Traffic dipped in early October? How to tell if Google's September spam update is the cause

If your website's visits sagged in late September or early October, Google's September 2026 spam update looks like the obvious culprit. It is also an unusually loose one to pin a dip on.

Google's dashboard lists this rollout at 13 days, 16 hours. The three earlier spam updates this year took 19 hours 30 minutes, 2 days 1 hour and 2 days 16 hours. By our estimate, September ran about two and a half times as long as those three put together: 328 hours against 132.5. It even outlasted the May 2026 core update at 11 days 21 hours, about 285 hours by our working.

A fortnight is a long time for a website. Plenty of ordinary things can happen inside it. A dip during the window does not on its own mean the update caused it: Google lists seasonality, technical issues, security issues, a site move and reporting glitches as other causes to rule out.

So treat the timing as a clue, not a verdict. Here is how we at Good Web Designer would check, and what we would leave alone while you do.

How long did this Google spam update run?

The short answer is nearly two weeks, start to finish. Google said up front it may take up to two weeks to complete, and it used almost all of that.

That length matters for how you read your numbers. A two-day update gives you a sharp before and after. A two-week one smears the change across a whole fortnight, so you need to compare three periods rather than two: the week before, the fortnight during, and the days since.

What is a Google spam update, and what was this one?

Google describes a spam update as a notable improvement to its automated spam-detection systems, with SpamBrain as one example.

This one began on 24 Sep 2026 at 09:15 PDT, and Google said it “applies globally and to all languages”. Google's dashboard keeps US Pacific time, so in eastern Australia the start fell in the early hours of 25 September. The dashboard then noted “The rollout was complete as of October 8, 2026”. By the time that note was posted, it was already the evening of 8 October here.

What it went after is unknown. Neither Google's spam updates page nor the dashboard notes say what the September rollout addressed or why it took longer. Treat any confident explanation of its targets with caution.

It was also not a core update. On Google's 2026 list, the latest core update is the May 2026 core update, started 21 May 2026, with none listed since when we checked in October 2026. The spam updates in March, June, August and September are separate from core updates.

Is your sudden drop in website traffic really the update?

Start in Google Search Console, not a rank tracker. Search Engine Journal's advice is plain: check Search Console first.

There is a good reason for that. SEOmonitor reported that many rank trackers showed sudden changes from 26 Sep. It put those down to incomplete and incorrect results Google returned to automated searches, and said real people searching did not see them. SEOmonitor also says spam-related changes usually hold for several days and are often reflected in Search Console impressions and clicks.

You may also see an early industry figure doing the rounds. Diib looked at 32,569 sites with connected Google Analytics and found the median share of visits from unpaid Google search fell from 34% to 31%, comparing 24 to 26 September with a week earlier. Diib itself called that “an early read, not a verdict”, and it does not show which sites Google flagged. It tells you nothing about your own site.

Google's own debugging guide gives a sensible set of checks:

• Set the date range to the last 16 months so a yearly dip shows up as a pattern.
• Use Compare against the previous period or the same time last year.
• Look at the Page indexing report and Crawl stats for technical faults.
• Open the Security Issues and Manual Actions reports.
• Check the Data Anomalies page for reporting glitches.
• Check Google Trends to see whether interest in your topic dropped across the web.

Clicks or impressions, a few pages or the whole site?

Once you have ruled out the ordinary causes, look at the shape of the drop.

If impressions are steady but clicks fall, the title and snippet may be the problem. People are still seeing you. They are just choosing something else.

Next, sort your pages by “Clicks Difference”. One or two pages losing ground is a different problem from every page sliding at once.

Then judge the size. Google's example of a small drop is position 2 to 4, and that needs no drastic action. A large drop, such as position 4 to 29, is the signal to self-assess the whole site for being helpful, reliable and people-first. Bear in mind that results are dynamic and positions are not fixed. Some movement is normal.

