In short
A Google spam update is an improvement to SpamBrain, Google's AI-based spam detection, or to related systems, announced on Google's status dashboard and rolled out over days or weeks; sites violating the spam policies, such as link schemes, scaled content abuse, hacked content, cloaking, expired domain abuse and site reputation abuse, lose rankings or are removed from results automatically. It differs from a core update, which re-weighs quality across all sites, and from a manual action, which is a human-applied penalty notified in Search Console. Recovery requires fixing the violation and waiting for the next update.
What a spam update is
Google runs automated systems that identify spam: content and behaviour that violate its published spam policies. The main one, SpamBrain, is a machine-learning system introduced in 2018 and expanded since. A spam update is a release that improves these systems' ability to detect a category of spam, and its effect is that sites in that category lose visibility, sometimes entirely, without any human reviewing them.
Google announces spam updates on its Search Status Dashboard with a name and a start and end date. Some are general; some target a specific policy, such as the link spam updates of 2021 and 2022, or the site reputation abuse enforcement of 2024. Rollouts take days to a couple of weeks, and effects appear during that window.
Spam updates, core updates, manual actions
Core updates re-evaluate quality and relevance across the whole index. A site that drops on a core update was not doing anything prohibited; it was judged less helpful than competitors. Recovery means becoming more helpful. Our note on what a core update means covers that case.
Spam updates enforce the spam policies automatically. A site that drops on one was, in the systems' judgement, doing something the policies prohibit. Recovery means stopping it.
Manual actions are penalties applied by a human reviewer for a specific policy violation, notified in Search Console with a reason, and lifted through a reconsideration request after the fix. They are separate from both automated systems, and a site can be affected by an automated spam update with no manual action and no notification.
The practical consequence: a traffic drop on a spam update date, with no manual action in Search Console, means an automated system has classified something on the site as spam, and there is no message saying what.
| What it does | How you find out | |
|---|---|---|
| Core update | Re-evaluates quality across the whole index | Search Status Dashboard |
| Spam update | Enforces the spam policies automatically | Search Status Dashboard |
| Manual action | A reviewer penalises a specific violation | Search Console tells you |
The spam policies, in plain terms
Google's spam policies list what the systems enforce. The ones that catch ordinary sites:
Link spam. Buying or selling links that pass ranking signals, excessive link exchanges, private blog networks, links in widgets or footers across many sites, and low-quality directory and bookmark links. This is the policy behind the disavow question.
Scaled content abuse. Producing many pages, by automation, AI or humans, to manipulate rankings, without value for users; added in March 2024 and the policy most relevant to AI-driven content strategies.
Expired domain abuse. Buying an expired domain and repurposing it to rank content unrelated to its history, also added in 2024.
Site reputation abuse. Third-party content published on an authoritative site to exploit its rankings, the coupon and review sections that appeared on news sites; enforced from May 2024 and tightened since.
Cloaking, showing different content to Google and to users; sneaky redirects; hidden text and links; keyword stuffing; doorway pages built to rank for specific queries and funnel users elsewhere; thin affiliate pages with no added value; hacked content; malware and deceptive behaviour; and scraped content republished without value.
Most of these are deliberate. The ones sites fall into by accident are link spam through an agency's past work, scaled content through an over-enthusiastic publishing programme, and expired domain abuse through a domain bought without checking its history.
Diagnosing a drop
- Check the Search Status Dashboard for a spam update overlapping the drop.
- Check Search Console for a manual action; if present, the reason is named and the path is reconsideration.
- If no manual action, read the spam policies against the site honestly, including work done by previous agencies and the site's link profile.
- Look at which pages dropped: everything suggests a site-wide judgement such as link spam or scaled content; a section suggests site reputation abuse or doorway pages.
- Check for hacked content, which is a spam issue the owner often does not know about.
Recovery
Remove the violation entirely: take down the scaled pages, disavow and stop the paid links, remove the third-party section, clean the hack, drop the doorway pages. Then wait. Automated spam classifications are reassessed as the systems recrawl and as subsequent updates run, which can take months, and there is no request to expedite it. Partial cleanups tend not to work; the classifier is looking at the site's pattern, and the pattern has to change.
Sites that never violated a policy have nothing to do on a spam update except notice that competitors who did have dropped, which is the update's intended effect. If a spam update took traffic and the cause is not obvious, book a call; the link profile and the content pattern are where we would look first.
Common questions
What is the difference between a spam update and a core update?
A core update re-weighs quality and relevance across all sites; a site that drops was judged less helpful than competitors and recovers by improving. A spam update improves Google's automated detection of sites violating its spam policies; a site that drops was classified as doing something prohibited and recovers by stopping it. Both are announced on Google's status dashboard.
How do I know if my site was hit by a spam update?
Match the traffic drop to a spam update on Google's Search Status Dashboard, check Search Console for a manual action, and if there is none, review the site against the spam policies: purchased or scheme links, scaled low-value content, an expired domain with an unrelated history, third-party sections exploiting the site's authority, hacked content or cloaking. Automated classifications come with no notification.
What are Google's spam policies?
Published rules that automated systems and human reviewers enforce: link schemes, scaled content abuse, expired domain abuse, site reputation abuse, cloaking, sneaky redirects, hidden text, keyword stuffing, doorway pages, thin affiliate content, scraped content, hacked content and malware. Violations lose rankings or are removed from results.
How long does it take to recover from a spam update?
Months, usually. After the violation is fully removed, the automated systems reassess as they recrawl and as later updates run, with no way to request expedition. Partial cleanups rarely work because the classifier judges the site's overall pattern. A manual action, by contrast, is lifted after a successful reconsideration request, typically within weeks of the fix.
What is SpamBrain?
Google's AI-based spam detection system, introduced in 2018 and expanded since, which identifies spam content and spam links automatically. Spam updates are largely improvements to SpamBrain's ability to detect particular kinds of spam, and Google reports that it neutralises the majority of spam before it appears in results.
