Google spam update: 5 signs your website is at risk

The September 2026 Google spam update lasted 13 days and 16 hours. It's the fourth one this year. If your Google traffic changed between 24 September and 8 October, this article is for you. And if it didn't, it still is: these are the 5 signs worth checking before the next one.

What changed with the Google spam update?

Google regularly improves its systems for detecting spam, meaning pages made to trick the search engine. It calls these improvements spam updates. The September one applied worldwide and in all languages.

Google didn't explain what kind of spam it was after this time. What its guidance does say is this: if your site loses traffic after one of these updates, review its spam policies.

What it means: if your site follows the rules, you have nothing to fear. What to do: compare your traffic before and after those dates. Why: a drop on exactly those days is the first clue that something is off.

Rule of thumb: a drop on those dates isn't bad luck; it's a clue.

What are the 5 spam signs that put your website at risk?

We took them from Google's spam policies. They're the ones we see most in small businesses.

• Lots of pages mass-produced with AI or templates, nearly identical and adding nothing new. Google calls this scaled content abuse.
• Links bought or swapped to rank higher, for example paying a blog to link to you.
• A section of your site written by another company to take advantage of your good name, like a third-party coupon page.
• Words repeated for no reason or hidden text, such as white letters on a white background.
• Pages on your site that you didn't create, often in another language. It's usually a sign someone got in without permission.

What it means: AI isn't banned. Google says using it appropriately isn't against its guidelines. What to do: ask yourself whether each page helps a person. Why: what it penalises is mass-producing pages for Google, not the tool you use.

If you use AI to write, see how to do it well in our guide to content strategies in the AI era.

How can you tell if the Google spam update affected your site?

Open Search Console, Google's free tool for seeing how people find you. Compare the two weeks before 24 September with the two weeks after 8 October. If clicks fall much more than usual, review the 5 signs.

To understand the tool properly, see our guide to AI SEO tools for small businesses.

The Garcai method: check your site for spam in 5 steps

You need one afternoon. No technical knowledge required.

1. In Search Console, look at the ‘Security & Manual Actions’ section. If it's empty, nobody at Google has penalised you by hand.
2. Compare your clicks before and after the update, as described above.
3. Search Google for ‘site:’ followed by your domain, with no space. You'll see your pages and can spot any you didn't create.
4. List the pages that look very similar. Merge the repeated ones or improve them with your own data.
5. If you've bought links or rent a section to another company, stop. According to Google, recovery can take months.

You can do it yourself: steps 1, 2, 3 and 4.

Ask your tech team, or whoever runs your website, if you find pages you didn't create. Ready-to-send message: ‘I've found pages on the site that we didn't make. Can you check whether someone got in without permission?’

Common mistakes after a Google spam update

• Thinking Google penalises AI, when it penalises mass-produced content with no value.
• Deleting pages at random without first checking which ones bring traffic.
• Buying an expired domain with a good reputation to host weak content. Google also treats this as spam.
• Expecting to recover in days: according to Google, it can take months.
• Never checking ‘Security & Manual Actions’ in Search Console.

Spam updates aren't aimed at you if your site helps real people. Check the 5 signs once a quarter and keep creating useful content. And if you also want AI to find you, read our guide to showing up in ChatGPT.