Google Spam Update September 2026: What Got Hit and Why

The Google spam update September 2026 started rolling out on 24 September 2026, and one day in it is hitting the same four kinds of site the August spam update hit: exact match domains, sites with no defined entity, one article spun across hundreds of locations, and thin location pages. Kasra Dash tracks 13,000 sites with no defined entity and 3,500 exact match domains, and this page is what that data shows so far, with the fixes. By the end you will know whether your site fits one of the four patterns and what to change this week.

The update is still rolling out. Sites in the numbers below may drop further, and a few will recover. I will update this page as the rollout completes.

What is the Google spam update September 2026?

The Google spam update September 2026 is a spam-focused update to Google Search that Google announced on 24 September 2026 and is still rolling out. It follows the August 2026 spam update by roughly three weeks. In the data I track, it targets the same things: exact match domains, sites Google cannot identify as an entity, spun content, and location pages that swap one word.

Everything below is from sites and domains I track, not from Google’s announcement. Google’s spam updates page is the primary source for the rollout dates: Google Search Status Dashboard.

Who got hit: the four patterns

Four kinds of site were hit in the August 2026 spam update, and the same four are being hit in the September 2026 spam update.

Pattern	August 2026 spam update	September 2026 spam update (day one)
Sites with no defined entity (13,000 tracked)	65% hit	a further 40% of those hit
Exact match domains (3,500 tracked)	48% hit	a further 25% hit
One article spun across locations	hit in both updates	hit in both updates
Thin location pages (one word swapped)	hit in both updates	hit in both updates

Day-one numbers move. Treat the September column as a floor, not a final figure.

1. Exact match domains

Exact match domains lost rankings in both the August and September 2026 spam updates. In August, 48% of the 3,500 exact match domains I track were hit. On day one of the September update a further 25% were hit.

An exact match domain is a domain that is the keyword: bestplumberleads.co.uk, for example. An exact match domain makes it harder for Google to assign an entity, because Google cannot tell whether the name is a brand, a service or a description. When the name is ambiguous, there is nothing for Google to trust when a spam update asks “who is this?”.

Exact match domains still work in some cases, and I have ranked them. The point is the trend across two updates in a row, not that every one is dead.

2. Sites with no defined entity

Sites with no defined entity were the biggest loser in the August 2026 spam update: 65% of the 13,000 I track were hit. On day one of the September update, a further 40% of those sites were hit again.

A defined entity means Google can answer four questions about your business from what it finds across the web. If you fail all four, you are a stranger to Google, and strangers get hit first.

The four checks:

The same business name everywhere. Site, Google Business Profile, directories, social profiles. One spelling.
One address that matches every listing. Google Business Profile, the footer of your site, every citation, Facebook and other social profiles. This is the NAP check: name, address, phone number, identical everywhere.
Real photos with real people. Not stock. Sites that lean on stock photos have looked less trustworthy for four or five years and keep getting hit over time.
Other websites mentioning your brand. Sites you do not own, saying who you are.

If you have two or three of the four, work on the ones you are missing. If you have none, that is the whole job.

3. One article spun across hundreds of locations

Spun location content was hit in both the August and September 2026 spam updates. This is one article published hundreds of times with the place name swapped: tree surgeon in Miami, tree surgeon in Orlando, tree surgeon in Tampa, same page each time.

Google treats the set as one thin page repeated, because that is what it is. The fix is not more pages. It is one page per location that says something only true of that location, or no page at all.

4. Thin location pages

Location pages that only swap the location word were hit in both updates. These are the same problem as pattern three at a smaller scale: a services page copied for each town with nothing local on it.

If a location page has no local address, no local photos, no local reviews and no local reference, it is a spun page with a smaller footprint.

What is winning instead

Real businesses with a consistent entity footprint are taking the rankings that exact match domains and rank-and-rent sites lost. The sites that gained in August, and are gaining on day one of September, have all four entity checks in place: one name, one address everywhere, real photos, and third-party mentions.

This is the same shape as what AI models look for when they decide whether to cite a brand. The entity optimisation guide covers how to build that footprint, and the E-E-A-T framework covers the trust side. The SEO ranking factors page scores entity signals against the rest.

How to audit your site against this update

Audit your site against the four patterns before the rollout finishes, because a site hit on day one can be hit harder on day five.

Check the domain. Is the domain a keyword? If so, you are in the exact match group and the entity work below matters more, not less.
Run the four entity checks. Name, address, photos, third-party mentions. Write down which ones fail.
Count your location pages. Open five at random. If you could swap the town name and nothing else would change, they are spun.
Fix the entity first. Match the name and address everywhere, replace stock photos with real ones, and get mentions on sites you do not own. This is the change that moved sites in August.
Consolidate or rebuild location pages. Keep the ones with real local content. Merge or remove the rest.
Check Search Console daily until the rollout ends. Note which pages dropped and on which day, so you can tell the spam update from anything else.

If you were hit, take the transcript of the video below, give it to an LLM with your site, and ask it to audit you against the four patterns. It will find something.

Watch the breakdown

Common mistakes I see after a spam update

Buying links to recover. A spam update that hit you for having no entity does not care how many links you buy. It cares whether Google can identify you.

Changing the domain in a panic. Moving an exact match domain to a brand domain is sometimes right, but not on day one of a rollout, and never without fixing the entity checks first.

Deleting every location page. Some of them have real local content and real rankings. Audit before you delete.

Waiting for the rollout to end before doing anything. The entity fixes take weeks to be picked up. Start now.

Frequently Asked Questions About the Google Spam Update September 2026

When did the Google spam update September 2026 start?

Google announced the September 2026 spam update on 24 September 2026, and it is still rolling out. It came roughly three weeks after the August 2026 spam update. Day-one impact numbers will change as the rollout completes.

What did the Google spam update September 2026 target?

In the sites I track, the same four patterns as August: exact match domains, sites with no defined entity, one article spun across many locations, and thin location pages that only swap the place name. Real businesses with a consistent entity footprint gained.

Are exact match domains dead after the September 2026 spam update?

No, but the trend is bad. 48% of the 3,500 exact match domains I track were hit in August and a further 25% on day one of September. Some still rank. They need a stronger entity footprint than a brand domain to survive an update.

How do I recover from the September 2026 spam update?

Fix the entity first: one business name and one address everywhere, real photos, and mentions on sites you do not own. Then consolidate spun location pages. Do not buy links or move domains before the entity work is done.

What is a defined entity in SEO?

A defined entity is a business Google can identify with confidence: the same name and address across your site, Google Business Profile, directories and social profiles, real photos, and other websites mentioning the brand. Sites without one are the most likely to be hit in spam updates.

Final Thoughts

The September 2026 spam update is punishing the same thing the August update punished: sites Google cannot identify. Exact match domains, spun location pages and stock-photo sites all fail the same test. The fix is not clever. Same name everywhere, same address everywhere, real photos, and other sites saying who you are.

I am tracking the rollout across 13,000 sites and will update the numbers here as it completes. I am also doing a one-hour breakdown once the data settles. If you want to ask about your own site, join The New Search on Skool, where I go live once a week.