Google ran a spam update last week without changing a single rule, and that is the part worth understanding

Google confirmed the August 2026 spam update on August 18 and finished rolling it out on August 21. The announcement was one sentence long: “Released the August 2026 spam update, which applies globally and to all languages. The rollout may take a few days to complete.”

There was no blog post, no new policy documentation, and no list of targets. Google characterised it as a normal spam update with nothing specifically new in it.

That description has been read by a lot of people as “nothing to see here.” We think it is the opposite. A spam update with no new rules is the most informative kind, because it tells you exactly what moved: not the rules, the enforcement. And the gap between what the rules have said since 2024 and what Google was actually able to detect is precisely where an ordinary, well-meaning small business site sits.

Here is the version we would give a client who called on Monday asking why their traffic looks different.

What actually happened, with dates

Google logs these on its Search Status Dashboard, so the timings are not guesswork.

Update	Started	Finished	Duration
February 2026 Discover update	February 5	February 26	21 days, 17 hours
March 2026 spam update	March 24	March 25	19 hours, 30 minutes
March 2026 core update	March 27	April 8	12 days, 4 hours
May 2026 core update	May 21	June 2	11 days, 21 hours
June 2026 spam update	June 24	June 26	2 days, 1 hour
August 2026 spam update	August 18	August 21	2 days, 16 hours

The August rollout opened at 09:27 US/Pacific on Tuesday August 18 and closed at 08:49 UTC on Friday August 21. It is the third confirmed spam update of 2026 and, at two days and sixteen hours, the longest of the three. That is worth noting only because some early coverage called it the fastest, which is the opposite of what the dashboard records.

Two further details come from the search trade press rather than from Google’s public statement, and they matter for anyone trying to work out whether they were affected: this update did not target link spam, and it did not target the site reputation abuse policy. Both exclusions were also reported for the June update. If your rankings moved and your working theory is “it must be our backlinks,” the reporting says that theory is probably wrong for this particular event.

Update, August 30, 2026. There is no August 2026 core update, whatever you are reading. In the days after this post went up, several SEO sites began publishing analysis of an “August 2026 core update,” some of them putting a rollout start at August 26 and quoting percentages of sites affected. We re-read Google’s Search Status Dashboard on August 30. It records exactly the six ranking updates in the table above. The most recent confirmed core update is still the May 2026 core update, which finished on June 2. There have been three spam updates in 2026 and two core updates, and the third core update of the year has not happened.

This matters beyond pedantry. If your rankings moved in the last two weeks and you have been told a core update did it, you have been pointed at the wrong repair. A core update means rewrite; the confirmed August event was a spam update, which means find and remove the thing being enforced against. Those are different weeks of work. Before you accept any diagnosis of a traffic drop, including ours, check the date against Google’s own dashboard, which is the only authoritative record of what ran and when.

Spam update and core update are not the same thing, and the difference decides your response

This gets conflated constantly, including by people selling recovery services, so it is worth being precise.

A core update is a change to how Google decides which of the many acceptable pages about a topic deserves to rank highest. Nothing is wrong with your site. You have been reassessed against everyone else and you came out lower. The fix is genuinely making the page better, and the honest timeline is the next core update, not this week. We wrote about this at length after the March 2026 core update, and everything in that post still holds.

A spam update is enforcement. Google’s systems have decided that something on your site violates a published spam policy. This is not a relative judgement about quality; it is a rule being applied. The fix is removing whatever is triggering it.

The practical consequence is that the two failures look identical in your analytics and require completely different work. Traffic went down in both cases. In one you rewrite pages; in the other you delete them.

There is a third possibility that is worth ruling out before either: it is late August, and search volatility in most Canadian small business categories is seasonal. Third-party rank trackers also logged elevated movement on August 1 to 3 and again on August 12 to 13, well before this update was announced and not attributable to it. If your data starts moving in the first fortnight of August, this update is not the explanation.

“No new policies” means the enforcement caught up, not that nothing happened

Google’s spam policies page has not been rewritten around this update, and is reported to have been unchanged since mid-May 2026. The three policies that most often catch legitimate-looking sites, scaled content abuse, expired domain abuse and site reputation abuse, were all introduced in March 2024. They have not changed.

