Google started rolling out an August 2026 spam update on August 18. If your leads or rankings moved this week, don’t rewrite your whole website before breakfast.

First, verify that organic search actually dropped. Then determine which pages and queries changed. Only after that should you audit the tactics that Google defines as spam.

That order matters. A rushed “recovery” can destroy useful pages, remove links that were helping customers, and make your reporting harder to read. Here is a practical response plan for small businesses that need answers, not panic.

What Google announced

Google’s official Search Status Dashboard lists the August 2026 spam update as beginning August 18 at 9:27 a.m. Pacific time. A rollout means results can move while Google’s systems process sites and queries. One day of movement is not a final diagnosis.

Spam updates are different from manual actions. Google says its automated spam-detection system, SpamBrain, operates continuously and is improved periodically to catch new types of abuse. Its official advice is straightforward: sites that change after a spam update should review Google’s spam policies and make sure they comply.

That doesn’t mean every site that loses clicks is guilty of spam. Search demand changes. Competitors publish better pages. Tracking breaks. A seasonal business may compare a busy week with a slow one. Google lists algorithmic changes, technical problems, security issues, seasonality, and reporting glitches among the possible causes of a Search traffic drop.

Your job is to identify the cause before prescribing a fix.

The first 48 hours: preserve the evidence

Don’t delete pages, disavow links, or change every title tag during the early rollout. Preserve a clean baseline.

Open Google Search Console and record total web-search clicks, impressions, average position, and click-through rate. The Performance report supports period comparisons and lets you break results down by query, page, country, device, and search appearance. Google’s Performance report documentation also explains that the 24-hour view contains preliminary hourly data, so treat the newest numbers as directional.

Compare three periods:

  • August 18 onward against the immediately preceding days
  • The latest complete seven days against the previous seven days
  • The same weekdays against the comparable period last year, if your business is seasonal

Export the page and query tables. Add a note in your analytics timeline with the update’s start date. Save a list of any site releases, migrations, content imports, tracking changes, or agency work completed during the previous 30 days.

This gives you something more useful than “traffic looks down.” You may find that branded searches are steady while three informational articles lost impressions. Or mobile clicks may have fallen while desktop stayed flat. Those are different problems.

Confirm whether the loss is SEO, tracking, or demand

Search Console records activity in Google Search. Your analytics platform records what happens after a visitor reaches the site. They won’t match exactly because they measure different events, and Google provides a guide to using Search Console and Google Analytics data together.

Use both.

If Search Console clicks are stable but analytics sessions fell, inspect consent settings, tag deployment, channel definitions, and recent website releases. That points toward measurement rather than ranking.

If impressions dropped but average positions did not, fewer people may be searching for those terms. Check whether the decline is concentrated in seasonal products, old news, or a temporary trend.

If impressions and positions fell across many nonbranded queries while branded demand stayed steady, an algorithmic change becomes more plausible. If one page template disappeared, look for technical causes such as an accidental noindex, bad canonical tag, blocked resource, server error, or broken internal links.

Check the Manual Actions and Security Issues reports too. An automated spam update is not a manual action, but you don’t want to overlook a separate notice while focusing on the headline.

Audit the spam risks small businesses actually have

Google’s spam policies cover many practices. Most legitimate small businesses don’t run sophisticated spam operations. Their exposure usually comes from shortcuts, old vendor work, compromised sites, or publishing systems that made too many low-value pages.

Scaled pages with little original value

This is common when a business publishes hundreds of city pages, service variations, glossaries, or AI-written articles. The issue is not whether a person or AI typed the words. Google warns that using generative AI to produce many pages without adding user value may violate its scaled content abuse policy.

Review pages in groups. If 60 location pages differ only by the city name, don’t add another paragraph to each and call them fixed. Decide which locations you truly serve, then add proof: local project details, travel boundaries, response times, staff assignments, permits, photos, testimonials, pricing factors, and answers based on actual customer questions.

Consolidate pages when you don’t have enough distinct information to justify separate URLs. A strong regional service page is more useful than 40 doorway-like pages that all funnel visitors to the same destination.

Look at what your current and former vendors built. Warning signs include paid guest-post packages, private blog networks, sitewide footer links, mass directory submissions, automated forum profiles, and anchors that repeat the same commercial keyword.

Don’t assume every unfamiliar backlink is toxic. The web creates messy links naturally, and Google’s traffic-drop guide cautions against focusing on technical quick fixes when a sitewide assessment is needed. Start with links you know your business paid for, exchanged, or controlled. Stop ongoing schemes. Ask for manipulative placements to be removed when practical, and document the work.

