If you run a website in 2026, you have probably noticed that Google's spam updates no longer arrive once or twice a year. They arrive almost every quarter. The September 2026 spam update, which began rolling out on September 24, is the fourth confirmed spam update of the year, following the March, June and August releases. It is also the first one in 2026 that Google said could take up to two weeks to finish, which makes it noticeably different from the short, sharp updates that came before it.
For anyone running a WordPress, Joomla or headless CMS site, this is worth paying attention to. Spam updates are not core updates. They don't reward "better" content in a broad sense. They exist to find pages and sites that break Google's spam policies and push them down or out of the results. If your site gets caught, the damage tends to be steep, and recovery is slow.
This guide covers what we know about the update, how it fits into Google's 2026 pattern, why CMS-based sites are often exposed without their owners realising it, how the iGaming niche fared, and what you can do to audit your own site.
What Google Actually Announced
Google's announcement on its Search Status Dashboard was brief, as usual. The company said it had "released the September 2026 spam update, which applies globally and to all languages," adding that "the rollout may take up to two weeks to complete."
That is about all the official detail there is. Google did not name a new spam policy, did not say the update was aimed at link spam, and did not single out any particular tactic. Like the March and August updates, it reads as routine enforcement of the existing spam policies, powered by SpamBrain, Google's machine-learning spam detection system.
What made it stand out was the timeline. Rather than one clean drop, the SEO community tracked at least two distinct waves:
September 25–27: the first wave of ranking volatility, picked up by most rank-tracking tools within a day of the announcement.
September 30: a second, clearly separate wave. Glenn Gabe, who studies algorithm updates closely, reported receiving emails from several site owners who saw "a huge drop right on 9/30."
As of this writing (October 6), the update is still within its announced two-week window, so further movement is possible. If your traffic looked fine at the end of September, don't assume you're in the clear until Google confirms the rollout is complete.
How It Fits Into Google's 2026 Spam Update Pattern
Looking at the four 2026 spam updates side by side shows a clear shift in how Google runs enforcement.
UpdateStart dateApproximate rolloutMarch 2026 spam updateMarch 24Around 19.5 hoursJune 2026 spam updateJune 24About 2 daysAugust 2026 spam updateAugust 18About 2.5 days (complete August 21)September 2026 spam updateSeptember 24Up to 2 weeks (in progress)
For comparison, 2025 had only one spam update, in August, and it ran for close to a month. In 2026, Google has moved to more frequent releases, and three of the four finished in days rather than weeks. The March update was the fastest spam rollout on record. The common reading among SEO analysts is that SpamBrain already knows what it's looking for before an update starts, so the rollout is mostly about applying decisions that have already been made.
That makes September's two-week window interesting. A longer rollout with distinct phases suggests Google may be applying more than one classifier, or rolling changes out in stages to watch the effects. Google hasn't confirmed either, so treat that as an informed guess rather than a fact.
The practical takeaway is simpler: the gap between spam updates is now short enough that you can't wait for "the next one" to fix things. If you have a problem, you'll likely be re-evaluated within a couple of months whether you've cleaned up or not.
A Quick Refresher on Google's Spam Policies
Since Google rarely says which policy an update targets, it helps to know what the policies actually are. Most of the damage in recent years has come from a handful of them, including three that Google introduced in March 2024:
Scaled content abuse. Producing large numbers of pages mainly to manipulate rankings rather than to help readers. This covers AI-generated pages, but also human-written or templated content made at scale with little original value. How the content is made isn't the issue. Why it exists is.
Site reputation abuse. Often called "parasite SEO." This is when third-party content is published on an established site to borrow its ranking signals, with little oversight from the host. Coupon sections, sponsored "partner" directories and casino review subfolders on news sites have been typical examples.
Expired domain abuse. Buying an expired domain with existing authority and repurposing it for unrelated, low-value content.
Link spam. Buying or selling links that pass ranking credit, large-scale link exchanges, and automated link building.
Cloaking, sneaky redirects and doorway pages. Showing different content to users and search engines, or creating many near-identical pages to funnel visitors elsewhere.
Hacked content and user-generated spam. Content injected into a site without the owner's permission, or spam posted in comments, forums and profiles.
