Quick answer: If your traffic dropped in August 2026, there are four likely causes, not one. The August 2026 spam update (18-21 August) is only one of them. The others are AI Overview click absorption, ordinary seasonality, and self-inflicted technical damage from your own deploys. They look nearly identical on the Search Console overview chart and they need completely different fixes. Read clicks, impressions and average position together to tell them apart.
Almost everyone who asks me this question in late August arrives with the answer already decided. Their traffic fell, Google ran a spam update on 18 August, so the spam update did it.
That is usually wrong. I have spent the week since the rollout finished going through client Search Console properties, and the honest finding is uncomfortable: most of the sites I have looked at that were convinced the spam update hit them were not hit by the spam update. At least four separate things pulled traffic down in the second half of August 2026, and three of them look the same on the one chart most people check.
That matters because the four causes have nothing in common. One needs a content rebuild measured in months. One needs no remediation at all, because nothing is broken. One needs no action beyond waiting. One is a bug you can fix this afternoon. Guess wrong and you spend a quarter fixing a problem you do not have while the real one keeps running.
So this is not a "what the update targets and how to recover" piece. This is the differential diagnosis: how to work out which of the four actually happened to you, using nothing but Search Console, in about thirty minutes.
The four things that pulled traffic down in August 2026
This is the part that separates a careful diagnosis from an expensive mistake. Four distinct events overlap in the August data, and only one of them is the spam update.
1. Volatility before the update, on 1-3 and 12-13 August
Third-party trackers registered notable movement in both windows, days and weeks before the announcement on the 18th. This is not speculation on my part: Google's John Mueller explicitly said the volatility people saw prior to the announcement was not this update. If your decline began in the first fortnight of August, the spam update did not cause it, and rewriting your content to fix a violation you do not have will not bring it back.
2. A Search Console reporting defect from 13 August
A logging defect affected the Generative AI and Discover performance reports in Search Console from 13 August 2026, five days before the spam update started. Open Search Console, filter to Discover or an AI surface, see a cliff in mid-August, and you may be looking at a reporting bug rather than a ranking loss.
The defensive move is simple and it is step one of the diagnostic below: run your analysis on the Web search type only.
3. AI Overview and AI Mode click absorption
This is the quiet one, and in my experience it is the most commonly misdiagnosed. Your rankings do not move at all. Your impressions hold. Google answers the query above your result and the click never happens. On the overview chart that looks exactly like a penalty. It is not one, and no amount of spam remediation will fix it.
4. The update itself, 18-21 August
Only movement beginning inside or immediately after that window is a candidate. Spam updates do not reach back and take traffic you lost two weeks earlier.
And a fifth possibility worth naming: some sites gained. Publishers in the search forums reported that this update reversed earlier false positives and restored traffic they had lost in a previous cycle. If your numbers went up on 18 August, that is a plausible reason, and it is a reminder that spam updates correct in both directions.
The four-branch diagnostic: which one is yours?
This is the procedure I actually run. It takes about half an hour and needs nothing but Google Search Console.
Gate: check Manual Actions first
Open Search Console and go to Manual Actions before anything else. A manual action and an algorithmic update can coexist, and they need completely different responses. A manual action has a reconsideration process. An algorithmic spam update does not. If that report is empty, whatever happened to you was algorithmic and no submission will shorten the clock.
Set-up: Web search type, and the right date comparison
In Performance, change the search type filter from the default to Web. This excludes Discover, News, Image, Video and the AI surfaces, sidestepping the mid-August reporting defect entirely. Then use the custom date comparison to put 22 August to 5 September against 1 to 15 August. That puts a clean two-week post-rollout window against a clean two-week pre-rollout window with the noisy 18-21 rollout excluded from both sides.
Now read the signature. Every branch below is defined by a different combination of clicks, impressions and average position.
Branch A: a real spam update hit (clicks, impressions and position all down)
Signature: clicks down, impressions down, average position down. Onset lands inside 18-21 August. Critically, the loss is concentrated in a subset of URLs rather than spread evenly across the site.
