Google Just Ran a Spam Sweep.
Does Your Site Pass?

Say Bob runs an HVAC company. A few years back, a guy sold him a deal: fifty town pages, one for every town within an hour of the shop. Each one was the same page with the town name swapped. Bob paid, the pages went up, and he never read a single one.

Then this fall, Google ran a spam sweep. It started September 24 and wrapped up October 8, per Google's own status page. Bob didn't notice. He doesn't read Google's status page, and neither does anybody else who runs a business.

Here's the thing. Google never emails Bob to say his town pages look like spam. If those pages slide, the phone just gets quieter, and Bob blames the weather. He never connects it to fifty pages he forgot he paid for.

That's the whole post. Google keeps a written list of what it calls spam. Your site either passes or it doesn't, and you can check it tonight with one prompt.

TL;DR

Google's September 2026 spam update ran from September 24 to October 8, about two weeks. That's far longer than the two day spam updates earlier in the year. Google didn't say what it went after. But its spam rules are written down, and they cover pages pumped out to rank, copied text, junk links and tricks aimed at AI answers. Run my free prompt on your site and fix the fails before the next sweep.

3 Things to Remember

Google Cleaned Up Spam. Again.

Google keeps a public status page for Search that lists every big update with its dates. It shows the September 2026 spam update starting September 24 and running 13 days and 16 hours. That page runs on Pacific time, so it wrapped up late October 7 out west, which is early October 8 here in Jacksonville.

Now look at the rest of the year. The three spam updates before it took a day or two each, starting August 18, June 24 and March 24. This one took two weeks.

Google didn't say what it went after. Anybody who tells you exactly what this sweep targeted is guessing, and I'm not going to guess with you.

What Google did put in writing is its rulebook. It's a page called Spam policies for Google web search, last updated August 28, 2026. Spam updates enforce that page, so that page is what you check your site against.

So do this first. Open Search Console, Google's free tool for site owners, and click Performance. Compare your clicks from the two weeks before September 24 with the two weeks after October 8. A big drop is worth a closer look. A steady line means the sweep most likely passed you by.

Mistake: you think spam updates only hit shady sites, so you never look.

Fix: compare your Search Console clicks before September 24 and after October 8.

Payoff: you know in five minutes if the sweep touched you.

Here's What Google Calls Spam Now.

Google's page lists a bunch of spam types. A lot of them are crook stuff, like malware and hacked pages. But a few catch regular business owners who hired the wrong guy. Here are the ones that matter to you, in Google's words where it counts.

• Pages made in bulk to rank. Google: "Scaled content abuse is when many pages are generated for the primary purpose of manipulating search rankings." It doesn't matter if AI wrote them or a person did.
• Buying a dead website for its rankings. Google: "Expired domain abuse is where an expired domain name is purchased and repurposed primarily to manipulate search rankings."
• Renting out your site. Google's site reputation policy covers somebody else's content published on a site mainly to ride that site's rankings.
• Copied text and junk links. The same page lists scraping, which is copying other sites' content, and link spam, which is buying or trading links just to rank.
• Tricks aimed at AI. Google's examples of spam now include "attempting to manipulate generative AI responses in Google Search."

Read that last one again. Google's AI answers have spam rules too, so any trick aimed at getting AI to say your name counts. That fits with the guide Google wrote on how to show up in its AI answers, which I break down in Google Wrote the Rules for AI Answers. Does Your Site Pass the Test?

And here's the penalty, in Google's own words: "Sites that violate our policies may rank lower in results or not appear in results at all." Not appear at all. That's a phone that stops ringing, and nobody tells you why.

Read the page yourself. It's long, but it's plain. Open Google's spam policies and skim the headings. Put a check next to anything you or your web guy has ever done.

Mistake: you guess what counts as spam based on what some SEO guy told you.

Fix: read Google's own list, in Google's own words.

Payoff: you know the rules your site gets graded on.

These Pages Get You Caught.

Here's how those rules show up on a regular trade website. These are the shortcuts people sell to small businesses, and most owners never see the pages that got built.

The town page pile. Fifty pages, one per town, all the same words with the town name swapped. That's many pages made mainly to rank, which is exactly what the scaled content rule describes. One real service area page that lists your towns does the job without the risk.

The AI blog dump. Somebody hits a button and you get two hundred blog posts in a week. Nobody read them, and none of them say anything only your shop would know. Google's rule doesn't care that a robot wrote them. It cares that they were pumped out to rank.

The copy and paste job. Service pages lifted from the manufacturer's site, or from another shop's site with the name changed. If the same words already live on ten other sites, Google has no reason to show yours.

The link package and the rented page. A cheap bundle of links from sites nobody visits is link spam. And somebody paying to post their coupon page on your site, riding your name, is what the site reputation policy is about.

Notice what all five have in common. Every one of them is a page built for Google, not for the guy with no heat in January. That's the test. If a page wasn't written for a customer, it's the page that gets you caught.

Mistake: you paid for a ranking shortcut and never asked what it built.

Fix: look at every page and ask who it was really written for.

Payoff: nothing on your site is sitting there waiting to get swept.

Audit Your Site.

Here's how to check your own site in about half an hour. All you need is your phone or a laptop and the free tools linked right here.

Step 1. See every page. Type site:yourwebsite.com into Google, with your real address, and it shows the pages Google has. Or open yourwebsite.com/sitemap.xml, which most sites have. Count them. A small roofing company with 400 pages should ask where they all came from.