What changes in an update like this is SpamBrain, Google’s machine-learning spam detection system, which Google says it improves periodically “to make it better at spotting spam and to help ensure it catches new types of spam.”

So the question to ask about your own site is not “what did Google change.” It is: what have we been doing that has been against the rules for two years and was simply not being caught?

For most small businesses, the honest answer is one of four things, and none of them feel like spam from the inside.

The four ways an ordinary business site trips a spam policy

1. The forty city pages an agency built for you

This is the most common one in the GTA, by a distance.

You run a plumbing company, or a dental clinic, or a moving service. An agency told you that to rank in Mississauga, Brampton, Vaughan, Markham, Oakville, Burlington, Richmond Hill and thirty-odd other places, you need a page for each. So you have forty pages that are the same page with the city name swapped, each one funnelling to the same contact form.

Google’s doorway abuse policy names this behaviour directly: creating multiple pages or sites “targeted at specific regions or cities that funnel users to one page.” Not similar to it. That is the definition.

The distinction that matters is not the existence of location pages, it is whether each one earns its keep. A page for Mississauga that lists your actual Mississauga jobs, your response time to that part of the city, the permit office you deal with there, and photos of work you did there, is a real page. A page that is the Brampton page with three words changed is not, and forty of them is a pattern that is easy to detect at scale.

This one is painful to hear because you paid for those pages, and for a while they worked. That is exactly why they existed.

2. The blog somebody set to publish four AI articles a week

Google’s scaled content abuse policy is worth reading in full, because the wording is careful:

“Scaled content abuse is when many pages are generated for the primary purpose of manipulating search rankings and not helping users. This abusive practice is typically focused on creating large amounts of unoriginal content that provides little to no value to users, no matter how it’s created.”

Note what it does not say. It does not say AI-generated content is against the rules. The phrase “no matter how it’s created” is doing deliberate work: a human writing forty thin pages and a model writing forty thin pages are the same violation. Google’s own examples list includes “using generative AI tools or other similar tools to generate many pages without adding value for users.”

The test is unoriginal content at volume. If your blog publishes four posts a week that summarise what is already on page one of the results for that query, that is scaled content abuse whether a person or a model typed it, and this update is exactly the kind of event that finds it.

We have written separately about what the measured rise of AI-written pages does to your credibility even when it does not trigger a policy. The short version: the ceiling on generated-and-published content is not the algorithm, it is that it contains nothing a reader could not have got elsewhere.

3. The expired domain somebody bought for its backlinks

Somebody found a lapsed domain with an established link profile, bought it, and either redirected it to you or rebuilt it as a site pointing at you. This is sold as a shortcut and it is explicitly a named policy: expired domain abuse covers buying expired domains “primarily to manipulate search rankings by hosting content that provides little to no value to users.”

If you did not do this, you might still have inherited it. It is worth asking whoever handled your SEO before your current arrangement, because you own the consequence either way.

4. Hacked content, which is the one that catches innocent sites

This is the sleeper, and it is the reason a business that has genuinely done nothing wrong can be demoted by a spam update.

Google’s hacked content policy covers content placed on a site through a security vulnerability: injected pages, injected links, redirects that fire only for visitors arriving from search. A compromised WordPress install typically hosts hundreds of pharmacy or gambling pages in a directory nobody looks at. To Google these are spam pages on your domain, because that is what they are. The fact that you did not publish them is not visible to a ranking system.

This is not hypothetical for anyone running WordPress this month. A core remote code execution flaw was disclosed recently enough that a meaningful number of sites are still unpatched, which we covered in the wp2shell writeup. A site compromised in July shows up as a spam problem in August. That sequence, breach first and ranking collapse a month later, is common enough that a sudden unexplained traffic drop should always trigger a security check before an SEO audit.

How to tell what actually happened to you, in about ten minutes

Do these four checks in order and stop when one of them fires. All of them are free.

1. Search Console, Manual actions. This is the single most important screen and most people have never opened it. If there is a manual action here, a human reviewer at Google made a decision about your site. This is good news in one narrow sense: manual actions can be appealed with a reconsideration request once you have fixed the problem, and they get resolved on a human timeline. If this screen says “No issues detected,” your problem is algorithmic, and there is no appeal process to use. You fix the cause and wait for a recrawl and a refresh.