That concentration is the confirming evidence, and it usually names the violation for you. Group the losing pages by template, by author, by how they were produced, and by intent. A shared factor across the losers is the signature. If the loss sits entirely inside a programmatic folder, you are in doorway or scaled content territory. If it sits in an affiliate roundup section, look at thin affiliation.
Branch B: AI Overview click absorption (clicks down, impressions flat)
Signature: clicks down, but impressions flat or rising and average position stable.
You did not lose rankings. You lost clicks off rankings you still hold. This is not enforcement and there is no violation to fix. The response is a different discipline entirely: structuring pages so they get cited in the answer rather than skipped over it. I have written the specifics of that in why sites do not show up in AI Overviews and how to rank in AI Overviews.
Branch C: seasonality or demand shift (everything down, brand included)
Signature: the decline is uniform across all URLs, including your branded queries.
Here is the sharpest single test on this page, and I have not seen it published anywhere else in the coverage of this update: filter your queries to your brand name and check whether those clicks fell too.
Branded queries are effectively immune to spam updates. Nobody searching your company name by name gets served a different result because SpamBrain improved. So if your brand clicks dropped by roughly the same proportion as everything else, you are almost certainly looking at seasonality, a demand shift, a tracking change or a measurement artefact, not enforcement. If brand held steady while non-brand collapsed, that is consistent with Branch A.
Branch D: self-inflicted or technical (your indexed page count moved)
Signature: your indexed page count moved, or the Page Indexing report changed state around the same date.
Before concluding anything, confirm that between 15 and 20 August you did not deploy a site change, alter robots.txt, change canonical logic, migrate a CMS, let a certificate lapse, or have a plugin update alter your rendered HTML. I have lost count of the "algorithm penalties" that turned out to be a deploy shipping a stray noindex. Check the robots.txt and indexing reports before you touch the content strategy. This is where my technical SEO work starts for exactly this reason.
The uncomfortable part: in the properties I have looked at since the rollout, Branch A was the minority answer. Most landed on B, C or D. Sorting them apart is thirty minutes of work and it decides where the next three months of budget goes.
If you landed on Branch A: what Google actually announced
Everything Google formally published fits in two sentences on the Search Status Dashboard incident record:
"Released the August 2026 spam update, which applies globally and to all languages. The rollout may take a few days to complete."
Google Search Status Dashboard, 18 August 2026, 09:28 PDT
On LinkedIn, Google added only that "this is a normal spam update, and it will roll out for all languages and locations," and pointed to its spam updates help document. There was no Search Central blog post. That is the entire official communication.
It still gives you four facts, and they are the spine of any real diagnosis:
- A hard start: 18 August 2026, 09:27 US/Pacific (about 12:30pm ET).
- A hard end: 21 August 2026, 01:49 PDT.
- A duration: two days and sixteen hours.
- Global scope: every language, every region. No country carve-outs to check.
What Google did not do matters just as much. It added no new spam policies. The spam policies documentation still carries a last-updated stamp of 15 May 2026.
No new policies means nothing became a violation in August that was not already a violation in July. SpamBrain, Google's machine-learning spam prevention system, simply got better at catching things that were already against the rules. If this update genuinely hit you, no goalpost moved. Something that was already prohibited finally got detected.
What Google said it did not target, and how firmly
Here is a claim you will see repeated on a dozen agency blogs this week, usually phrased as though Google announced it:
"This update does not target link spam, it does not target the site reputation abuse policy and some other policies."
Search Engine Roundtable, 21 August 2026
Be precise about where that came from, because most pages repeating it are not. Google did not publish this. It is not in the incident record, it is not in the documentation, and it is not on the Search Central blog. It comes from Barry Schwartz at Search Engine Roundtable, who put questions to Google directly and reported the answers, noting in the same fact box that "Google would not tell me what percentage of queries or searches were impacted by this update."
So: it is a credible confirmation from the most reliable reporter on this beat, obtained directly from Google, and it is not a Google publication you can cite back to Google. Treat it as strong evidence, not as documentation. I am flagging the distinction because you will make decisions on this claim, and a claim you cannot trace is a claim you cannot defend when it turns out to be wrong.
