September 2026 spam update start and finish? The Ranking dashboard records a start at 09:15 PDT on 24 September 2026. The incident header records an end at 01:00 PDT on 8 October 2026. The table row records the completion note at 01:37 PDT. Ranking history lists 13 days, 16 hours. The update applies globally and to all languages.

Does this update target link spam? Google did not write that target on the September incident. The title is "spam update", not "link spam update". The sentence about link benefits that cannot return applies to an update Google names as a link spam update. The paid-link policy still applies, apart from the incident title.

Does a green check in Manual actions mean the site is clear of this update? No. A green check means there is no manual action from a human reviewer. A spam update is a change to automated systems. A site can lose clicks on a URL cluster while the manual report stays empty.

How long does Google say recovery takes? The spam updates page says changes may help if automated systems learn, over a period of months, that the site complies with the policies. That is not a schedule, and it is not a promise. For a matching window after the rollout, read Search Console on or after 26 October 2026.

Should I send Request Review? Send it only when the Manual actions report lists a finding and that URL pattern is already fixed. If the report shows a green check, there is no manual finding to review. A reconsideration review usually takes several days or weeks.

Why does the daily chart show no cliff on 24 September? 24 September in Search Console is a partial Pacific day. The update starts at 09:15 PDT, which is 23:15 WIB. Part of that day happens before the update. 8 October sits almost entirely after the 01:00 PDT end field.

Next step

The limits above still apply. A click drop inside the window does not yet prove a cause, and recovery is not read before 26 October 2026. SEO Audit and AI Visibility Service checks the URL pattern, Search Console, and AI answers, then returns a gap list. book a 30-minute session when you want the 13-day export and the Manual actions result on one table before any repair.

Sources

• September 2026 spam update incident. Read 11 October 2026. 09:15 PDT, the 01:00 PDT header, the 01:37 PDT note, and the rollout sentence.
• Ranking history. Read 11 October 2026. The 13 day 16 hour duration, and the other 2026 spam and core update durations.
• incidents.json. Read 11 October 2026. The begin and end fields, and the text of the four 2026 spam updates.
• spam updates page. Updated 10 December 2025 UTC. The spam-update definition, SpamBrain as an example, and the recovery sentence measured in months.
• spam policies. Read 11 October 2026. The policy list and the ban on automated queries for rank checking.
• Manual actions help. The green check, Request Review, and the difference from Security issues.
• traffic-drop guide, comparison help, Performance discrepancy help, and About the data. How to compare ranges, Pacific Time, and data that is not final yet.