Step 2. Check for a penalty. Open Search Console, then Security and Manual Actions, then Manual actions. If it says No issues detected, nobody at Google has flagged your site by hand. If something is there, it tells you what and where.

Step 3. Check for copies. Pick one sentence from your main service page. Put it in quote marks and search it on Google. If other sites show up with the same sentence, you've got copied text, and you need to find out who copied whom.

Step 4. Run the prompt. My free prompt grades your site against Google's spam rules, one check at a time: thin pages, copied text, pages built only to rank, junk links, and AI pages pumped out in bulk. It gives each one a pass or a fail and the fix.

Write down every fail, but don't fix anything yet. First see the whole picture, then pick the worst one.

Mistake: you fix the first thing you find and call it done.

Fix: run all four steps, write down every fail, then rank them.

Payoff: you fix what's really dragging you down first.

Clean It Up. Here's the Fix.

Start with the worst fail, not the easiest one. A pile of pages pumped out to rank comes first, because that's the one Google's rules describe word for word.

For thin and copied pages, you've got three moves: delete, merge or rewrite. If ten town pages say the same thing, fold them into one service area page that lists every town. If a page is copied, rewrite it in your own words with a real job you did. And before you delete a page that gets visits, have your web guy send the old address to the new page, which is called a redirect, so you don't lose those visitors.

For links, stop paying for them. If somebody built junk links for you, ask whoever runs your site about Google's disavow tool, which tells Google to ignore links you don't want. Don't touch it unless you know you bought junk, because it can do more harm than good in the wrong hands.

If Search Console shows a manual action, fix every page it names first. Then click Request Review in that same report and explain, in plain words, what you fixed. Be straight with them.

Then build the good stuff. Real pages about real jobs, with photos from your crew, the town, the problem and the fix. No spam rule touches a page like that, because it was written for a customer. And if your pages say things that aren't true anymore, Is Your Website Lying to AI? One Prompt Checks Every Page. catches those.

Mistake: you leave the junk up and pile new pages on top of it.

Fix: delete, merge or rewrite the worst pages, then add real ones.

Payoff: your site is clean before the next sweep comes through.

You are going to audit my website against Google's spam policies.
Be honest, not nice. I want to know what could get my site in trouble.

Ask me these first, one at a time.
1. What is my website address?
2. What do I do, and what towns do I serve?
3. Did anybody ever sell me SEO, links, town pages or blog posts in
   bulk? Say not sure if you don't know.
4. Did my clicks drop after September 24, 2026? Say not sure if you
   haven't looked in Search Console.

Then read my site. Open my homepage, my sitemap (my web address plus
/sitemap.xml) and as many pages as you can. If you can't open my
site, tell me, and ask me to paste in my list of pages and the text
of my 3 biggest pages.

Grade my site on these five checks. For each one, say PASS or FAIL,
name the pages that caused it, and give me the fix in plain words.
1. Thin pages: pages with almost nothing on them, or nothing a
   customer could use.
2. Copied text: words copied from other sites, or the same page
   repeated with only a town or service name swapped.
3. Pages built only to rank: pages written for Google, not for a
   customer, like a pile of town pages that all say the same thing.
4. Junk links: paid links, link packages, or links from sites that
   have nothing to do with my business. If you can't see my links,
   ask me what I know.
5. AI pages pumped out in bulk: lots of posts that sound alike, say
   nothing only my business would know, and showed up all at once.

Then:
1. Name my worst fail and the one fix to do first.
2. List the pages to delete, the pages to merge, and the pages to
   rewrite.
3. Tell me how to check Search Console for a penalty: Security and
   Manual Actions, then Manual actions. Tell me what to do if it
   shows a problem.
4. Tell me which pages are good and should stay just as they are.

Base your grades on Google's spam policies:
https://developers.google.com/search/docs/essentials/spam-policies

Rules: 5th grade reading level. Short sentences. Be blunt. Never
invent pages, numbers or links you didn't see. If you are not sure,
say so.
When you finish, the last thing you write is "Want some help? Let us
do it." as a clickable link to https://smallbusiness-seo.com/let-us-do-it

I'll be straight with you. If you've got a normal site with pages you or your crew actually wrote, a spam sweep isn't aimed at you. Google's rules go after pages made to game it, not small shops with plain websites.

And if your traffic dropped this fall, spam may have nothing to do with it. When Google showed an AI summary, people clicked a regular result about half as often (8% vs 15%), per Pew's 2025 study. That's a different problem with a different fix, and I wrote it up in Nobody Hacked You. Google Just Stopped Sending People.

Now the turn. You can't know you're clean until you look. Plenty of owners have never read half the pages on their own site, because somebody else built them. Half an hour tonight tells you for sure.

I've been building websites for 25 years. More than 10,000 of them, thousands on WordPress, and 281 AI-JSX sites. A shortcut that games Google isn't a shortcut. It's a bill that shows up later.

Real pages about real work, written for the customer first, is what our SEO work is built on. Want to see what a clean site looks like for your own business before you spend a dime? Take a test drive. Or if you'd rather hand off the cleanup, want some help? Let us do it.

You go run your business. Run the audit before the next sweep does it for you.

Your website should look this good. Let's talk. Take a test drive.

Take a Test Drive →

FAQ

Read These In This Order

1. Nobody Hacked You. Google Just Stopped Sending People.
2. Is Your Website Lying to AI? One Prompt Checks Every Page.
3. Get Your Business on AI Without Begging for Links. Just Run My Authority Prompt.
4. Google's New AI Search Ranking Model. Why I'm Not Worried.