That last group matters most for ordinary site owners, because you don't have to do anything wrong on purpose to be affected.
Why WordPress and CMS Sites Are Often Exposed
WordPress powers a huge share of the web, and that makes it the most common place for spam to show up on otherwise legitimate sites. In our experience, most CMS-based sites that run into spam problems fall into one of these traps.
Hacked content you don't know about
The classic case is a vulnerable plugin or theme that lets an attacker inject pages, often thousands of them, promoting pharmaceuticals, replica goods or gambling. These pages are frequently cloaked, so they show to Googlebot but not to logged-in admins. You can browse your own site for months and never see them.
Signs to look for in Search Console include a sudden jump in indexed pages, unfamiliar URLs in the Pages report, and search queries in a language your site doesn't publish in. A site: search on Google (for example, site:yourdomain.com casino or site:yourdomain.com viagra) is a quick sanity check.
Comment and user-generated spam
If you allow comments, registrations or forum posts, you're hosting user-generated content, and Google holds you responsible for it. Open comment sections and unmoderated bbPress or BuddyPress installs are common sources of spammy outbound links. Use moderation, an anti-spam plugin and the rel="ugc" or rel="nofollow" attribute on user-submitted links. WordPress adds nofollow and ugc to comment links by default, but some themes and plugins override it.
Thin, templated and auto-generated pages
CMS platforms make it easy to create pages in bulk. Tag archives, author archives, attachment pages, location pages generated from a spreadsheet, and AI-assisted posts published in batches can all look like scaled content if they add little value. WordPress tag pages with one post each, or "best [service] in [city]" pages that differ only in the city name, are classic examples.
Ask yourself: if this page didn't exist, would anyone miss it? If not, consider merging it, improving it, or setting it to noindex.
Sponsored sections and "partner content"
Many publishers have quietly added sponsored subfolders or category pages run by third parties. Since Google's site reputation abuse policy came in, this has been one of the riskiest things a site can do. If someone else writes and controls the content, and it has nothing to do with your site's main topic, it's a liability. Either bring it under real editorial control or remove it.
Old link-building habits
Plenty of older WordPress sites still carry the remains of past link-building campaigns: footer links from themes, sitewide blogroll links, guest posts with keyword-rich anchors. Paid links should be marked rel="sponsored". Links that look manipulative and serve no reader purpose are worth cleaning up.
Manual Actions vs Algorithmic Demotions
One point of confusion after every spam update is whether you've received a "penalty." There are two different things to check.
A manual action is applied by a human reviewer at Google. It appears in Search Console under Security & Manual Actions, tells you which policy was violated, and gives you a way to request a review once you've fixed the problem.
An algorithmic demotion from a spam update shows no message anywhere. Your traffic simply falls, usually around the dates of the rollout. There's no reconsideration request. You fix the issues and wait for Google's systems to process the site again, which Google itself says "may take months."
If your traffic dropped during the September 24 to early October window and there's nothing under Manual Actions, you're most likely dealing with an algorithmic adjustment.
iGaming SEO and the September Spam Update: Trust Wins, Thin Content Loses
Few niches feel spam updates as sharply as iGaming. Online casino and betting search is extremely competitive, the commissions are high, and for years that encouraged fast tactics: thin comparison pages, doorway pages for every geo, scraped reviews, expired-domain casino sites and casino folders hosted on unrelated news sites. Industry coverage of the June 2026 spam update already listed those exact patterns as the main risks for iGaming publishers, along with large volumes of templated bonus pages and auto-generated casino descriptions. The September update looks like a continuation of that cleanup. Sites built on thin pages lost ground again, while sites that look like real resources for players held or improved. A good example is Spinbob. In our checks at the time of writing, spinbob1.com sits in the top position for Spinbob searches in its main market, the UK. It didn't get there with a trick. The site answers the questions players actually have: there's a dedicated support and help section, a detailed FAQ, and step-by-step guides for the problems players run into most often, such as login and registration issues, KYC verification, withdrawal delays and blocked accounts. It also covers responsible gambling tools like deposit limits, time-outs and links to UK support services. From Google's point of view, that's a site with a clear reason for every page to exist, which is exactly the test spam classifiers apply. The lesson for anyone in iGaming is that trust signals and real user support content are no longer optional extras. They are what separates a site that survives a spam update from one that disappears.
