Google’s September 2026 Spam Update on Arabic Websites: What Moved and What Didn’t

Three white-hat Arabic sites showed no spam-update damage we could isolate. Across 200 Arabic keywords tracked in Semrush, a Saudi medical lab averaged 69.6% visibility during the 24 September to 8 October 2026 rollout, against 65.4% in the 14 days before. Its top-3 count dipped from 157 to 145 on the final day and stood at 157 again by 11 October.

The one real loss, an 8% drop in clicks on the same lab’s blog, arrived while its average position barely moved. We set every number against the swings the same sites showed with no update running, because a two-week window will always contain some movement. The checklist near the end works for any Arabic site in Saudi Arabia, Egypt, the UAE or elsewhere.

What Google released on 24 September 2026

Google released the September 2026 spam update at 09:15 Pacific time on 24 September 2026 and marked it complete on 8 October 2026. Its Search Status Dashboard entry says the update applies globally and to all languages, so Arabic results across the region were in scope.

Google named no target. Its page on spam updates describes them as notable improvements to automated spam detection, with SpamBrain as the example, and tells sites that saw a change to review the spam policies. Those policies list 16 named practices, from cloaking and doorway abuse to scaled content abuse, expired domain abuse and the site reputation policy.

Search Engine Roundtable reported at launch that the update does not target link spam and that Google would not say what share of queries it touched. It was the fourth spam update of 2026, and the first that year expected to take up to two weeks instead of a couple of days. The site’s completion report listed the main impact dates as 25 to 27 September, 30 September, and 4 to 6 October.

How we measured three clean Arabic sites

We pulled data for three VOCTOS clients on 11 October 2026: a Saudi medical lab in Semrush Position Tracking, the same lab’s blog in Search Console, and a Saudi specialist clinic in Search Console. All three run white-hat programmes with no spam signals we know of, so this is a study of what a clean site saw.

The lab project tracks 200 Arabic keywords on Google Saudi Arabia, desktop. The two Search Console properties report all countries. To keep the weekday mix equal, we compared the 14 days before launch (Thursday 10 September to Wednesday 23 September) with the first 14 days of the rollout (Thursday 24 September to Wednesday 7 October). A 15-day rollout window would carry an extra Thursday.

For a baseline with nothing announced, we compared Semrush snapshots on 10 and 23 September. Keyword-level comparisons use three dates: 23 September (the day before launch), 8 October (the day it ended) and 11 October. Search Console data stops at 8 October, because the Performance report lags, and on 11 October Search Engine Roundtable reported it more than 64 hours behind. A fourth client property was missing from the tool accounts we used, so it is excluded.

Did rankings move for the Saudi medical lab?

Slightly, and mostly upward. Across the first 14 rollout days the lab’s average position was 5.69, against 5.94 in the 14 days before, and average visibility was 69.6% against 65.4%. Semrush’s estimated traffic was flat at 89,793 against 90,569, a 0.9% difference on a modelled figure that swings by more than that from one day to the next.

The two worst-looking days sat on the rollout’s edges. Average position jumped to 7.25 on 24 September and 8.00 on 8 October, yet visibility on those days was 71.8% and 69.1%, close to the period average. Average position reacts sharply to a few keywords dropping out of the top 100, which Semrush scores as position 101. That count rose from 4 to 9 on 8 October and was back to 5 on 11 October, when visibility hit 74.2%, the highest in our 41-day series. The one competitor in the project, another Saudi lab chain, stood at 37.1% visibility that day.

Is that movement bigger than normal noise?

No. In the two weeks before the update, with nothing announced, the lab’s top-3 count fell from 162 to 157 and 44 keywords declined. Between launch and the rollout’s last day 51 declined, and three days after it ended only 34 sat below their pre-update positions. The largest single-keyword swings were the same size in both periods.

The highest-volume keyword in the set shows why single-keyword alarms mislead. This commercial query, with 90,500 monthly searches, fell from position 4 to 15 between 10 and 23 September, before the update existed, then climbed from 15 to 5 by 11 October. An informational query with 4,400 searches did the same: 3 to 21 before launch, 21 to 4 after it.

