Google Spam Update Ends as Illyes Shares Crawl Timing Ranges

Two announcements, one practical lesson

In the same week, Google closed out its longest spam rollout of 2026 and gave SEOs rare internal figures on how slowly its systems move. Taken together, the two developments say a lot about the gap between when Google says something is finished and when a site's search performance actually reflects the change.

The September 2026 spam update began on September 24 at about 9:15 a.m. Pacific. Google's Search Status Dashboard marked it complete on October 8, just inside the two-week window Google gave at launch.1213 Separately, Google's Gary Illyes presented typical and slowest-case timings for crawling, indexing and serving at Search Central Live Deep Dive Europe in Barcelona. The figures run from discovering a new URL to recovering from a core update.16

Read side by side, they make one point: a finished rollout does not mean Google has seen your fix, and Google has now said so with numbers.

A "normal" update that wasn't short

All the coverage agrees on the basic facts. Google announced that the update applied globally and to all languages and might take up to two weeks.11 It later posted a one-line confirmation that the rollout was complete as of October 8.20 On LinkedIn, Google called it a normal spam update.11

The length is what stood out. This was Google's fourth spam update of 2026, after March, June and August. Each of those finished in under three days.12 The March update took about 19 and a half hours, June's took about two days and one hour, and August's took about two days and 16 hours.14 One analyst pointed out that September's update ran longer than the three earlier ones combined.13 Another noted it also outlasted this year's March and May core updates, which took roughly 12 days each.20

Barry Schwartz of Search Engine Roundtable questioned how a two-week rollout counts as "normal" when the earlier ones took two days.11 Long spam rollouts have happened before, though. The August 2025 spam update ran about 26 to 27 days, and a December 2024 update took about seven days.1518 What's new is the change from this year's pattern of very fast rollouts.

Reports differ slightly on the exact finish time. Several put the end at 1:00 a.m. Pacific, for a total of about 13 days and 16 hours.1213 Search Engine Roundtable recorded 4:37 a.m. Eastern, which is 1:37 a.m. Pacific.11 At least one report rounded the duration to 13 days and 15 hours.20 None of these differences changes anything practical. Whichever figure you use, September 24 to October 8 is the window to compare against.

How hard did it hit?

This is where reports split. Schwartz described what looked like a significant update, with some observers calling its impact closer to a core update. He identified volatility waves on September 25–27, September 30 and October 4–6, while warning that those dates assume no other update ran at the same time.11 A German-language trade report also described search volatility as very high recently.17 Diib analyzed 32,569 sites with connected Google Analytics during the rollout, and early data suggested a measurable organic traffic dip for some of them.14

Coalition Technologies took a more cautious view, arguing that a longer rollout does not necessarily mean a bigger update.12 That's a fair point, but the volatility patterns suggest this one was not minor.

Google has not said what it targeted. Several reports stress that Google named no specific tactic or policy.1420 One report says link spam was outside this update's scope.19

The AI SEO angle

Google hasn't confirmed that AI content was targeted, so claims about AI-generated spam should be treated as hypotheses. Coalition Technologies described AI-generated spam as a possible focus but noted that Google has not confirmed any specific targeting.12 One GEO-focused analyst went further, arguing that self-ranking listicles and programmatic AI pages are losing ground. That analyst separated confirmed facts from predictions.13

My reading is that the risk is real even without confirmation. Google's spam policies target pages built to manipulate rankings rather than help visitors.16 Mass-produced AI pages and self-promotional "best of" lists are among the easiest kinds of content to manipulate rankings with. Even without a confirmed target, publishers relying on those formats should treat this update as a warning.

The crawl coverage also highlighted how Google and AI search differ. One developer's logs from nine new sites showed ChatGPT's OAI-SearchBot sometimes arriving before Googlebot. On one site it came about 20 minutes after the domain went live, while Googlebot arrived two days later.4 The author noted that this varies by site, and that Google's slower pace reflects its multi-stage crawl, index and serve pipeline rather than a slow bot.4 Crawl controls differ too. Googlebot ignores the robots.txt Crawl-delay directive, while several AI crawlers reportedly follow it.3 Google also expanded its crawl rate documentation to cover the Retry-After header for 503 and 429 responses.10

What Illyes' numbers show

The timing tables give SEOs official reference points for questions they used to answer from experience. Typical figures include:

• New URL discovery: about 20 hours
• Refreshing a known URL: about 30 days
• Sitemap processing: about 24 hours
• End-to-end indexing: about 1.5 hours6

The slowest cases are much longer, and several end in "never." Sitemap processing, end-to-end indexing and structured data updates are marked with quality as the reason.16

On the serving side:

• Title and snippet changes: typically one to two days1
• Canonicalization changes: typically one to three weeks
• Site moves: typically one to three months, and six months to more than a year at the slowest6
• Manual action removal: typically one to two weeks, and longer for dormant sites
• Core update recovery: typically three to six months, and up to a year at the slowest, described as waiting for the next core update1

The most useful caveat is Illyes' own: these processes are linked, so delays add up. A page can't be indexed until it has been crawled.6 ALM Corp estimated that a new page could reach the index in roughly a day if everything goes well. It labeled that as its own back-of-the-envelope math, not a figure Google presented.5

Search Engine Journal noted the data's limits. Neither the attendee recap nor Google's event pages give a sample size, a time period or a definition of "typical."1 Illyes also told Schwartz that the slides were partly an exercise to see whether the audience could relate to internally pulled numbers.6 These are rough ranges, not guarantees.

Where the timing table and the spam update meet

The two stories overlap directly on one line. The table reproduced by Search Engine Roundtable lists spam update changes as typically taking one to two weeks on a continuous basis, and months when they depend on batch refreshes.6 ALM Corp's write-up said the slide listed a one-to-two-day typical rollout and that Schwartz had flagged a mismatch with the two-week September update.5

Going by the table as reproduced, the September rollout fits within Google's own typical range. The mismatch looks more like a gap between that range and the very short spam rollouts earlier this year. Either way, the important part is the "months" figure. Google's spam guidance has long said that recognizing a fixed site can take months, and the slide puts a rough timeframe on that.1120

What SEOs should do now

The takeaway across the coverage is to be patient and measure carefully. Scale Xpert argues that a spam update ending is not a recovery deadline. It recommends tracking four separate dates: when a fix was deployed, when Googlebot fetched it, when URL Inspection reflected it, and when performance changed.7 It also warns against treating core update recovery ranges as a schedule for spam recovery.7 SEO Expert suggests comparing September 17–23 with data from October 9 onward in Search Console.20 Coalition Technologies adds a warning that, with four spam updates in seven months, not every ranking drop in this window was caused by this update.12

Google's own documentation also says that repeatedly requesting a recrawl of the same URL won't speed it up.2 Silverback Marketing argues that the 30-day refresh cycle and the three-to-six-month core recovery window belong in client forecasts. Judging a fix in its first two weeks is premature.10

In short, Google has finished its update but hasn't said what it targeted. It has also shared numbers showing that the results of any cleanup will take weeks to months to show up. Teams that set a clear baseline now will be in the best position to tell what actually worked.