The Google spam update risk checklist

People routinely spend weeks fixing "spam issues" after a drop that was really a core update, a SERP layout change, or seasonality. These four questions don't count toward your score — they tell you whether the rest of the page is even the right diagnosis.

None of the three came with a blog post or a new policy category, and Google's spam policy documentation hadn't changed since December before the August rollout. The rules haven't moved — detection has got better at finding things. A quiet rollout is not a small one: SE Ranking found top-10 URLs were roughly 1.8 times more likely to fall out of the top 100 during the August update than in a normal week.

The single biggest driver of spam-update casualties right now. Google's position is method-agnostic: it doesn't matter whether pages were written by AI, by humans, by scrapers, or by all three. What matters is whether many pages exist mainly to catch rankings rather than help anyone.

Volume alone is not a violation. Programmatic SEO done well is fine. A page per postcode with genuine local data is a legitimate page. A page per postcode with the postcode swapped in is a doorway.

Spam updates and link spam updates aren't always the same thing, and Google said the August 2026 update did not target link spam. But link issues surface in manual actions and other updates, so audit them anyway.

Paying for links is fine as advertising. It's only a violation when the links pass ranking credit — rel="sponsored" solves this.

Old-school, mostly obvious, and still enforced.

Google's framing here is blunt: this isn't something people do by accident. Reusing an old domain for a genuinely new, original site that serves people first is fine — rebrands, mergers and revived projects are normal. The abuse pattern is a drastic mismatch between what the domain used to be and what's on it now: affiliate content on a former government domain, casino content on a former school site.

The site reputation policy. This one changed in August 2026, and the change matters for European and UK publishers. Note that the EEA is the EU plus Iceland, Liechtenstein and Norway — the UK is not in the EEA, so UK sites fall under the non-EEA treatment.

Google judges this on presentation consistency, content quality relative to your main domain, clear authorship and editorial responsibility, and whether the same content is syndicated everywhere. No single factor decides it. The question underneath all of them is whether the host site genuinely exercises editorial control.

Google has lifted previous EEA manual actions under this policy and says a past action isn't used as a ranking signal. EEA sites also get a faster reconsideration process and access to mediation.

Affiliate sites are not inherently spam. The distinguishing features of good ones are original reviews, real testing and ratings, genuine price information, and useful comparison and navigation. If your page has none of those, it's thin affiliation.

Worth checking even if you'd never do any of the above deliberately.

Hacked content is one of the most common causes of a sudden, inexplicable collapse. Check before you assume it's an algorithm.

Google clarified in May 2026 that its spam policies also cover attempts to manipulate generative AI responses in Search, including AI Overviews and AI Mode. The definition of spam on Google's policy page now names this explicitly.

Google hasn't said whether any 2026 update specifically targeted this. It doesn't much matter — it's a stated policy, and stated policies get enforced eventually.

If you've already been hit

• Establish a clean baseline. Pull Search Console data from after the rollout finished, and compare against the weeks before it started. Data pulled mid-rollout tells you nothing reliable.
• Check manual actions first. A manual action names the policy and comes with a reconsideration path. No notice means it's algorithmic — nothing to appeal, so you fix and wait.
• Find the affected cluster. Which page types lost the most? Which query groups? Spam updates rarely hit everything uniformly, and the pattern usually names the cause.
• Fix by decision, not by tweak. For each affected group, pick one: substantially improve it, consolidate it into something that earns its place, or remove it from search with noindex or deletion. Half-rewriting thin pages produces slightly longer thin pages.
• Be realistic about timing. Algorithmic recovery usually waits for a later update to reassess your site, which can take months. Manual action recovery follows a reconsideration request, once you can show what you actually changed.
• Don't undo a real business. Plenty of sites hit by spam updates lost rankings for genuine reasons that happen to look spammy in aggregate. If your location pages are thin but you really do serve those locations, the fix is real local content, not deletion.