Taken at that weight, two exclusions remove the two most common panic responses:
- Do not start with your backlink profile. The reflex after any spam update is to open a backlink tool, find some ugly referring domains and start a disavow file. Google names link updates explicitly when they are link updates, as it did with the December 2022 link spam update. This one was not named that way.
- Do not tear down your partner or sponsored content section. Site reputation abuse covers third-party content published on a strong host domain to borrow its ranking signals. It was reported out of scope.
There is a second-order consequence of the link spam exclusion that is genuinely good news, and I have not seen anyone say it. Google's spam updates documentation draws a distinction that matters enormously:
"Making changes may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies."
But for link spam specifically, Google warns that "making changes might not generate an improvement. This is because when our systems remove the effects spammy links may have, any ranking benefit the links may have previously generated for your site is lost."
Read that carefully. A link spam hit can be permanent by design. Nothing is being lifted, so there is nothing to restore: the ranking was propped up by links Google has now neutralised, and cleaning up does not give it back. Content-side violations do not work that way. Fix the underlying problem and the page can genuinely earn its position back. If August took your traffic, you are in the recoverable category rather than the structural one.
The 16 spam policies, scored against this update
If you finished the diagnostic on Branch A, this is where you narrow it down. Google names sixteen distinct spam policies. Two were reported out of scope, along with unnamed others. Everything else is live:
| Spam policy | Status | Who should worry |
|---|---|---|
| Link spam | Reported OUT | Nobody, on the SER reporting above. |
| Site reputation abuse | Reported OUT | Nobody, on the same reporting. |
| Scaled content abuse | Prime suspect | Anyone who published a large volume of near-identical or low-substance pages, AI-assisted or not. |
| Doorway abuse | Prime suspect | Programmatic city, service or "best X in Y" page sets that differ only by a swapped noun. |
| Expired domain abuse | Prime suspect | Content on a bought expired domain unrelated to its former use. |
| Scraping | Prime suspect | Aggregators and feed-republishers adding no original analysis. |
| Thin affiliation | Prime suspect | Affiliate sites reusing merchant descriptions without original testing or opinion. |
| Cloaking | In scope | Sites serving different HTML to Googlebot, sometimes via a plugin the owner forgot about. |
| Hidden text and links | In scope | Zero-opacity keyword blocks, off-screen text, CSS-hidden footer link farms. |
| Keyword stuffing | In scope | Pages ending in a list of 40 city names, or a phrase repeated unnaturally. |
| Hacked content | In scope | Anyone on an unpatched CMS. Check this before you blame your content strategy. |
| Sneaky redirects | In scope | Often a symptom of a hack rather than a decision. |
| User-generated spam | In scope | Forums, comment sections and unmoderated profile pages. |
| Misleading functionality | In scope | Fake calculators and converters that do not actually work. |
| Malicious practices | In scope | Includes back button hijacking, folded into this policy in April 2026. |
| Machine-generated traffic | In scope | Rank-tracker scraping at volume. Rarely the cause of a site-wide drop. |
What to do if you are genuinely on Branch A
Match the remedy to the violation. Generic advice to "improve quality" is how people waste six months.
Scaled content abuse
The policy targets producing many pages that add little or no value to users. The trigger is not the tool, it is the absence of substance at volume. Go through the affected folder and ask one question per page: does this contain anything a reader cannot already get from the top three results? Consolidate the failures into fewer, deeper pages and redirect the rest. A hundred thin pages merged into fifteen genuinely useful ones beats a hundred pages lightly rewritten.
Doorway abuse
The classic programmatic location-page problem. If your Chicago page and your Cleveland page differ only by the city name, they are doorways under Google's definition regardless of your intent. The fix is fewer pages with real local substance: named neighbourhoods, local pricing realities, actual work you have done in that market. If you cannot write genuinely different content for a location, you should not have a page for it.
Thin affiliation
Merchant descriptions plus an affiliate link is the exact pattern the policy names. Add first-hand testing, original photography, a comparison you actually ran, or a stated opinion with reasoning behind it. Restating a spec sheet is not added value.
Cloaking, hidden text or hacked content
Treat this as urgent and technical rather than editorial. Fetch your key pages with the URL Inspection tool's live test and compare the rendered HTML against what a browser sees. Differences you did not author are usually a compromised plugin or an injected script. Fix the security problem first; ranking recovery follows the cleanup, not the other way round.