Had we read only the 8 October snapshot, we would have reported 12 lost top-3 positions; three days later the net loss was zero. If your own dashboard is still showing the rollout’s last days, check my site’s update data against a clean baseline.

Why did the lab’s blog lose clicks while position held?

We do not know, and the data does not let us pin it on the spam update. Blog clicks fell 8.0% between the two 14-day windows (269,206 to 247,778), impressions fell 3.5% and average position moved from 6.16 to 6.23. Most of the loss came in one week, 1 to 7 October, when clicks ran 14.6% below the week before.

The blog was already losing 5% to 6% of weekly clicks before launch, then gained 2.5% in the rollout’s first week, which held the first reported wave of volatility. The October drop is larger than that trend, and most of it came from click-through rate, which fell from 1.01% to 0.92% while impressions fell 6.2%.

Google’s guide to debugging traffic drops describes this shape. After a small position shift, “you might see a noticeable drop in traffic without a big change in impressions”, and clicks falling against steady impressions can mean “other sites had a more appealing rich result”.

AI Overviews are one candidate on that results page. On the lab’s 200 tracked keywords, Semrush counted an AI Overview on 163 results pages on 23 September and 180 on 8 October. We cannot tie that to the blog. Those are the main site’s keywords on desktop, not the blog’s queries, and the same count fell from 197 to 163 in the two weeks before launch. Treat it as a lead; our reading of Search Console’s AI report for Arabic sites shows how to test it with your own data.

What the Saudi specialist clinic saw

The clinic gained. Its Search Console clicks rose from 1,410 in the 14 days before launch to 1,704 in the first 14 rollout days, up 20.9%, with impressions up 19.4% and average position improving from 7.19 to 6.58. Click-through rate barely changed, from 0.79% to 0.80%, so the extra clicks followed extra visibility.

The numbers are small, between 76 and 138 clicks a day across the two windows, so a handful of queries can move them. They were also rising before the update: the clinic averaged 84 clicks a day from 3 to 9 September and 101 a day from 10 to 23 September. We read this as a trend the rollout did not interrupt, not as a reward from it.

Spam updates demote sites that break the policies; Google’s documentation says nothing about rewarding clean ones. One possible reading is that pages ranking above the clinic lost ground. We track no competitors for this property, so we cannot test it, and we would not claim it.

How do you check whether the spam update hit your site?

Compare equal windows in Search Console, read the Manual actions report, and set your own movement against a quiet baseline period before changing anything. Google tells sites to review the spam policies if they saw a change, and its debugging guide warns against radical changes to pages that already perform well.

1. Open the Manual actions report. Google’s help page says a manual action follows a human reviewer’s finding and is notified in the report and the message center. A clean report rules out a human penalty only; the update itself runs on automated systems.
2. Compare 10 to 23 September with 24 September to 7 October. Use Compare in the Performance report, then sort the Pages and Queries tabs by click difference to see whether the loss is site-wide or a few URLs.
3. Split clicks into impressions and CTR. Steady impressions with falling CTR point at the results page, such as AI Overviews or new features, before your content.
4. Size the position change. Google separates a small drop (position 2 to 4) from a large one (top 10 to position 29). Only a large, site-wide drop resembles a demotion.
5. Run the same comparison on two quiet weeks. If the pre-update swing is as large, you are looking at noise.
6. Match dates against a volatility tracker. Semrush Sensor tracks results volatility across 20+ categories; set it beside the reported peaks of 25 to 27 September, 30 September and 4 to 6 October.
7. Audit pages made at scale. The scaled content abuse policy names generative AI pages “without adding value” and automated “translating”, which matters for Arabic sites that machine-translate English pages in bulk.
8. Rule out technical causes. Check Security issues, Page indexing and Crawl stats, as Google’s debugging guide suggests.