What not to do while you work it out

Panic edits do more harm than good. Google recommends avoiding radical changes to pages already performing well.

Google's guidance on core updates holds up here too. It warns against “quick fix” changes made because you heard something is bad for SEO, and treats deleting content as a last resort.

In practice that means:

• Do not rewrite every page in a weekend.
• Do not delete pages because a forum post said to.
• Do not change your page titles across the site unless your clicks, not your impressions, are what fell.

A plain spam-policy self-check for a small business site

If the checks above point back at the update, Google says sites that see a change should review the spam policies. The stakes are real: “Sites that violate our policies may rank lower in results or not appear in results at all”.

Most of the policies read like legal text, but a handful turn up on small business sites again and again:

• Keyword stuffing. This includes blocks of text listing cities and regions a page is trying to rank for.
• Doorway pages. For example, pages for many cities that funnel visitors to one page.
• Scaled content abuse. That is many pages made mainly to manipulate rankings, however they were created, including with generative AI tools.
• Link spam. This covers buying or selling links for ranking purposes, excessive link exchanges, automated link creation and widely distributed links in the footers or templates of various sites.
• Hidden text and links. These are on Google's list too.

Two exceptions save a lot of needless worry. Accordions, tabs, sliders, tooltips and text meant only for screen readers are not hidden-text spam. And buying and selling links for advertising or sponsorship is not a violation of Google's policies as long as the links are qualified with rel="nofollow" or rel="sponsored".

The rest of the list, cloaking, expired domain abuse, scraping and site reputation abuse, is rarer on a typical small business site, but worth a read if anything on it sounds familiar.

Hacked pages count as spam too

This is the one that catches honest owners out. Google treats hacked content as spam: injected code, injected pages, hidden links or text, and redirects that can depend on how the visitor arrived, such as a click on a Google result.

That last trick is nasty because you may never see it. You type your own address and your site looks normal. Google warns that existing pages may look fine while new spam pages sit on the site. Google's debugging guide says to check the Security Issues report in Search Console to find out whether Google detected a security threat on your site.

Keeping your software patched is the dull, reliable defence. Our routine for updating WordPress covers the site itself. The server matters too. This month's critical PHP release is a live example: business.gov.au says that, unpatched, the flaws could let attackers run their own commands on your server. It advises checking that your web developer, website host or IT provider has applied the patches, and, if you can't patch immediately, consider taking impacted websites or systems offline until you can.

How long can recovery take after a spam update?

Months, not days, and with no guarantee. Google says making changes “may help a site improve if our automated systems learn over a period of months that the site complies”. “May” is doing real work in that sentence.

There is one firm exception. After a link spam update, making changes might not bring an improvement, because any ranking benefit spammy links generated “cannot be regained”. Removing bad links stops the problem growing. It does not bring the old boost back.

So the honest plan is slow and steady. Fix what breaks a policy. Improve what helps your customers. Then give it time and watch Search Console rather than a daily rank checker.

Your next step: keep a baseline for the next dip

The hardest dips to read are the ones with nothing to compare against. If Search Console is not connected to your site yet, connect it now. In a few months you will have your own before, during and after for whatever Google changes next, and the 16-month view will start to fill in your seasonal pattern.

If you would like to talk through a dip you are seeing, or work out which of these checks matter for your site, get in touch with Good Web Designer through our contact page.

Sources

• https://status.search.google.com/incidents/XhUDXP7A67iHCD2kmbVu
• https://status.search.google.com/products/rGHU1u87FJnkP6W2GwMi/history
• https://www.searchenginejournal.com/google-september-2026-spam-update-complete/592283/
• https://developers.google.com/search/docs/monitor-debug/debugging-search-traffic-drops
• https://developers.google.com/search/docs/appearance/spam-updates
• https://developers.google.com/search/docs/essentials/spam-policies
• https://developers.google.com/search/docs/appearance/core-updates
• https://business.gov.au/news/critical-vulnerabilities-found-in-php