Your traffic dropped on August 18. Or maybe it did not, and you are just refreshing Search Console every ten minutes anyway. Either way, you are asking the same question: was that the spam update, and what do I do now?

Here is the honest answer. Google’s August 2026 spam update was real, it was fast, and for the sites it caught, it was brutal. One dataset shows top 10 pages were about 1.8 times more likely to fall out of the top 100 than in a normal week. But it does not mean every ranking drop is a penalty. And there is a twist most articles miss: Google started another spam update on September 24, and it is still rolling out as of September 29, 2026.

So before you delete a single page, read this. You will get the confirmed facts, the real numbers, the patterns analysts are seeing, the spam policies worth knowing, and a step-by-step plan that does not involve panic.

What Google Actually Confirmed (and What It Did Not)

Let us separate facts from rumours, because the SEO internet is very good at inventing the second kind.

According to the Google Search Status Dashboard, the ranking incident began on August 18, 2026 at 9:27 a.m. Pacific Time and ended on August 21 at 1:49 a.m. Pacific Time. As Search Engine Roundtable reported, Google called it a normal spam update for all languages and locations, and said little else.

That last row matters. One technical analysis points out that any claim about a specific target, such as link spam or scaled content abuse, is an assumption until Google says otherwise. Keep that in mind for everything in the “patterns” section below. Those are observations from real sites, not official statements.

2026 spam updates at a glance

This is the third spam update Google confirmed in 2026 before September arrived, according to Search Engine Journal. Speed varies a lot, so a short rollout tells you nothing about how much damage it did.

For context, the August 2025 spam update took almost four weeks, running from August 26 to September 22, 2025, per Search Engine Roundtable’s history.

The Numbers: How Hard Did It Hit?

SE Ranking compared the days around the update with a quiet baseline in late July, when no ranking update was confirmed. In that data, 16.71% of URLs that had ranked in the top 10 fell beyond position 100 for the same keyword, versus 9.2% in the baseline window. That is an 82% increase, or roughly 1.8 times the normal odds. The findings were reported by Search Engine Land.

The same dataset found a 12% increase in the share of URLs reaching the top 3 that had not even been in the top 20 before the update. In plain English: some pages fell off a cliff while other pages jumped up to take their place. That is not random noise. That is a reshuffle.

The bigger traffic picture

Spam updates are not the only thing squeezing organic traffic, so compare your own trend before blaming one event.

●  Chartbeat: its 2026 Publisher Playbook found Google Search referrals across its network fell 40.2% year over year (July 2025 to July 2026), after a 21.9% decline the year before. Discover fell 34.3%. The network leans toward news and media, so treat it as context, not a forecast for your site. Covered by Search Engine Journal.

●  AI Mode experiment: a University of Pennsylvania and Northeastern preprint tracked 1,100 US participants. Those forced into AI Mode clicked through to other websites 18.8 percentage points less often than regular Google users. The authors describe it as a forced, full-adoption scenario, so it is not a prediction for any one site.

●  Ahrefs: a study of about 14 billion pages found that 96.55% of pages get zero traffic from Google. The study dates from 2023, but the lesson stands: ranking is the exception, so the pages that do rank deserve careful protection.

The takeaway: clicks are getting harder to win from every direction. Losing rankings to a spam update on top of that hurts twice as much.

What Analysts Say Got Hit: Four Patterns From the Field

Glenn Gabe of GSQi reviewed sites that dropped after the update and shared four blinded case studies. He also notes that link spam updates are separate from general spam updates, so in his view August was not about links. Here is what he found.

Notice the common thread. It is not “AI.” It is scale without value: thousands of pages that exist because a system could generate them, not because a person needed them.

Two more details from Gabe’s write-up are worth remembering. First, a spam hit can spread across an entire domain instead of staying inside one section. Second, sites that drop in Google can also lose visibility in AI Overviews and AI Mode, and even in ChatGPT answers when it grounds its responses through Google.

