Google's September 2026 Spam Update: What South African Businesses Should Check (and When Not to Panic)
If your website's Google rankings have jumped around over the past week, you're not imagining it. Google is in the middle of a spam update, and rankings often move while one rolls out.
For most legitimate South African businesses, a spam update is nothing to fear. But it's a good moment to check your site properly, understand what's happening and avoid rushed changes that do more harm than good. This guide explains what we know, how to tell whether a ranking drop is real, and what to do if your site has been affected.
What is a Google spam update?
A spam update is an improvement to the automated systems Google uses to find websites that break its spam policies. Sites that break those policies may rank lower, or disappear from results entirely.
It's different from a core update. A core update changes how Google judges the quality and relevance of pages across the web. A spam update is narrower: it targets manipulative tactics. If your site is built on honest, useful content, a spam update should not be aimed at you.
What we know about the September 2026 spam update
When it started: Google began rolling out the update on 24 September 2026, according to its Search Status Dashboard.
Who it affects: it applies worldwide and in all languages, so South African websites are included.
How long it will take: Google says the rollout may take up to two weeks. Counting from the start date, that points to around 8 October. That's a maximum estimate, not a guarantee.
How it compares: it's the fourth spam update of 2026, following March, June and August. Those three were much faster. March took about 19 and a half hours, June about two days, and August about two days and 16 hours.
What it targets: Google hasn't said whether this update focuses on a particular spam policy or tactic. Google described it as a normal spam update.
The honest summary: Google has told us when, where and roughly how long, but not what. Be wary of anyone claiming to know exactly what this update is hunting for.
Is your website at risk?
Most small business websites have nothing to worry about. Sites are at risk when they rely on tactics that break Google's spam policies. The most common ones we see in South Africa are:
Mass-produced, low-value content. Dozens of near-identical pages or AI-written articles published to capture keywords, with little real information. AI-assisted content is not a problem in itself. Publishing it at scale without adding value is.
Location page spam. Copies of the same service page with only the town name swapped, such as "Plumber Paarl", "Plumber Wellington", "Plumber Stellenbosch", with no genuinely local detail.
Keyword stuffing and hidden text. Repeating phrases unnaturally, or hiding text from visitors.
Hacked content. Spam pages or links injected into a site through an outdated plugin, theme or weak password. Many business owners don't know it has happened.
Bought links and link schemes. Paying for links or joining link-swap networks to inflate rankings.
Misleading behaviour. Google continues to add to its policies. In 2026 alone it introduced a policy against "back button hijacking" and updated its site reputation policy.
If none of these apply to your site, a ranking dip during the rollout is more likely to be normal movement than a penalty.
How to tell if a ranking drop is real
Don't judge by one search you ran on your phone. Rankings change by location, device and search history. Use data instead.
Open Google Search Console. Go to Performance and compare the last 7 days with the previous period. Look at clicks, impressions and average position.
Check the timing. Did the change start on or after 24 September? If it started earlier, the update is probably not the cause.
Check which pages moved. Look at the Pages tab. A drop on a few pages suggests a page-level issue. A sharp drop across the whole site is more serious.
Check the Security & Manual Actions section. If Google has taken manual action against your site or found hacked content, it will tell you there.
Wait for the rollout to finish. Rankings can move up and down while an update is still rolling out. Google's advice is to review your Search Console data and consider the timing before drawing conclusions.
Compare with enquiries. Check Google Analytics 4 for form submissions, calls and sales. A small rankings wobble that doesn't affect enquiries rarely needs action.
If you haven't used Search Console's reports much, our guide to Google Search Console's new AI report and our GA4 beginner's setup guide walk through the basics.
Other reasons your rankings might move
Not every drop during an update is caused by the update. Before changing anything, rule out:
Seasonality. Many South African industries slow down or pick up around school holidays, month-end and the festive season.
Competitors. A competitor may have launched a new site, published strong content or started paid ads.
Technical problems. A broken page, slow loading, an expired SSL certificate or a site change that accidentally blocked Google.
AI features in search. AI Overviews and AI Mode can reduce clicks even when your rankings haven't changed.
General volatility. Google changes its results constantly, and some weeks are simply bumpier than others.
What to do if your site has been hit
If the rollout has finished and you've confirmed a real, sustained drop that lines up with the update:
Don't panic-edit your whole site. Large, rushed changes make it harder to know what worked.
Read Google's spam policies and honestly compare them with your site.
Remove or improve the problem content. Merge thin location pages, rewrite or delete low-value articles, and remove any paid or spammy links you control.
Check for hacking. Update your CMS, plugins and themes, change passwords and scan for unfamiliar pages.
Keep a record of what you changed and when, so you can match changes to results.
Be patient. Recovery from a spam update can take months, because Google's systems need time to see the improvements.
A proper SEO audit is the fastest way to find what's holding a site back, especially if you're not sure where to start.
How to protect your site from future updates
The best protection is a site Google has no reason to treat as spam:
Publish content that answers real customer questions, written from real experience. Our guide to AI-ready website content shows how.
Build trust with clear business details, reviews and author information. See website trust signals.
Keep your website software updated and secure.
Earn links through genuine relationships, not payment.
Accept that good SEO takes time. Our SEO timeline guide explains what realistic progress looks like.
Frequently asked questions
Will the September 2026 spam update affect South African websites?
Yes. It applies worldwide and in all languages. But it only targets sites that break Google's spam policies.
How long will the update take?
Google says up to two weeks from 24 September 2026. It may finish sooner.
My rankings dropped this week. Have I been penalised?
Not necessarily. Rankings often fluctuate during an update. Wait until the rollout is complete, then check Search Console before making changes.
Does Google penalise AI-written content?
Not because it's AI-written. Google targets content produced at scale mainly to manipulate rankings, whether a person or AI wrote it.
How do I know if my website has been hacked?
Check the Security Issues report in Search Console, search "site:yourdomain.co.za" on Google for pages you don't recognise, and make sure your CMS and plugins are up to date.
Worried about your rankings?
If your traffic or enquiries have dropped and you're not sure why, Aquawave Web Designs can review your Search Console data, check your site against Google's spam policies and give you a clear plan. We also monitor Google updates for clients on our Ongoing SEO Services, so you don't have to. Book a free consultation to get started.
Comments