Google's September 2026 Spam Update: What NZ Businesses Should Check

Google started rolling out the September 2026 spam update at 9:15am US Pacific time on 24 September, which was 4:15am on Friday 25 September in New Zealand. It applies globally and to all languages, and Google says the rollout may take up to two weeks. If you run a normal NZ business website, the most useful thing you can do today is nothing drastic: note the start date, keep an eye on Search Console, and only act if a drop lines up with the rollout and with one of the practices Google’s spam policies describe.

That is the short version. The rest of this post covers what Google has actually said, how this update fits into a busy 2026, what happened to our own site during the last two spam updates, and a quick way to tell a spam-update drop from the far more common alternatives.

What Google Actually Said

Everything in this section comes from Google’s own pages. Nothing here is second-hand.

The Google Search Status Dashboard entry says Google “released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete.” Two weeks from the start date is 8 October.

Google’s page on spam updates explains the mechanics. Its automated spam systems, including an AI-based system it calls SpamBrain, run all the time. A “spam update” is a notable improvement to those systems. Google’s guidance for affected sites is to review its spam policies, and it is blunt about recovery: changes “may help a site improve if our automated systems learn over a period of months that the site complies.”

On links specifically, Google says that when its systems remove the effect of spammy links, “any ranking benefit the links may have previously generated for your site is lost,” and those benefits “cannot be regained.”

What Google has not said: which spam practices this update focuses on. Any article telling you this update “targets” a specific tactic is guessing. We will not.

Fourth Spam Update of 2026

Here is every ranking update Google has logged on its status dashboard since December 2025. Dates are as recorded on the dashboard.

Update	Started	Finished
December 2025 core update	11 Dec 2025	29 Dec 2025
February 2026 Discover update	5 Feb 2026	27 Feb 2026
March 2026 spam update	24 Mar 2026	25 Mar 2026
March 2026 core update	27 Mar 2026	8 Apr 2026
May 2026 core update	21 May 2026	2 Jun 2026
June 2026 spam update	24 Jun 2026	26 Jun 2026
August 2026 spam update	18 Aug 2026	21 Aug 2026
September 2026 spam update	24 Sep 2026	Rolling out (up to two weeks)

Two things stand out. This is the fourth spam update of the year, and the third in roughly three months. And the three earlier spam updates each finished within about three days, while this one comes with a two-week window. Google has not said why, so we will not speculate.

The practical point for a business owner: when updates arrive this often, a dip in any given week has a good chance of overlapping with some update. That makes it easy to blame Google for a drop that has a far more ordinary cause.

What Happened to Our Own Site in the Last Two

We pulled lucidmedia.co.nz’s own Google Search Console data for the seven days before and after the June and August spam updates started. Our site is not small or simple: we run hundreds of service and location pages alongside more than 200 blog posts, which is exactly the kind of footprint people worry about when a spam update lands.

Spam update	Clicks, 7 days before	Clicks, 7 days after	Avg position before	Avg position after
June 2026	145	150	25.8	24.4
August 2026	295	332	23.5	22.6

Neither update moved us in any meaningful way. The March spam update cannot be separated out, because the March core update started three days later. That core update is where our real drop happened: average position slid from around 12 to 15 in the fortnight before it to between 19 and 28 in the two weeks after it began.

This is one site, and it proves nothing about yours. What it does show is where our own risk sat this year: the update that moved our rankings was a core update, and the two spam updates we can measure left us where we were.

Spam Update, Core Update or Something Else?

Plenty of traffic drops have ordinary causes. Before you assume the spam update got you, work through this table in Search Console and GA4.

What you see	Where to check	Most likely cause
A message in Search Console about a policy violation	Security & Manual Actions, then Manual actions	A manual action, reviewed by a person at Google. Fix it and request a review.
Pages suddenly gone from Google, or impressions fall off a cliff	Pages report (indexing) and URL Inspection	A technical fault: a stray noindex, a robots.txt block, broken redirects after a site change
Rankings slide across the whole site during a core update window	Performance report, compared against the dashboard dates	A core update. Different problem, different fix.
Clicks down, but average position flat	Performance report: impressions vs clicks	Lower demand (seasonality) or fewer clicks per search, not a ranking loss
Leads down, but Search Console traffic steady	GA4 key events and your form submissions	Broken tracking or a broken form
A drop that starts inside the rollout window, on specific pages, and those pages match a spam policy below	Performance report, filtered to those pages	Possibly the spam update

That fifth row is not hypothetical. After our own site rebuild earlier this year, our GA4 recorded no sessions at all for February, March and April 2026 because the tracking tag did not make it across. The website was fine. The measurement was broken. If we had judged the site on analytics alone, we would have “fixed” a problem that did not exist.