Do you run a 30-page service site with a decent blog? These four cases are probably not you. But if you have cloned location pages, auto-generated tag pages or bulk AI articles, keep reading.

The September Spam Update Is Live Right Now

According to Search Engine Journal’s weekly roundup, Google began the September 2026 spam update on September 24 at 9:15 a.m. PDT. It applies globally and to all languages, and Google gave it a rollout window of up to two weeks, longer than any spam update this year. Google has not said what it targets.

That creates a measurement trap: today’s data can mix the effects of two updates. Here is how to stay sane.

1.  Annotate your dates. Mark August 18-21 and September 24 onward in your reports.

2.  Use the clean window. August 22 to September 23 is your cleanest “after August” period.

3.  Wait before judging September. Give it a few days after Google marks it complete. Early numbers mislead.

4.  Fix obvious problems now. A stray noindex tag or a hacked page does not need to wait for anyone’s rollout.

Spam Update vs Core Update vs Manual Action

These three get mixed up constantly, and the difference decides your next move.

So open Search Console and check Security & Manual Actions > Manual actions first. If it says no issues, that does not mean you are safe. It just means a person did not flag you. Google’s own spam updates documentation tells affected sites to review its spam policies, and notes that improvements can take months to be recognised.

Be wary of anyone promising recovery in 48 hours or a guaranteed win in seven days. No one can promise that, because no one controls Google’s timing.

Did the Update Actually Cause Your Drop?

Ask this first. Traffic falls for a dozen reasons: seasonality, competitors, a botched migration, a rogue noindex tag or plain bad luck. A page that slips from position 2 to position 5 loses a big chunk of clicks without any spam problem at all.

Now look at the shape of the loss. Is it:

●  Query-level (a handful of keywords)?

●  Page-level (specific URLs)?

●  Template-level (every page built from one layout)?

●  Directory-level (one folder, like /locations/)?

●  Site-wide (everything, all at once)?

The narrower the drop, the smaller the fix. Ten pages that lost traffic need ten page-level fixes, not a full site rebuild.

How to Investigate in Google Search Console (Step by Step)

1.  Set three date ranges. Before: August 4-17. Rollout: August 18-21. After: August 22 to September 23. Using September 23 as the end date keeps the September rollout out of your comparison.

2.  Open Performance and compare. Use the Compare option in the date filter. Look at clicks, impressions, CTR and average position together. Falling impressions with stable position points to lost visibility. Stable impressions with falling clicks can point to SERP changes such as AI features.

3.  Switch to the Pages tab. Sort by click difference and export. Tag every URL as service page, blog post, location page, category, product or programmatic page.

4.  Check the Queries tab. Did you lose branded queries (a sign of a bigger problem) or only generic ones?

5.  Split by country and device. A drop only in one country or only on mobile is rarely a spam problem.

6.  Run URL Inspection on your biggest losers. Confirm they are indexed, the canonical is what you expect, and the rendered page looks right.

A quick illustration. Imagine blog traffic is down 8%, service pages are down 12%, but location pages are down 70%. You have just found your suspect. Fix that template first instead of rewriting the whole website.

Google’s Spam Policies: The Checklist Behind Every Spam Update

Because Google did not name a target, your best defence is knowing the rulebook. These are the main behaviours covered in Google’s spam policies. Policies get added over time, so always check the live page for the current list.

●  Scaled content abuse: producing many pages mainly to manipulate rankings, whether by AI, automation, humans or a mix.

●  Thin affiliation: affiliate pages with product descriptions copied from the merchant and no original value.

●  Doorway abuse: many similar pages built to rank for slight query variations, all funnelling to the same place.

●  Scraping: copying content from other sites with little or no added value.

●  Keyword stuffing: loading pages with repeated terms to manipulate rankings.

●  Link spam: buying, selling or exchanging links to pass ranking signals, and excessive link exchanges.

●  Cloaking and sneaky redirects: showing search engines something different from what users see.

●  Hidden text and links: content placed on the page for crawlers but hidden from people.