Site reputation abuse, worth knowing, is largely enforced through manual actions rather than through this update.

2. Search Console, Security issues. This is where hacked content shows up. Check it before anything else that costs money.

3. Search site:yourdomain.com in Google and page through the results. You are looking for pages you do not recognise. If you find URLs about products you do not sell, in languages you do not publish in, you have found your answer and it is a security incident, not an SEO one.

4. Search Console, Pages report. Compare the number of indexed pages against roughly what you think your site contains. A site you believe has 30 pages that reports 900 indexed is telling you something specific.

Reading the numbers without fooling yourself

The mistake we see most often is looking at three days of Search Console data and making an expensive decision. The dates here give you a clean way to avoid that.

• Baseline: through August 17. Exclude August 1 to 3, which had its own unexplained volatility.
• Skip: August 18 to 20. Data during a rollout is meaningless. Rankings are being recomputed and partially applied.
• Measure: August 21 onward. Compare weekday to weekday, not against a weekend, and give it at least fourteen days before drawing a conclusion. Twenty-eight is better.

Then look at clicks per query group rather than total clicks. A site that lost 30 percent of clicks on one cluster of pages and held steady everywhere else has a page-level problem. A site that lost 10 percent evenly has probably not been hit by anything at all.

One more thing worth saying plainly, because it is where the marketing pitches get their leverage: Google does not disclose what percentage of queries a spam update affects, and no third-party tracker knows either. Any agency that tells you in the first week that you were hit by the August 2026 spam update, specifically, is guessing.

What recovery actually looks like

For an algorithmic spam demotion there is no button. You remove the cause, Google has to recrawl the affected pages, and its systems have to reassess the site over time. Google’s own guidance on this class of demotion is that recovery can take many months.

Google also refreshes these systems periodically without announcing it, which cuts both ways. Rankings can move again from the same system with no news to explain it, and a site that fixed its problem in September might see recovery on a date that corresponds to nothing public.

The practical sequencing, if one of the four causes above applies to you:

1. Fix the security problem first, if there is one. Nothing else matters until the site is yours again.
2. Delete rather than rewrite thin doorway or scaled pages. A 410 or a 301 to the one genuinely useful page beats forty pages of improved filler. Consolidating forty city pages into one strong service page plus three real location pages is usually the right shape.
3. Stop the thing that produced the volume. If a content schedule generated the pages, turning off the schedule is part of the fix, not a separate decision.
4. Then wait, and measure monthly. Not daily. Daily measurement during a recovery produces panic decisions that undo the work.

The uncomfortable summary

If you were hit by this update, something on your site violated a rule that has been published since 2024. That is not a comfortable sentence, particularly if you paid an agency to build the thing that did it, but it is the accurate one, and it is also the reason the fix is knowable rather than mystical.

And if you were not hit, the useful takeaway is not relief. It is that detection is improving faster than the rules are changing. Anything on your site that works today and that you would struggle to justify to a human reviewer is on a clock. That includes most of what gets sold as a content strategy at volume.

The sites that have been quietly fine through every core and spam update this year have one thing in common, and it is not technical: every page on them exists because a real customer needed that page to exist. That is a low bar, and remarkably few small business sites clear it.

If your traffic moved this month and you want a straight answer about which of the four causes applies, send us a note. Running the four checks above on a specific site takes us about half an hour and we will tell you if the answer is “nothing happened, this is seasonal,” which it often is.

Sources

• Google Search Status Dashboard, ranking updates, the primary record for start and end times of every confirmed update quoted above, retrieved August 24, 2026 and re-checked August 30, 2026
• Google releases August 2026 spam update, Search Engine Land, August 18, 2026, carrying Google’s full announcement text
• Google August 2026 spam update done rolling out, Search Engine Land, August 21, 2026
• Google’s third spam update of 2026 hits every language and region, PPC Land, for the 09:27 Pacific start time and the pre-announcement volatility on August 1 to 3 and August 12 to 13
• August 2026 Google spam update: dates, what it targets and recovery and The August 2026 spam update is done, here is what to measure, both reporting the link spam and site reputation abuse exclusions
• Google Search spam policies, Google Search Central, source of the scaled content abuse, doorway abuse, expired domain abuse, site reputation abuse and hacked content definitions quoted above