When you compare periods, compare like with like: seven days against seven days, same country, same device, same search type. A Monday-to-Sunday week against a Wednesday-to-Tuesday week will mislead you.

The Spam Policies Most Likely to Catch a Normal NZ Business

Google’s spam policies list more than a dozen practices. Most (cloaking, sneaky redirects, malicious code) are not things a legitimate business does by accident. These six are the ones most likely to apply to an ordinary NZ business, often through a supplier rather than a decision the owner made.

Scaled content abuse. Google defines this as generating many pages “for the primary purpose of manipulating search rankings and not helping users,” and it explicitly includes using generative AI to produce many pages without adding value. For an NZ business, this looks like 80 AI-written blog posts published in a month, or a page for every suburb with only the suburb name changed. The policy says “no matter how it’s created,” so the question is whether the pages help anyone.

Doorway abuse. Pages built to rank for similar searches that funnel people somewhere else. Google’s examples include “multiple domain names or pages targeted at specific regions or cities that funnel users to one page.” City and suburb pages are not banned. Pages that exist only to catch a search and add nothing for someone in that city are the risk.

Link spam. Google’s policy lists buying or selling links for ranking purposes, including “exchanging money for links, or posts that contain links,” excessive link swaps, and automated link building. It is the one area where Google says lost ranking benefit cannot be regained, so it is worth knowing exactly what links point at your site and where they came from. If a past supplier sold you “500 backlinks” for a flat fee, that is the first thing we would look at.

Expired domain abuse. Buying an expired domain for its search history and filling it with unrelated, low-value content. If you have bought an old domain to redirect or rebuild, make sure what you publish on it genuinely relates to what it was.

Site reputation abuse. Publishing third-party content on your site mainly to borrow your site’s ranking strength. For a local business, this usually shows up as a “partner” who wants to publish sponsored articles on your blog that have nothing to do with what you do.

Hacked content. Injected code, hidden pages or spam links added through a security hole. Google treats it as spam whether or not you knew. Out-of-date plugins are a common way in, which is why we keep client sites patched rather than leaving them after launch.

One more line is worth knowing about. Google’s definition of spam explicitly includes “attempting to manipulate generative AI responses in Google Search.” If anyone is selling you tricks to force your business into AI Overviews, that line is aimed at them.

What to Do in the Next Two Weeks

If your traffic is steady, keep doing what you are doing. There is nothing to “prepare” for an update that is already rolling out.

If you see a drop:

1. Write down the date the drop started. Compare it to 24 September. A drop that began on 15 September was not caused by this update.
2. Check Manual actions and the Pages report first. They take five minutes and rule out the two causes you can fix fastest.
3. Find the specific pages that dropped. That tells you whether the drop lines up with any of the policies above, or with nothing in particular.
4. Hold off on big changes until the rollout finishes. Rankings can move during the two weeks. Rewriting or deleting pages mid-rollout makes it impossible to tell what caused what.
5. Then fix the cause, not the symptom. If pages match a spam policy, improve them or remove them. Google says recovery happens “over a period of months,” so a week of waiting will not tell you whether it worked.

And a few things not to do:

• Do not mass-delete content because a forum said the update is “about” AI. Google has not said what this update focuses on.
• Do not disavow links in a panic. Google describes the disavow tool as an advanced feature that “can potentially harm your site’s performance” if used incorrectly.
• Do not buy a “spam update recovery” package from anyone who has not first looked at your Search Console data.

If you would rather have a second pair of eyes on it, our free SEO audit checklist covers the technical and content checks above in a self-serve format. For a proper diagnosis, our SEO team will go through your Search Console with you and tell you plainly whether this update is your problem or not.

Further Reading

• Google’s March 2026 core update: who recovered, and why
• Google’s March and April 2026 core updates explained
• How NZ trades get to page one on Google