●  Site reputation abuse: publishing third-party content on a trusted site to borrow its ranking power.

●  Expired domain abuse: buying old domains to host low-value content and lean on their past reputation.

●  User-generated spam: spammy comments, forum posts or profiles left open on your site.

●  Hacked content: pages or code injected into your site through a security hole.

●  Misleading functionality and malicious behaviour: sites that promise one thing and deliver another, or harm the visitor.

Print this list and walk your top 50 URLs through it. If you cannot honestly say “none of these apply,” you have found your starting point.

The 5-Point Audit: What to Check on Your Site

A spam update is a reason to audit, not a reason to bulldoze. Work through these five areas.

1. Scaled and low-value content

The question is never “was AI used?” The question is: what useful value does this page add that justifies its existence? Red flags include programmatic pages, scraped or lightly rewritten content, translated pages with no added value, database-generated pages, and bulk AI publishing with no human review. If dozens of pages share the same intro, the same FAQ and the same call to action and only the keyword changes, Google has good reason to shrug.

2. Location and doorway pages

Local pages are not spam. Cloned local pages are. Run this test: if you remove the city name, is the rest of the page identical to another location page? If yes, you have a problem. A strong local page includes real coverage details, local customer needs, service-specific examples, honest pricing context, genuine case studies and useful FAQs.

3. Keyword stuffing

Keywords still matter. Repetition does not. If a sentence reads like it was written for a crawler, rewrite it for a human. Build the topic around search intent, related concepts, real questions and clear examples instead of chasing a keyword density number.

4. Manipulative links

Look for unnatural patterns: piles of exact-match anchors, irrelevant directories, paid links meant to pass ranking signals, sitewide commercial links and sudden backlink spikes. But do not mass-disavow links just because a tool gave them a low score. A low-authority link is not automatically a toxic one. Also remember that when Google neutralises the effect of spammy links, that lost benefit may not come back by cleaning up later.

5. Duplicate and template content

Templates are normal. Duplicate purpose is the issue. For every suspect URL ask four things. Does it satisfy a unique intent? Does its main content differ from similar pages? Would a user benefit from landing on it directly? Does it earn impressions, links or conversions? If several pages do the same job, merge them into one stronger page.

Rule Out Technical Problems Before Blaming Spam

A ranking decline can be caused by a technical change that happened around the same time. Google’s John Mueller recently made a related point in a de-indexing case, where pages fell out of the index while an unrelated casino site appeared as their canonical. His advice, as summarised by Search Engine Journal, was to catch broken pages before Googlebot does, for example by fetching critical pages on a schedule and testing them before launch.

If your sitemap points to URL A, your internal links point to URL B and your canonical says URL C, fix that mess before you assume the spam update is responsible.

What to Do With Weak Pages

Do not delete everything that lost traffic. Match the action to the page’s purpose.

One firm rule: never redirect a pile of unrelated low-traffic pages to the homepage. It looks lazy to users and unhelpful to search engines.

Internal Links, Schema and AI Content: The Quiet Fixes

Internal linking

Important pages should be reachable through normal HTML links in context, not only through the sitemap. Look for orphan pages, key service pages with almost no internal links, and competing pages using identical anchors. A clean path such as Homepage > Service category > Detailed service > Supporting article helps users and crawlers alike.

Structured data

Schema should describe what is visibly on the page. Do not claim ratings, reviews or prices you cannot support. Zero errors in a validator does not mean the markup is honest. Accurate beats excessive.

AI content and AI search

AI-assisted writing is not automatically spam. Mass-producing low-value pages to catch search traffic is. A safer workflow: research, AI assistance, expert input, fact-checking, original examples, editorial review, then publish. Add first-hand experience, screenshots, case studies and real data. That is what generic AI text cannot copy.

There is also a newer angle. Search Engine Journal reported that on May 15, 2026 Google clarified that its spam policies also apply to attempts to manipulate generative AI responses in Search, including AI Overviews and AI Mode. So tricks aimed at “ranking in AI answers” carry the same risk as old-school spam.

