Google's September 2026 spam update is done. Before your MSP rebuilds anything, figure out what moved and why.
Google's September 2026 spam update started rolling out on September 24 and wrapped up on October 8. If you run a managed service provider (MSP) and your website's organic traffic wobbled anywhere in that window, the instinct is to start tearing pages down. Hold that thought.
Think about the smoke detector that starts chirping at 3 a.m. Nobody rips out the wiring or calls an electrician in a panic. You find the right detector, swap the battery, and go back to bed (eventually). A Google update deserves the same calm. A dip during the rollout is a reason to look closer, not proof that Google singled you out, and a rushed rebuild can do more damage than the update ever did.
The better move is to figure out what moved and why before touching a single page.
What Google Confirmed, and What It Didn't
Google's official word on the update fits on a sticky note. The Google Search Status Dashboard says it applied globally and to all languages, and that's about it. No list of targeted industries. No new rules for MSP websites. No memo declaring war on your blog about why backups matter. Google called it a routine spam update and moved on.
The internet, naturally, did not move on. That vacuum filled up fast, mostly with theories from people who happen to have a "Google recovery" package to sell. (The irony isn't lost here.) If you want to know what Google's systems look for, skip the hot takes and read the source. Google's spam policies for web search haven't changed, and they spell it out. They're also clear that sites breaking those rules can slide down the results or vanish from them entirely, which is why the patterns below matter, whether your traffic dropped or barely twitched.
Seven Spam Patterns MSP Sites Should Recognize
Google never said which violations this update was gunning for. It didn't need to. The spam policies already read like a rap sheet, and a few of the offenses on it look awfully familiar to anyone who's clicked around MSP websites lately. These seven are the ones to check your own site against.
1. Mass-Produced, Low-Value Content
Publishing pages in bulk, whether AI or a human wrote them, mainly to rank rather than to help anyone. Think 50 near-identical cybersecurity articles, each aimed at a slightly different keyword, and none of them saying anything new. Using AI to help write isn't the violation; cranking out pages to game rankings is. For an MSP, the tell is a blog that publishes constantly and still can't answer the question a prospect asked on last week's sales call.
2. Cloned Location Pages
Spinning up near-identical pages for every city you'd like to rank in, where the only thing that changes is the name. "Managed IT Services in Jacksonville" and "Managed IT Services in Tallahassee" shouldn't be the same page with a find-and-replace. Real location pages are fine; give each one honest local context. A page that talks about the businesses you support in that area, how quickly someone can get on-site, and who on your team covers it earns its place.
3. Manipulative Link Building
Buying links, swapping them by the hundreds, or letting a bot churn them out to puff up your rankings. The MSP classic is the vendor who swears 500 backlinks will send your domain authority through the roof, then delivers them from a crypto blog, a recipe site, and a directory nobody's visited since 2011. Links like that rarely help, and a pattern of them can earn a site a manual action from Google, which is exactly as fun as it sounds. Paid or sponsored links are still allowed, as long as they're labeled with rel="sponsored" or rel="nofollow."
4. Keyword Stuffing
Repeating the same phrase until the copy stops sounding human: "Our Jacksonville managed IT services provide the best Jacksonville managed IT services for businesses searching for Jacksonville managed IT services." If a page reads like someone yelling keywords at Google, it's due for a rewrite. Using your main keyword where it fits naturally is fine. Using it in every sentence is not.
5. Scraped Content With Nothing Added
Copying articles or service descriptions from other sites and republishing them with a few words shuffled around. Taking a vendor's cybersecurity blog, swapping "protect" for "safeguard" and slapping your logo on top counts, no matter how good the thesaurus was. Vendor-supplied content isn't off-limits, but without your own experience layered on top, it's the same page that's already live on a hundred other MSP sites, and Google has no reason to rank copy number 101.
6. Hidden Content and Cloaking
Hiding keywords or links from visitors, or showing Google's crawler a different page than prospects see. The classic move is a block of white-on-white city names at the bottom of a service page, which was already a bad idea in 2006. Expandable FAQs, accordion menus, and screen-reader text are all fine. A simple test: if it would embarrass you when a prospect hits Ctrl+A, take it down.
7. Borrowed Authority
Buying an expired tech domain for its backlinks and stuffing it with unrelated, low-value pages. Picture a dead IT blog with ten years of links that suddenly starts publishing casino reviews and "best MSP in Tampa" roundups. When a domain's old reputation has nothing to do with what's on it now, Google treats it as spam. A related trick, third-party content piggybacking on another site's rankings, falls under Google's separate site reputation abuse policy.
Diagnose the Numbers Before Touching a Page
Start in Google Search Console, not in your website builder. Compare two similar stretches of time and look at clicks, impressions, the queries behind them, the landing pages, and average position, splitting branded searches from non-branded ones where you can. Fewer people searching your company name is a very different problem from fewer people searching "managed IT services near me." Then check organic traffic and conversions in your analytics platform, because fewer visits doesn't automatically mean fewer qualified leads.
Google's guide to debugging search traffic drops lists a long roster of suspects that can produce the same ugly chart, from ranking updates and indexing problems to site changes, security issues, seasonality, and plain old fluctuation. A bad Tuesday on a graph isn't a reason to rebuild a page.
And sometimes the numbers say something nobody expected. During a recent Tactics site audit, one MSP blog post had more than 9,300 impressions in Google Search, an average position of 4.6, and zero clicks. A traffic-only report would say Google buried it. In reality, Google was showing it constantly, and people just weren't clicking. So the fix wasn't a rewrite. It was detective work: which searches the post showed up for, whether the headline matched what those searchers wanted, and whether the page answered their question.
Where MSP Sites Are Most Exposed
If the numbers do point to a real problem, it's usually hiding in one of four spots on an MSP site.
- Repeat content. Three blog posts that all define phishing the same way aren't triple the coverage. Combine them into one strong post built around what buyers actually ask.
- Thin service pages. A managed IT services page should explain scope, fit, expectations, and the next step, not run ten paragraphs of adjectives.
- Technical foundations. Indexing, redirects, canonical tags, broken links, and mobile usability all deserve a check. Not every traffic problem is a content problem, and no blog post can fix a page Google can't find.
- Missing proof. Real processes, case studies, and team expertise build credibility. Invented results or certifications build the opposite.
Check the Battery Before You Call the Electrician
Most chirping smoke detectors need a nine-volt, not new wiring, and most traffic dips work the same way. An update is a good reason to examine your site and a bad reason to throw out your strategy. Fix what you can prove is broken, start with the pages where usefulness and conversions are weakest, and keep notes on every change so the next comparison means something.
A technical search engine optimization (SEO) and answer engine optimization (AEO) audit from Tactics separates structural problems from content and visibility issues. If your traffic moved and you'd rather have a clear answer than another algorithm theory from a forum thread, reach out to Tactics Marketing.