Gambling content is for adults aged 18+ only. If gambling is affecting you or someone you know, free and confidential help is available at BeGambleAware.org or through the National Gambling Helpline on 0808 8020 133 (UK).
How to Audit Your Site After the Update
Whether you've seen a drop or not, the September update is a good prompt for a spam-focused audit. Here's a practical checklist for CMS sites.
1. Line up your traffic with the rollout dates
In Search Console, compare clicks and impressions before September 24 with the days after, and look specifically at September 25–27 and September 30. A drop on those dates is a strong signal. A gradual decline that started earlier probably has another cause, such as a core update, seasonality or a technical problem.
2. Check Manual Actions and Security Issues
Both reports are in Search Console. If either shows a problem, deal with it first, because it gives you a direct path to recovery.
3. Audit your indexed pages
Export the list of indexed URLs and look for anything you don't recognise, unusually high page counts, or large groups of near-identical pages. On WordPress, check for indexed attachment pages, tag archives with one post, paginated archives and leftover test content.
4. Scan for hacked content
Run a security scanner, check your plugins and themes against known vulnerabilities, and remove anything abandoned or nulled. Look for unfamiliar admin users, modified core files and odd entries in your database. Make sure your server isn't serving different content to Googlebot by using the URL Inspection tool to view the rendered page as Google sees it.
5. Review sponsored and third-party content
List every section of your site that's written, controlled or paid for by someone else. If it isn't closely tied to your site's main purpose, or you don't review it editorially, it's a site reputation abuse risk.
6. Clean up links
Make sure paid and affiliate links use rel="sponsored", user-submitted links use rel="ugc", and old link-building leftovers are removed. You usually don't need a disavow file unless you have a manual action for unnatural links or know of a specific paid-link problem.
7. Prune or improve thin content
Merge overlapping articles, improve weak pages that have real search demand, and noindex or delete pages that exist only to target keyword variations. Be selective. Deleting good content in a panic causes as much damage as the update itself.
8. Document everything and be patient
Keep a simple log of what you changed and when. Recovery from a spam update is rarely fast. Google's systems need to recrawl and reassess the site, and with spam updates now arriving every two to three months, the next one is often when you'll see whether your fixes worked.
What This Means for the Rest of 2026
Four spam updates in seven months tells you where Google is heading. Enforcement is becoming a continuous process rather than an occasional event, and the updates are getting faster to roll out and harder to see coming. Combined with the growth of AI answers in search, which already reduces clicks to many sites, there is less room than ever for pages that don't earn their place.
For site owners, this is mostly good news, provided you're doing the work. The sites that came through the September update in good shape tend to share the same traits: they're secure, they're well maintained, they have a clear topic, and they answer real questions from real users, whether that's a WordPress tutorial blog or a casino support centre. That's not a new idea. Google just keeps enforcing it more often.
Frequently Asked Questions
When did the Google September 2026 spam update start?
Google began rolling out the September 2026 spam update on September 24, 2026. It said the rollout could take up to two weeks and applies globally and to all languages.
Is the September 2026 spam update finished?
As of October 6, 2026, Google had not yet confirmed that the rollout was complete. SEO trackers recorded ranking waves on September 25–27 and again on September 30.
How is a spam update different from a core update?
A core update reassesses content quality and relevance across the web. A spam update targets pages and sites that break Google's spam policies, such as scaled content abuse, site reputation abuse, link spam, cloaking and hacked content.
How do I know if my site was affected?
Compare your Search Console traffic before and after September 24, with particular attention to September 25–27 and September 30. Check the Manual Actions report too. If there's no manual action but traffic fell on those dates, you're likely dealing with an algorithmic demotion.
How long does it take to recover from a spam update?
Google says sites that fix spam issues may need months before its systems recognise that the site now follows its policies. Cleaning up promptly and documenting changes gives you the best chance at the next update.
Can a WordPress site be hit by a spam update without doing anything wrong?
Yes. Hacked content injected through vulnerable plugins or themes, unmoderated comment spam and poorly controlled third-party content can all trigger spam signals, even if the owner never meant to break any rules.