The 6-Step Recovery Loop

Your first 7 days

Day 1:  Back up the site and record your current SEO settings.

Day 2:  Check Manual actions and Security issues.

Day 3:  Find the page groups and templates with the biggest losses.

Day 4:  Audit indexability, canonicals, redirects, robots and sitemaps.

Day 5:  Review sample pages for scaled content, duplication, stuffing and weak value.

Day 6:  Improve your highest-value pages first.

Day 7:  Validate technical fixes and set a monitoring baseline.

The 30-60-90 day view

Common Mistakes After a Spam Update

Panic causes more damage than the update itself. Avoid these:

✗  Deleting thousands of pages without checking which ones earn traffic, links or leads.

✗  Rewriting the entire website in one week.

✗  Mass-redirecting low-traffic pages to the homepage.

✗  Publishing hundreds of new AI articles to “make up” the traffic.

✗  Mass-disavowing links because a tool showed a low authority score.

✗  Changing every canonical or URL at once.

✗  Faking “last updated” dates in the sitemap.

✗  Requesting indexing again and again for the same URLs.

How Long Does Recovery Take?

Nobody can give you an honest fixed number. Technical fixes can show progress once Google recrawls. Content consolidation and architecture changes can take weeks. Spam-related recovery is slower: Google says automated systems may need months of sustained compliance before they recognise improvement, and it does not guarantee any specific ranking result.

Gabe’s field experience matches this. Sites can recover from spam updates, but only after the spam is cleaned up and Google sees the improvement over an extended period, usually months. He mentions some recoveries within a few months, including one example that took about five months. The hardest road belongs to sites whose entire business model is the problem, such as a fully automated thin affiliate build.

Local Businesses: Read This Twice

If you sell services in one city, you are less likely to be a spam-update victim, unless you cloned your pages. Review ranking changes at the service and location level, and check your Google Business Profile, review authenticity, local backlinks and enquiry numbers alongside rankings.

For example, an SEO agency in Kolkata or a digital marketing company in Kolkata should earn rankings with real local relevance: actual services, actual case studies, clear contact details and honest answers to local questions. Repeating the city name in every heading is the old trick, and it is exactly the kind of thing spam systems are built to discount.

Key Takeaways

✓  The August 2026 spam update ran August 18-21 and hit rankings harder than a normal week.

✓  Google did not say which policies it targeted, so treat every explanation as an informed guess.

✓  A September spam update started on September 24 and can run up to two weeks. Do not read your data too early.

✓  Field patterns point to scaled, programmatic, thin affiliate and misleading content, not to AI itself.

✓  Check manual actions, security and technical SEO before assuming a spam hit.

✓  Recovery is measured in months, not days. Anyone promising otherwise is selling something.

Frequently Asked Questions

When did the August 2026 spam update start and finish?

It began on August 18, 2026 at 9:27 a.m. Pacific Time and finished on August 21, 2026 at 1:49 a.m. Pacific Time, a rollout of 2 days and 16 hours. It applied globally and to all languages.

Does a ranking drop mean I got a penalty?

Not necessarily. Competition, seasonality, technical problems and migrations can all cause drops. Look at the pattern before making big changes.

I have no manual action. Was I still affected?

Possibly. Manual actions and algorithmic changes are separate. A site can lose rankings with no notice in Search Console.

Is AI-generated content spam?

No, not automatically. The risk is publishing content at scale mainly to manipulate rankings with little value for readers.

Should I delete pages that lost traffic?

Not automatically. Improve valuable pages first, and consolidate, noindex or remove only with clear evidence a page is redundant or low value.

Are location pages risky?

Not by themselves. Many near-identical pages that differ only by city name are risky.

Is there a September update too?

Yes. Google began a spam update on September 24, 2026, with a rollout window of up to two weeks.

How long can recovery take?

There is no fixed timeline. Technical fixes can show up quickly, while spam-related recovery can take months of sustained improvement.