Google began rolling out the September 2026 spam update on September 24, and as of today it is still in progress, with Google saying it may take up to two weeks to complete. Spam updates target sites that break Google's spam policies, not legitimate nonprofits by default. But three specific patterns still catch real organizations, and this is what to check.
The short version
- Google confirmed the September 2026 spam update on September 24, 2026. It applies globally and to all languages, and Google says it may take up to two weeks to finish, making it the slowest spam rollout Google has shipped.
- Spam updates are algorithmic, not manual penalties. There is no reconsideration form to file. You fix the underlying issue and wait for a later reassessment to reflect it.
- Nonprofits rarely spam on purpose, but three policies catch legitimate organizations anyway: site reputation abuse, scaled content abuse, and expired-domain redirects left over from a rebrand.
- If your organic traffic dropped this week, confirm the decline lines up with the September 24 rollout before you change anything. Most late-September dips are seasonal.
What Google actually announced
Google confirmed the update on its Search Status Dashboard on September 24, 2026, with a short note: "Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete."
The two-week window is the story. The August 2026 spam update wrapped in about two days. This one is scheduled to take up to two weeks, the longest spam-update rollout Google has run, which means rankings can keep shifting into early October. If you saw movement over the past few days, it may not be finished moving.
If you think you were hit, Google's spam updates documentation is the canonical starting point, and it points you back to the spam policies your site may be tripping.
Why "we are a nonprofit, this does not apply to us" is the wrong reaction
Google's spam policies apply to every page in the index. A 501(c)(3) designation is not a ranking signal, and "we do good work" is not a defense the algorithm evaluates. The three policies most likely to snag a mission-driven org are the ones Google added and sharpened in its March 2024 update: site reputation abuse, scaled content abuse, and expired domain abuse. Here is how each one shows up on a real nonprofit site.
Pattern one: site reputation abuse
Site reputation abuse is when third-party content sits on your domain mainly to borrow your ranking authority, with little oversight from you. Nonprofits walk into this more than you would think: a partner resource hub where outside organizations publish their own pages, a sponsored "guest article" section, a jobs board syndicated from a third party, or a blog where an outside agency posts keyword pages under your name.
A legal-services nonprofit I worked with had a partner resource section where affiliated organizations uploaded their own landing pages. Useful in theory. In practice it was a few hundred unreviewed pages riding on a domain with real authority, which is close to the exact pattern the policy describes. The fix was not complicated: put new submissions behind human review, noindex the thin pages already there, and move anything purely promotional onto a subdomain that does not inherit the main site's reputation.
Pattern two: scaled content abuse
Scaled content abuse is producing many pages whose primary purpose is ranking rather than helping a reader, and Google is explicit that it does not matter whether AI, humans, or both created them. The nonprofit version is rarely malicious. It is the agency that spun up three hundred near-identical "[service] in [city]" pages, the AI blog set to publish on autopilot, or program pages templated across dozens of locations with only the town name swapped.
The tell is simple. It is not that you used AI. It is whether a real person would miss the page if it vanished. If the answer is no, consolidate. Fold the templated pages into fewer strong ones, add information that is actually specific to each place or program, and turn off anything publishing without a human in the loop.
Pattern three: expired-domain redirects from a rebrand
Nonprofits merge and rebrand constantly, and the old domains they keep pointing at the new site are where expired domain abuse hides. The risk is redirecting an acquired org's domain wholesale at unrelated pages to harvest its backlinks, or 301-ing a decade of old campaign microsites straight into your donation page. When I ran a domain consolidation for a state association client, the temptation was to redirect every legacy URL to the homepage to "keep the link equity." That is the pattern Google flags. We mapped each old URL to its closest real equivalent instead and let the ones with no home return a clean 404 or 410. If you are planning a merge, I wrote up how I score pages before a migration so the redirect map is defensible.
How to tell if the update actually hit you
Before you touch anything, confirm the timing, because most traffic dips in late September are seasonal rather than algorithmic. Open Search Console, look at the last 28 days, and check two things: did clicks fall on or after September 24, and is the drop broad or concentrated in one section. A decline that started before the 24th is not this update. A drop confined to your resource directory or your templated program pages points straight at one of the three patterns above. And because the rollout may run into early October, check whether it has even finished before you draw conclusions.
What recovery actually looks like
Recovery from a spam update is slow and undramatic. Because these updates are algorithmic, fixing the problem does not restore rankings the next morning. Google's guidance is to review its spam policies, correct whatever violates them, and wait for its systems to reassess, which in practice can mean the next spam update, potentially months out. Do not panic-delete your whole blog. Fix the specific pattern, document what you changed, and hold the line.
What this does not cover
This post is about the spam update specifically, not the whole ranking picture. It does not cover core updates, which are a different system with different signals, or manual actions, which show up as a notice in Search Console and do have a reconsideration process. It also does not cover the AI Overviews and AI Mode visibility shifts running in parallel. If you have a manual action notice in Search Console, follow the reconsideration flow, not this one.
Frequently asked questions
Is the September 2026 spam update the same as a core update?
No. Core updates reassess overall quality and relevance across the index. Spam updates specifically target violations of Google's spam policies. They roll out separately, and a site can be affected by one and untouched by the other.
My nonprofit's traffic dropped this week. Is it the spam update?
Maybe. Confirm in Search Console that the decline started on or after September 24, 2026, and that it is concentrated somewhere logical, like a directory or a set of templated pages. Late-September dips are often seasonal, so match the timing before assuming the update is the cause.
How long until rankings recover if we fix the problem?
Not quickly. Spam updates are algorithmic, so improvements are reflected only when Google reprocesses your site, often at a later update rather than on demand. Plan for months, keep the fix in place, and resist the urge to keep changing things while you wait.
Does using AI to write our blog put us at risk?
Not by itself. Google's scaled content abuse policy targets pages built mainly to manipulate ranking, regardless of who or what wrote them. AI-assisted content that genuinely helps a reader is fine. Mass autopilot pages that help no one are the risk.
Where to start
Pick the one pattern most likely to apply to you and check it this week: your third-party and directory content, your templated pages, or your redirect map. This is the kind of check I run for nonprofit clients. If you want a second set of eyes before the rollout finishes, book a 20-minute read-out and I will tell you where you are exposed and what to fix first.