Our read

For a clean Arabic site, the September 2026 spam update was not the story. On the lab’s 200 keywords, the two quiet weeks before launch moved rankings about as much as the rollout did, and three days after it ended the top-3 count was exactly where it started.

We think the bigger risk for most Gulf and Egyptian brands is reacting to a date on a dashboard. A team that rewrote pages on 8 October, the rollout’s worst snapshot, would have spent money fixing positions that came back on their own by 11 October.

A click drop with flat rankings is a results-page question before it is a penalty question. The blog’s lower click-through rate is the one finding here that costs real traffic, and the work it calls for is snippet, title and AI Overview citation analysis, not a spam clean-up.

Where spam updates do threaten Arabic sites is in bulk production. Early observations quoted by Search Engine Roundtable on the first weekend pointed at highly templated, programmatic pages. Thousands of auto-translated articles, bought expired domains and rented-out sections fit that description far better than anything in our sample.

Measurement caveat, added 18 October 2026: Search Engine Roundtable reported on 12 October that Google is blocking and sending altered results to some third-party rank trackers (Nozzle measured about 8% of SERPs affected), and that tools such as Semrush and Sistrix lagged on some changes. Our position figures here come from rank tracking and Search Console; treat any tracker-only movement as directional and read the Search Console numbers first. Source: Search Engine Roundtable.

What this data does not prove

Three sites, two of them one health business, all Saudi-facing and all doing white-hat work, cannot show who the update hit. A null result is what we expected from sites with no spam signals, and it says nothing about sites that use the tactics Google targets.

Semrush tracks desktop results from one location, and its traffic figure is modelled. Search Console data stops at 8 October. We have no competitor data for the clinic and no query-level view of the blog’s lost clicks. Search Engine Roundtable noted that it could not rule out other Google changes inside the same two weeks, and neither can we. We will rerun the same windows a month after completion and publish whatever changed.

FAQ

My traffic dropped during the spam update. Was my site penalised?

Not necessarily. Check the Manual actions report first, then compare equal 14-day windows in Search Console. If position barely moved and the loss sits in click-through rate, look at the results page before your content. On a clean Saudi lab site we tracked, the two weeks before launch moved rankings about as much as the rollout did.

When did the September 2026 spam update start and end?

Google’s Search Status Dashboard lists the start as 24 September 2026 at 09:15 Pacific time and completion on 8 October 2026. It applied globally and to all languages, Arabic included. Search Engine Roundtable listed the main impact dates as 25 to 27 September, 30 September, and 4 to 6 October, all inside the two-week rollout.

Did the update treat Arabic and Saudi websites differently?

Google gave no language-specific details; the dashboard says the update applies to all languages. Our three Saudi-facing Arabic sites showed no damage we could isolate. That shows clean sites came through. It says nothing about Arabic sites built on scaled, machine-generated or machine-translated content, because none of ours use those methods.

How long does recovery from a spam update take?

Google’s spam updates page says a site that fixes violations can improve once its automated systems learn, over a period of months, that the site complies. After a link spam update, value from removed links does not return. Search Engine Roundtable reported that Google said refreshes would continue periodically, so there is no fixed recovery date.

Should I change my site while an update is still rolling out?

Hold structural changes until the rollout ends and you have compared equal windows. Google’s traffic-drop guide recommends avoiding radical changes when a page already performs well. On the lab we tracked, a 12-position top-3 loss on the rollout’s last day had disappeared three days later, without any change to the site.

The better question

The useful question after a spam update is not whether it hit you but whether you could tell a hit from ordinary movement. On our three sites, the answer needed a quiet baseline, equal weekday windows and a split of clicks into impressions and click-through rate.

If your drop is large, site-wide and lines up with the reported dates, read the spam policies against every page type you produce at scale and fix those first. If the drop is small or sits in click-through rate, leave the content alone and study the results page. Either way, help me read my Search Console data after this update. For the traffic side of the same problem, our bot traffic data for Arab markets covers why a session count alone can mislead.