On September 24, 2026, Google started rolling out the September 2026 spam update, its fourth this year. Many years ago, before DigiAssets, I did black hat SEO, and I watched this gap close up close. This post explains why today’s black hat looks like efficiency, and what to do over the next two weeks.
The Google September 2026 spam update is a global update covering all languages. It started on September 24, 2026, and the rollout may take up to two weeks. It is the fourth spam update of 2026. Google did not say what it targets. Its spam policies cover large-scale content with no value, expired domain abuse and duplicated doorway pages.
| Spam update | Start | Rollout duration |
|---|---|---|
| March 2026 | March 24, 2026 | 19.5 hours |
| June 2026 | June 24, 2026 | 2 days and 1 hour |
| August 2026 | August 18, 2026 | 2 days and 16 hours |
| September 2026 | September 24, 2026 | Up to two weeks (per Google’s announcement) |
Source: Google Search Status Dashboard, as of September 27, 2026.
“Today’s black hat doesn’t look like black hat. It looks like efficiency.”
Omri Kfir, Co-founder, DigiAssets
How did black hat SEO work on Google years ago?
I used to make money off Google being dumb.
I’m not proud of it. But I’m not going to deny it either.
Many years ago, long before DigiAssets as you know it, I did black hat. And it worked. Too well.
Usually I’d buy an aged, expired domain. Sometimes I’d use a third-party tool to hunt one down, sometimes I’d just dig through expired domains lists until I found a good one.
Usually it was a domain that already had links from strong sites. And it used to host a real website.
I’d build a site on it. Fill it with “spun” content (software that swaps words for synonyms so Google won’t detect it’s copied. Yes, before AI, that was the trend).
Send an exact-match anchor link from it. “עורך דין גירושין בחיפה” (divorce lawyer in Haifa). Repeat over and over… and wait.
Sounds like a joke, right? But it worked.
Sites that had no business being on page one just showed up and stayed there… for months.
Honestly, I didn’t call it SEO back then. It was more like arbitrage. There was a kind of grace period for “SEO”.
There was a gap between what Google could measure and what it actually wanted to show. And inside that gap was money… a lot of money.
How did Google close the gap?
Then Google started learning. It didn’t happen overnight. It was a tide that rose slowly.
Update after update that penalized thin content and artificial links (the famous Panda and Penguin).
Entire sites disappeared overnight. Traffic went from 500K users to 500. Not kidding.
And the people who were really, really good at black hat improved their tricks with every update, spent serious money on technology and research, and the whole black hat operation got more sophisticated too.
I remember following 4-5 guys who were considered legends in this space. They inspired me.
They’d do PAA scraping (pulling the “People Also Ask” questions from Google and writing an article for each one), then build sites around those questions, then a link network around those questions, and so on…
They had plenty of energy, money and time to refine these tricks, and for a few years the tricks just worked. It was a real contest between them and Google’s algorithm.
Why can’t you beat SpamBrain?
Somewhere in recent years, in my view overlapping with the rise of AI, the game changed. Google stopped hunting specific tricks like PAA and aged domains, and started using an AI system (SpamBrain) that learns to recognize patterns.
That’s when I understood it was over. You can’t beat a system that learns from every attempt you make to get around it.
Today you can clearly see the black hat field fading, the communities shrinking and shrinking.
In my eyes it’s a niche that’s slowly dying, because in the long run we’re playing against a giant company that spends billions to keep people from even getting onto the field.
And Google is sneaky. It doesn’t always penalize. It just neutralizes. The link you bought stays live, the money is gone, and nothing moves. You don’t even know you’ve been hit.
Most of the time you also won’t see a Manual action (a manual penalty notice) in your Search Console like you used to. You just won’t get impressions or indexing. That’s it.
What do we know about the September 2026 spam update?
Last Thursday Google started rolling out the September 2026 spam update. It’s the third spam update since June.
4 spam updates in one year. Anyone who’s been doing SEO long enough knows that’s insane.
It’s a record since Google started documenting its updates in an organized way.
By the way, the previous updates this year finished within a day or two. For this one, Google announced it will take up to two weeks.
