Google's September 2026 Spam Update: Which Spam Policies an Online Store Can Trip, and What to Check If Traffic Dropped

Google's Search Status Dashboard lists a "September 2026 spam update" starting on 24 September 2026, five weeks after an August spam update that began on 18 August and ran for two days and sixteen hours. A store that watched its organic traffic move in the last week of September will want to know whether this is why, and the useful answer starts with what Google says a spam update is rather than with what commentators say it targets.

This is Google's own description of the update, the spam policies among its sixteen that an ordinary online store can break without intending to, what to check if traffic moved after the 24th, and what Google says about getting back.

Google: "SpamBrain is our AI-based spam-prevention system. From time-to-time, we improve that system to make it better at spotting spam and to help ensure it catches new types of spam." When it does, "we refer to this as a spam update" and the date goes on the dashboard. That is the whole of what Google has said about September's: the name and the start date. It has not said which techniques this one is better at catching, and nothing here guesses.

The consequence of being caught is stated on the spam policies page: "Sites that violate our policies may rank lower in results or not appear in results at all." And the advice to a site that saw a change is the same every time: review the spam policies and make sure the site complies with them.

So a spam update is not an algorithm change in the sense a core update is. It does not re-weigh what makes a page good. It gets better at identifying pages built to manipulate rankings, and a site that was not doing that should see nothing. Most stores are in that position. The ones that are not usually got there by accident, through a supplier, a plugin, a content tool or a previous agency.

Google lists sixteen spam policies. Several are about hacking, malware and cloaking and are not accidents. These are the ones a store can walk into.

Scaled content abuse. "Many pages generated for the primary purpose of manipulating search rankings and not helping users." A store that generated a landing page for every keyword variation, a blog post for every search term in a tool export, or a collection page for every colour of every product with the same paragraph on each, has built exactly this, and generative tools make it a morning's work.

Thin affiliate pages. Affiliate content where "product descriptions and reviews are copied directly from the original merchant without any original content". The store-side version is the reverse: product pages carrying the supplier's paragraph, identical to forty other retailers'. Product descriptions and supplier feeds is the longer argument for why that copy was never ranking anyway.

Scraped content. Content taken "from other sites, often through automated means" and hosted "with the purpose of manipulating search rankings". Review widgets that import reviews written elsewhere, specification tables lifted from a manufacturer, and blog sections fed by a feed all qualify.

Doorway abuse. Pages created to rank for specific queries that funnel users to another page rather than answering there. City pages for a store that ships everywhere, size or colour pages that all redirect to one product, and search-result pages indexed as landing pages are the common forms. Why Shopify collection pages do not rank covers the related problem of collections with nothing on them.

Site reputation abuse. "Publishing third-party content mainly because of that host site's already-established ranking signals." A store that lets a partner publish coupon pages, guest posts or an unrelated blog on its domain for the traffic is the host in that sentence.

Expired domain abuse. Buying an expired domain and repurposing it "primarily to manipulate search rankings by hosting content that provides little to no value". A brand that bought a lapsed domain for its history rather than its name should read that twice.

Keyword stuffing, hidden text and user-generated spam. Filling a page "with keywords or numbers in an attempt to manipulate rankings", text placed where humans will not see it, and spammy content added through reviews, Q&A or comments. The last one is a moderation job the store may not know it has.

Link spam. Links created "primarily for the purpose of manipulating search rankings". Google's note on this one is the harshest on the page: when the effect of spammy links is removed, "any ranking benefit the links may have previously generated for your site is lost" and "cannot be regained". A store that paid for links in 2023 and ranked on them will not get that ranking back by removing them; it will have to earn the position again.

First, whether it moved at all in the organic line, by page type, in Search Console, rather than in a total that includes paid, social and the AI channels. A drop concentrated on one page type (the blog, the collections, the location pages) points at a policy; a drop across everything points elsewhere. The Shopify SEO guide for a store that has to rank is the baseline for what each page type should be doing.

Second, whether anything on the site matches a policy above, honestly. The pages most stores find are the ones nobody remembers making: the programmatic landing pages, the imported blog, the partner's section. Third, whether any of those pages earn their place by being useful to a shopper, which is Google's test in every policy's wording. A page that helps users is not spam however it was made; a page made for rankings is spam however good it looks.

Then fix or remove. Remove what exists only to rank. Rewrite what a shopper would read if it said something. Add structured data to what remains, because structured data for online stores is how a search engine confirms a product page is a product page. And do not expect the graph to turn the next week.

Google's sentence on timing is the one to plan around: changes to comply "may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies." Months, not days, and learn rather than reindex. A store that cleaned up in October should read its organic line in the new year, not at the end of the month, and should spend the interval on the thing a spam update does not touch, which is making the pages that remain the most useful answer to the query. eCommerce SEO against marketplace optimisation explains why that work is different from the listing work on Amazon, and why it compounds.

We audit a store against the sixteen policies in Google's wording rather than in a tool's score, find the pages nobody remembers making, and decide page type by page type whether to remove, rewrite or keep, then build the content that earns the rankings back over the months Google says it takes. That is part of our eCommerce SEO work. If your organic traffic moved in the last week of September, the first hour of that audit usually says whether this update is the reason.