Google’s September 2026 spam update finally wrapped after nearly fourteen days, four to five times longer than any of the three spam updates Google ran earlier in the year, and in the aftermath Google has quietly handed SEOs a rare look at how long core update recovery actually takes. If you’ve ever wondered why your site hasn’t bounced back from a ranking hit months after a core update supposedly finished, Google’s own numbers finally say the quiet part out loud: often it doesn’t, not quickly, and sometimes not within a year.
The spam update itself started September 24 and finished rolling out October 8, a run of 13 days and 16 hours according to Google’s own Search Status Dashboard. Compare that to the three earlier spam updates Google ran in 2026, each of which wrapped in under three days. Google hasn’t explained publicly why this particular update took so much longer, and the lack of explanation has become its own minor irritant in the SEO community, since update duration is one of the few signals SEOs use to gauge how aggressively Google is rewriting its spam detection systems underneath the hood.
Rank tracking tool SEOmonitor reported something stranger happening during the rollout window: starting around September 26, automated rank-tracking tools began seeing sudden ranking swings that real searchers using Google weren’t experiencing. SEOmonitor’s explanation is that Google was serving incomplete or inconsistent data specifically to automated query tools during the volatile rollout period, a theory that, if accurate, would mean a decent chunk of the “ranking volatility” SEOs panicked about during this update was partly an artifact of how rank trackers query Google rather than a true reflection of what human searchers saw. That’s a meaningful distinction for anyone who spent two weeks anxiously refreshing a rank tracker during this rollout.
The more useful information came out of a side channel entirely: Google’s Gary Illyes, speaking at Search Central Live Deep Dive Europe in Barcelona on October 2nd, reportedly gave attendees actual timing ranges for how long different kinds of Google Search recovery take. According to a recap published by an attendee, Illyes said a site move typically takes one to three months to fully settle in Google’s index, with the slowest cases stretching six months to over a year. Core update recovery, separately, typically runs three to six months, with the slowest cases again stretching toward a year.
The recap notes Illyes didn’t specify sample size, time period, or exactly what counts as “typical” in his figures, which means these numbers are directionally useful but shouldn’t be treated as a precise service-level agreement from Google.
Why does this matter beyond satisfying curiosity? Because the single most common question in SEO forums after any core update is some version of “how long until I recover,” and Google’s public answer has historically been a vague, unhelpful “it can take a while.” Having even rough ranges, one to three months for a site move on the fast end, up to a year on the slow end, gives site owners something concrete to set expectations against, both internally with leadership asking for timelines and externally with clients who want to know when an SEO recovery plan is actually going to show results.
Google made a few smaller but genuinely useful announcements in the same window. Search Console’s Performance report can now combine data across multiple countries or device types in a single filtered view, announced via Google Search Central’s LinkedIn account on October 6th, a small but real workflow improvement for anyone managing international sites who previously had to pull separate reports per country and stitch them together manually. Compare mode still only supports two items side by side, and multiple Search Appearance types still can’t be filtered together, so the improvement is incremental rather than a full overhaul.
Google also updated its people-first content guidance to explicitly warn against fabricated author profiles, calling out AI-generated headshots, invented names and false credentials as deception that signals a low-quality page. This isn’t a new ranking factor so much as a formalization of something Google’s spam systems have likely already been penalizing informally; sites that have been building fake “expert author” personas to pad out E-E-A-T signals now have explicit written guidance confirming that practice is treated as a red flag rather than a gray area.
And in a smaller item from a podcast appearance, Google’s Martin Splitt addressed why AI training crawlers so often can’t find a site’s sitemap: most AI crawlers, unlike Googlebot, don’t offer any mechanism for a site to proactively submit a sitemap location, so Splitt suggested sites fall back on a predictable default filename like sitemap.xml, or lean on an RSS feed, since he’s personally observed AI crawlers requesting both in his own server logs.
None of this comes from an official Google blog post laying out the full picture in one place, which is itself worth flagging. Google’s most useful SEO information this cycle came out piecemeal, a conference recap here, a LinkedIn post there, a podcast aside somewhere else, rather than through the structured documentation updates Google used to lean on more heavily. That scattering makes it harder for site owners to stay current unless they’re actively following the search marketing trade press, and it’s part of why aggregated roundups like this one have become more essential reading for SEO teams than Google’s own official channels in a lot of cases this year.
The bottom line: The real news isn’t that a spam update finished, it’s that Google let slip actual timing ranges for core update and site-move recovery, three to six months typically, up to a year in the slowest cases. If you’ve been panicking that your site should have recovered by now, Google’s own numbers say you might just be inside the normal range still.


