On this page
Four spam rounds in a year, and one rule Europe treats differently.
Google's September 2026 spam update finished rolling out on 8 October, after thirteen days and sixteen hours. It applied worldwide and in every language. It was the fourth spam update of the year and by far the longest: the three earlier rounds each finished within three days. No new update started after 8 October.
Between those rounds two rules arrived. A hijacked back button has been a violation since June, and manual actions for site reputation abuse no longer take effect for people searching in the European Economic Area since late August. Below: what that means for your site, and how to check whether you were hit.
Why a spam update calls for a different response than a core update
A spam update improves the systems Google uses to spot spam, such as SpamBrain. It hits sites that break the spam policies, and those can rank lower or drop out entirely. A core update, like the ones in March and May, reweighs how Google assesses every page, without anyone doing anything wrong. After a core update you improve your pages. After a spam update you remove what breaks the rules.
The March round took nineteen and a half hours, June two days, August almost three. September took nearly two weeks. Google gave no reason, and for your own site it does not matter: what counts is whether your drop started inside that window.
The rules that arrived this year
| Rule | What it is | What Google does | What you check |
|---|---|---|---|
| Back button hijacking | A script that sends visitors to another page or an ad when they press back | Manual action or automated demotion, worldwide | Scripts from ad platforms, plugins and libraries |
| Site reputation abuse, in the EEA | A strong site hosting third-party pages to rank on its reputation | The manual action does not take effect for searchers in the EEA; the affected section may rank on its own | Sponsored sections and partner coupon pages |
| Site reputation abuse, outside the EEA | Same practice | The manual action hits the affected section, not the rest of the site | The same, especially if you sell outside Europe |
| Scaled content abuse | Hundreds of pages made to rank, not to help | Lower rankings or removal | Pages per city or per keyword without substance of their own |
| Link spam | Bought or swapped links to gain positions | The benefit of those links is gone | Your backlinks and who paid for them |
The back button rule falls under what Google calls malicious practices. Google itself warns that the script often does not come from the site owner but from a library or an ad platform, and that the site is still responsible. The European exception follows talks with the European Commission under the Digital Markets Act; more in Google's DMA fine. For a French publisher with a coupon section, that means one manual action can now play out differently in Paris than in Montreal. Google still sends a Search Console notice for every manual action, and after a reconsideration request a site may qualify for mediation.
Step 1
Line up the dates
Did the drop start between 24 September and 8 October? Set a week after next to a week before.
Step 2
Which pages fell
Search Console, Performance, by page. The whole site or one folder?
Step 3
Check manual actions
A notice in Search Console says it in plain words. No notice: algorithmic.
Step 4
Hold it against the policies
Back button hijacking, reputation abuse, scaled content, link spam, hidden text.
Step 5
Fix and wait
Remove what breaks the rules. Algorithmic recovery comes over a period of months.
A drop without a notice and outside the rollout dates usually has another cause: technical, seasonal or competition.
Where an ordinary business site still goes wrong
A services site you wrote yourself rarely breaks the spam policies on purpose. The risk sits in what was added without you knowing. A plugin that puts links in your footer. A hacked WordPress install that shows Google pages in another language, but not you. An ad network script that redirects the back button. Read is WordPress safe if your site runs on it, and make sure your website maintenance actually reviews updates and scripts.
The quickest test takes two minutes. Search for your company on a phone, click through to your site, open one more page and press back twice. If you do not land back on Google, you have a problem, with or without Google: a visitor who gets stuck does not come back.
Link spam: what is gone does not return
Google puts it plainly: when an update neutralises spammy links, whatever benefit they once gave is lost, and cleaning them up will not bring it back. If you ever bought links to raise your domain authority, recovery does not lie in a reconsideration request but in pages that earn links on their own.
A hit site, clean again
- Find what breaks the policyScripts, pages, links. Start with what changed in the weeks before the drop, and run a technical check.
- Remove it fullyA script that hijacks the back button goes, even when it comes from your ad platform. Half switched off does not count.
- Request review if there is a noticeFor a manual action, file a reconsideration request in Search Console explaining what you did and when.
- Wait and measureWithout a notice it is algorithmic. Recovery comes once Google sees, over a period of months, that your site follows the rules.
No drop between 24 September and 8 October? Then this round did not hit you, even if your traffic moves later. Run the SEO checker for the technical basics. If your site disappeared from Google entirely, start with the website not showing on Google check, read how Google crawls in technical SEO, and go through the rest of your site with the SEO checklist.