Did a Google Update Hurt My Website? 

Google confirmed a spam update on September 24, 2026, and said the rollout could take up to two weeks.

That’s slow. Google’s own status dashboard records the three spam updates before it finishing in anything from 19 hours to a little under three days. Barry Schwartz at Search Engine Roundtable reported Google’s John Mueller saying this one is likely to take longer than some of the previous ones.

Slow rollouts are the ones that get us the most worried phone calls. Google’s published advice on when to assess is written for core updates rather than spam updates, but it’s the closest thing to a rule of thumb on offer: confirm on the status dashboard that the update has finished, then wait at least a full week after that before analyzing anything in Search Console. A number you read on day three is a partial reading of a change that hasn’t finished arriving.

So there’s a stretch of two weeks or more where the honest answer is that nobody knows yet. Here’s what you can check in the meantime.

Start with the one place that actually knows

Open Google Search Console and look at the Performance report. It holds Google’s own record of how your site did in search.

Set the date range to compare the four weeks before and after the day you first noticed something, then look at clicks and impressions. Resist the urge to go straight to average position. Google’s own guidance says you shouldn’t focus too much on your absolute position, because “impressions and clicks are ultimately the measure of success for your site.” It adds one exception worth knowing: a dramatic, persistent drop in position is a reason to go back and reassess whether your content is genuinely helpful.

Then open the Manual actions report. A manual action means a person at Google reviewed your site and penalized it by hand, and if that’s happened, Google tells you here and in Search Console’s message center. If it hasn’t, you get a green check mark and nothing else.

That green check mark settles less than people hope. The report covers penalties applied by hand, so an automated ranking change is something you would have to go looking for in the Performance graph instead.

If you’ve never set Search Console up, that’s the real first step, and it costs nothing. It’s also where you’d check whether Google’s AI features are pulling from your pages, which we get asked in the same phone call more often than not.

What the shape of the graph tells you

Google’s guide to debugging traffic drops sketches four shapes, and the one you’re looking at narrows the cause considerably.

A large, sudden drop. Google pairs this shape with an algorithmic update or a site-wide security or spam problem. Check the date against the status dashboard and see whether it lines up with something Google confirmed.

A dip that repeats around the same time each year. Google labels this one seasonality. A landscaping company losing search traffic through October hasn’t been penalized. It’s October.

A slower decline across the site. Google puts this down to a technical issue or to changing interest in what you offer. A misplaced noindex tag lands here, not in the cliff, and Google explains why: the tag is the line of code telling Google to skip a page, so the drop only arrives as Google recrawls, which makes it gradual. A noindex tag left over from a staging site is one way it happens, and the site still looks normal to you either way.

A drop with no story behind it at all. Google’s fourth sketch is a reporting glitch, which is worth remembering before anyone starts rewriting pages.

What a spam update is actually looking for

The list is published, and every behavior on it has its own definition.

It covers cloaking, which means showing Google one page and showing people another. It covers doorway abuse, keyword stuffing, link spam, scraping, hacked content, and buying expired domains to recycle their reputation. Two entries bear most directly on a small site.

Scaled content abuse covers creating large amounts of unoriginal content that adds little or nothing for readers, “no matter how it’s created.” The first example Google gives is using generative AI tools to produce many pages without adding value. The policy turns on how many pages there are and what they’re for, though Google clearly has AI-built bulk pages in view.

Site reputation policy covers third-party content published on a site “mainly because of that host’s already-established ranking signals.” Google’s two examples are an educational site carrying sponsored payday-loan reviews written by somebody else, and a medical site carrying a “best casinos” advertising page.

Most of that list describes things somebody chooses to do. Hacked content is the exception, because that one happens to you, which is why a security check belongs next to the Manual actions report.

Google didn’t say what this particular update targets. Matt G. Southern at Search Engine Journal noted that Google “hasn’t said whether this update targets a specific spam policy or tactic,” and Barry Schwartz wrote that Google did not mention any changes with this update.

One arrangement worth checking

One arrangement is worth naming. A marketing company bills a flat monthly fee and publishes a steady stream of posts, built from a keyword list and produced in bulk. The posts read fine in isolation. Nobody at the organization has read them. They exist to catch search traffic.

That’s the pattern scaled content abuse describes, and it doesn’t stop being that pattern because the website it’s happening on belongs to a church.

The test isn’t whether AI was involved. The test is whether somebody looking for that information would be glad they landed on the page. If your site picked up pages last year and nobody can say what’s on them, that’s worth a look no matter what any update does.

The same thinking runs through how churches get found in search generally. Google ran four spam updates in 2026 alone, by the count on its own status dashboard, and every one of them measured sites against that same published list.

What to do if it really was the update

Less than you’d hope, and more slowly. One caveat first: Google’s recovery advice is written for core updates, and it doesn’t say whether spam updates behave the same way. It’s still the best-documented thing on offer.

That guidance warns against “quick fix” changes, naming the instinct to rip out some page element because you heard it was bad for SEO. It also says that deleting content “is a last resort.”

On timing, that same core-update guidance says some changes can take effect in a few days, but that it could take several months. If nothing has moved after a few months, that may mean waiting until the next core update.

A manual action is the one case with a concrete path. Fix the problem on every affected page, because Google says fixing it on only some of them “will not earn you a partial return to search results.” Then file a reconsideration request that explains what the issue was, what you changed, and what happened as a result. Google says most reconsideration reviews take several days or weeks.

If what vanished was your map listing and your website is fine, stop reading about search updates. That’s a different system, and a suspended Google Business Profile has its own causes and its own appeal.

The unglamorous part

Open Search Console once and compare the four weeks either side. If clicks and impressions look the way they did a month ago, close the tab.

If they don’t, the shape of the drop is the next thing to read, and it’s free.