The recovery clock, honestly
Google told Search Engine Roundtable two specific things about recovery from this update: it will run periodic refreshes of the spam update, and it can take many months to recover. That matches the hedged language in the documentation, which says improvement "may" come "if our automated systems learn over a period of months that the site complies with our spam policies."
Three things are true in that sentence and people miss all three:
- "May", not "will". Compliance is necessary, not sufficient. Fixing the violation removes the suppression. It does not restore rankings you were never going to hold on merit.
- "A period of months". Google must recrawl the changed pages, reindex them, then run a subsequent spam evaluation. Those are separate clocks running in sequence. Anyone promising a four-week turnaround on a spam update recovery is selling you something.
- "That the site complies". This is site-level assessment, not page-level. Cleaning half the offending folder and leaving the rest live gives the system a mixed signal.
For calibration on how little rollout length tells you: the August 2025 spam update took twenty-seven days just to finish rolling out, and SISTRIX's analysis afterwards found minimal visible ranking movement.
Every Google spam update in 2026
August was Google's third spam update of the year. The full record is on the Google Search ranking updates history; here it is with durations and incident IDs, which is the version you actually need when you are date-bounding a drop:
| Update | Window | Duration | New policies? |
|---|---|---|---|
| March 2026 spam update | 24-25 March | ~19h 30m | None |
| June 2026 spam update | 24-26 June | ~2d 1h | None |
| August 2026 spam update | 18-21 August | 2d 16h | None |
Each rollout in 2026 has taken longer than the one before, and August ran more than three times as long as March. I would not read impact into that on its own, but the pattern around it is real. Google spent the first half of 2026 widening what counts as spam rather than shipping new headline systems: back button hijacking was folded into the malicious practices policy in April 2026, and attempts to manipulate AI-generated answers were addressed in May. Then the policy page went quiet and the enforcement cadence picked up instead.
The strategic read is straightforward. Google is not writing many new rules right now. It is getting better at enforcing the ones it already has, roughly every two to three months. Anything working only because it has not been caught yet has a shrinking runway. The same quality signals feed how entity strength and structured data are assessed, which is why the sites that ride these updates out tend to be the ones that were never optimising for the gap in the first place.
The bottom line
If your traffic dropped in August 2026, the single most useful thing I can tell you is that the spam update is the least likely of the four explanations to be yours, and the most expensive one to act on by mistake. It was a two-day-and-sixteen-hour global enforcement pass against rules already on the books. On Search Engine Roundtable's reporting, link spam and site reputation abuse were out of scope, which points that branch at the content and technical side of your site and means recovery is achievable rather than structurally impossible.
But the bigger risk this month is misattribution. With pre-update volatility on 1-3 and 12-13 August that Google's own John Mueller said was not this update, a Search Console reporting defect running from the 13th, and AI Overview click absorption happening continuously underneath all of it, the odds of confidently diagnosing the wrong cause are higher than usual. The cost of that mistake is a quarter of wasted work.
Check Manual Actions. Switch to the Web search type. Compare clean windows either side of the rollout. Read clicks, impressions and position together rather than staring at the one line on the overview chart. Test your branded queries. Rule out your own deploys. Then, and only then, fix the specific violation the evidence points at, and give the recrawl and reassessment cycle the months Google says it needs.
If you would rather not guess: the four-branch diagnostic above is exactly what I run for clients. The hard part is not the steps. It is being honest about what the data says when the answer is inconvenient, and most sites I look at after an update have a different problem than the one the owner arrived certain of.
If your traffic moved in August and you are not sure which of the four it was, that is a solvable problem, and it starts with reading the data properly rather than rewriting your site on a hunch. My SEO consulting and technical SEO work both begin from that diagnosis, and you can see how it plays out on real sites in my case studies. If you are weighing up who should do it, I have also written on choosing between an agency and a consultant.
Book a free 30-minute call and bring your Search Console access. We will run the four branches together on your actual data, and you will leave knowing which one you are on. If it is not the spam update, I will tell you that too, and tell you what it is instead.