They don’t say why, or what, or who. Secretive, as always.
My read? An update that takes several times longer usually does more. That’s been my experience.
Google isn’t “fighting spam.” It’s at war. It wants to tell everyone still trying black hat, loud and clear, that they don’t stand a chance.
That it wants to be the platform that delivers the most valuable, high-quality, unique and accurate content to its users.
Maybe my ego is hurt that I can’t do growth hacking on Google anymore. But on the other hand… I’m not sure I disagree with them.
I want the sites we promote to bring quality traffic that converts. I have a stake in that.
What does black hat SEO look like today?
So I’m starting to hear things like
“A spam update? So what? It doesn’t affect me. I don’t do black hat.”
Maybe. But today’s black hat doesn’t look like black hat. It looks like efficiency.
Do you feel like lately you’ve been doing things on or for your site “more efficiently”?
200 duplicated city pages where you just swap the city name? (There’s Claude Code, so why not.)
Publishing lots of articles?
Maybe an old domain bought only for its links?
I’ll go even simpler: a few AI articles you generated and published without any editing or human review.
Sound familiar?
Maybe you don’t call it spam, but Google does.
So no spinners. No crazy scrapers.
Notice that everything we do today comes wrapped in AI. And Google penalizes that wrapper to some extent when it isn’t kept under control.
Noticed something odd in your rankings or citations since September 24? Let’s look at it together →
What should you do over the next two weeks?
Four steps, in order. The first is to do nothing, and the last is to learn from the pages that actually went up.
Don’t touch the site mid-rollout
First, don’t touch anything. I always remind people of this. Mid-rollout, rankings jump around. Breaking your site over a two-day fluctuation hurts you more than the update. Measure only after Google announces the rollout is complete.
Check for manual actions in Search Console
Check for manual actions. For 99% of readers this probably won’t apply. But someone reading this is still running scrapers and buying domains in bulk. So go to Search Console, under “Security & Manual Actions”. If there’s something there, it’s a completely different problem from an algorithmic update, and the fix is different.
Run an honesty test on your pages
Run an honesty test on your pages. A polygraph. What in your content is true, and what is a lie? Go through the pages you built for Google rather than for people. If you’d be embarrassed to show a page like that to a client and ask them to read it, Google probably feels the same way.
Check where the growth came from
Check where the growth came from. If some of your pages are gaining from this update, something in them is working well, and that’s what Google is looking for. In Search Console, filter for gains only in rankings and impressions, then analyze the results. Oh, and if a sharp traffic spike came from some trick rather than from strategy, don’t pour more budget into it.
Why is black hat a loan and not a shortcut?
Black hat was never a shortcut.
Anyone who did black hat long enough knew it was just a loan. Churn & burn.
In the good old days, that loan was cheap. Today Google collects on it four times a year.
FAQ
When did Google’s September 2026 spam update start, and how long will it last?
The update started on September 24, 2026, and it applies to all languages, including Hebrew. Google said the rollout may take up to two weeks, while the earlier 2026 spam updates finished within a day or two.
How many spam updates did Google release in 2026?
Four: in March, June, August and September 2026. The September update is the third since June, and it’s the only one Google announced in advance would take up to two weeks.
If the spam update hit my site, will I get a notification in Search Console?
Usually not. Today Google typically neutralizes rather than applying a manual penalty, so the pages simply stop getting impressions and indexing. Still, check “Security & Manual Actions”, because a manual action is a different problem from an algorithmic update and needs different handling.
Does Google consider AI articles spam?
In our experience at DigiAssets, AI articles generated and published without any editing or human review can be treated as spam, even if you don’t call them that. Google does penalize AI wrapper content to some degree when it isn’t supervised, just as it does 200 duplicated city pages or an old domain bought only for its links.
What should I do if rankings jump around mid-update?
Don’t touch the site. Rankings fluctuate mid-rollout, and anyone who breaks their site over a two-day swing hurts themselves more than the update does. Measure only after Google announces the rollout is complete.
Ready to see where your next customers will come from?
- Analysis of your current organic performance
- 3 immediate opportunities identified
- No commitment