Google’s policies specifically identify link spam as links created primarily to manipulate rankings. A legitimate sponsorship, supplier listing, association membership, or news mention has a business reason beyond passing ranking credit.

Expired domains and borrowed authority

An expired domain is not automatically a problem. Buying one mainly to host unrelated content and inherit its past reputation is different.

The same logic applies to third-party sections on an established site. If an unrelated vendor publishes coupons, casino pages, loans, or product reviews under your domain because it wants your site’s reputation, investigate immediately. Google’s policy describes this as site reputation abuse when third-party pages exploit a host site’s ranking signals.

Small business sites are also hacked. Search for unexpected indexed URLs using site:yourdomain.com, review Search Console’s security report, inspect administrator accounts, and check recent file changes. Cheap hosting accounts and abandoned WordPress plugins can turn a normal company site into a spam host without the owner knowing.

Hidden text, cloaking, and redirects

Old SEO work sometimes leaves keyword blocks hidden with CSS, pages that show Googlebot different content, or redirects that send search visitors somewhere they didn’t expect. Google’s definitions of cloaking and sneaky redirects focus on deception.

Not every conditional experience is deceptive. Mobile layouts, logged-in content, paywalls implemented under Google’s guidance, and location-aware options can have valid uses. The practical question is whether search engines and people receive materially different information to manipulate rankings or mislead the visitor.

Improve the pages that lost, not every page on the site

Once you identify affected page groups, review them against customer intent.

Google’s people-first content guidance asks whether material demonstrates first-hand expertise, gives a substantial description, has a clear purpose, and leaves the reader feeling they learned enough to achieve their goal. Use the full helpful content self-assessment as an editorial checklist, not a box-ticking exercise.

For a service page, that might mean adding the conditions that affect price, what happens during the appointment, who performs the work, common failure points, warranty terms, project photos, and an honest explanation of who is not a fit.

For a product comparison, show how you tested the products, who evaluated them, the criteria used, tradeoffs, original photos, and the situations in which each option makes sense. A rewritten summary of other websites is still a summary.

For a local page, prove local relevance with work performed there, service limits, staff knowledge, neighborhood constraints, and customer evidence. Swapping city names in the same template does not create local expertise.

Google’s newer guidance for AI features makes the same point: create unique, expert-led content that provides value beyond common knowledge. That is good advice for both traditional rankings and AI-driven search experiences.

Build a recovery worklist by risk and revenue

Don’t sort the work by which SEO tool shows the angriest red icon. Use business impact.

Create a simple sheet with URL, page type, organic clicks before and after, leads or revenue, suspected issue, owner, action, and completion date. Prioritize pages that both lost meaningful visibility and contribute to sales.

Use three action levels:

  1. Remove or secure: hacked pages, deceptive redirects, controlled link schemes, hidden spam, and irrelevant third-party sections.
  2. Consolidate or rebuild: duplicated city pages, thin AI batches, copied product descriptions, and pages with no distinct purpose.
  3. Monitor: pages with small changes, low impressions, unclear seasonality, or no policy concern.

Avoid changing URLs unless necessary. If you merge pages, redirect retired URLs to the closest relevant replacement. Update internal links and your sitemap. Keep a change log so you can connect later movement with specific work.

What recovery timing should you expect?

There is no honest seven-day recovery guarantee.

Google says changes made after a spam update may help over time as automated systems learn that a site complies, but some improvements can take months. Its spam update guidance also says link-spam benefits removed by an update may not return, because the previous ranking advantage from those links is neutralized.

That distinction is important. Recovery does not always mean returning to the old line on a chart. If past performance depended on a tactic Google stopped crediting, the goal is to build legitimate visibility and qualified leads from a cleaner baseline.

Review progress weekly, not hourly. Watch affected page groups, conversions, branded versus nonbranded queries, and the quality of incoming leads. Keep improving pages where you have real evidence to add. Stop publishing content merely to hit a quota.

The August update is a useful forcing function. It gives you a reason to inspect the parts of your SEO program that nobody owns: old agency links, bulk content, forgotten subdomains, questionable location pages, and administrator accounts that should have been removed years ago.

If you want a second set of eyes on the pages and tactics putting your search traffic at risk, start a conversation with Your Web Team. We’ll help you turn the data into a prioritized repair plan instead of a month of random edits.