March 2026 spam update: which sites were affected and how to protect yourself

March 2026 spam update: which sites were affected and how to protect yourself: Google announced the update on 24 March 2026, at 12:18 Pacific time, through the status page and LinkedIn, and confirmed its completion after about 19 and a half hours, the shortest rollout in the history of the status page. If your site dropped suddenly around 24-25 March, this is the probable cause; if not, check the list below anyway, because spam updates recur and target the same practices.

The article summarizes what Google confirmed, explains the mechanism (SpamBrain) and the difference from a core update, lists the types of spam targeted and the signs that you have been hit, then the diagnosis, cleanup and prevention, with what we have seen on client accounts.

March 2026 spam update: which sites were affected and how to protect yourself

What Google confirmed

• The first spam update of the year and the first since the one in August 2025, which had lasted almost four weeks.
• Applied globally, in all languages and regions.
• Described as a "normal spam update", with no new policies; an improvement to existing systems, not a change of rules.
• A rollout of under 20 hours, a sign that the change was in the detection model, applied to the index in bulk, not a gradual reassessment.

SpamBrain, the mechanism

SpamBrain is Google's machine-learning-based spam detection system, introduced in 2018 and continuously improved; it does not apply fixed rules, but learns patterns of manipulation, including some that classic filters would not recognize: link networks, mass-generated content, compromised sites, cloaking, reputation abuse. A spam update means a new version of the model, with new patterns learned; sites that match the patterns are demoted or removed, with no notification in Search Console (unlike manual actions).

Spam update versus core update

	Core update	Spam update
What it evaluates	quality and relevance, in general	violations of the spam policies
Who loses	sites with weak content compared with the alternatives	sites with manipulative practices
Recovery	continuous improvement, at later updates	removing the practice, then reassessment (weeks or the next update)
Notification	no	no (only manual actions notify)
Rollout duration	one to three weeks	hours to weeks

Which practices it targets

1. Manipulated links: bought without rel=sponsored, mass exchanges, networks of your own sites, automated comments and profiles, repeated commercial anchors.
2. Scaled content abuse: many pages with no value, generated automatically or manually, to manipulate rankings (policy from March 2024).
3. Site reputation abuse: third-party content published on an authoritative site to take advantage of its authority.
4. Expired domain abuse: domains bought for their history and filled with something else.
5. Compromised sites: injected foreign pages, redirects, cloaking.
6. Hidden text and links, keyword stuffing, doorway pages, deceptive redirects.

The full list is in the spam policies in Search Central; each point above has its definition and examples there.

Signs that you have been hit

• A sudden drop in clicks and impressions on 24-25 March 2026, across the whole site or in sections, with no changes to the site on those days.
• Pages that disappeared from the index or dropped massively, with no reason in the indexing report.
• Empty Manual actions and Security issues reports (if they are not, you have a different problem, covered in the article on recovering after a penalty).
• A link profile with many unknown domains, commercial anchors or foreign languages; or content generated in volume in the preceding months; or a third-party section; or signs of compromise.

The diagnosis

1. Confirm the date: the performance report, by day, with the drop on 24-26 March; compare the 14 days after with the 14 before, by groups of pages, using the method from the article on measuring the impact of an update.
2. Rule out technical causes: noindex, blocks, 5xx errors, migrations in the same week.
3. Check the site for compromise: searching site:domain.ro for foreign pages, file checksums; the steps are in the guide to detecting and removing malware.
4. Inventory the links: the Links report in Search Console plus an external tool; the linking domains, the anchors, the date they appeared; look for waves of links from old campaigns or from previous agencies.
5. Inventory the content: pages generated in volume, third-party sections, template pages; what was published in 2025-2026 without human review.

The cleanup

• Links: remove the ones you control (your own networks, exchanges), removal requests for the rest, domain-level disavowal only for obvious networks; do not disavow good links "out of fear".
• Scaled content: delete or noindex pages with no value; consolidate those that can be saved; the rule for the future is in the article on automatically generated content.
• Third-party sections: remove or noindex; content published by others on your domain for their own purposes has no place.
• Compromise: full cleanup, rotated credentials, a review request if there is a security warning.
• Document everything, with dates: if a manual action appears later, you have the reconsideration request ready.

The effect of the cleanup does not come immediately: SpamBrain reassesses the site in the following weeks or at the next spam update. On client accounts hit by earlier spam updates, partial recovery came two to three months after cleanup, and full recovery rarely, because some of the positions were supported by exactly what was removed.

Prevention

1. No bought links without rel=sponsored; no mass exchanges; no site of your own created only to link; the right strategies are in the guide to link building strategies.
2. Content with a brief, human review and original information; no volume for the sake of volume.
3. No sections rented out to third parties; editorial partnerships with your own editorial control.
4. A secured site: updates, two-factor authentication, backups, scans; the guide is in the article on securing a WordPress site.
5. A quarterly check of the link profile, for waves of spam that are not yours (negative links); Google says it ignores them, and disavowal is useful only if they are numerous and obvious.
6. Following the Google status page and measuring at every update, so that you know from the first week whether it has hit you.

Three cases from after 25 March

A services site, a 60% drop overnight: the link profile contained 300 domains from a network of "niche blogs" run by the same former agency, with identical commercial anchors; removing the links the agency still controlled, domain-level disavowal of the network and ten months of real links brought recovery to 70% of the previous level, in six months. A blog with 900 articles generated in 2025 without review, an 80% drop: consolidation into 120 articles rewritten with original data, the rest redirected or removed; at four months, traffic at 50% of the peak, but with double the conversion, because the remaining articles were commercial. A brochure site, a 30% drop, with no risky practice at all: compromised, with 2,000 pharmacy pages injected into a subfolder; cleanup and a review request, full recovery in three weeks. The right diagnosis decided, in each case, what got cleaned up.

What to check even if you were not hit

1. The links report in Search Console, monthly: new unknown domains, anchors in other languages, sudden waves.
2. The content published in the last year: who wrote it, with what review, with what value; what was done "for volume" gets consolidated now, before the next update.
3. The sections of the site you do not control editorially (partnerships, sponsored content, rented subdomains).
4. Signs of compromise, with file checksums and with a site: search for foreign pages.
5. Former agencies and collaborators: what methods they used; ask for the inventory of the links they built.

What the speed of the update means

A 19-hour spam update means that Google can apply a new model to the whole index almost instantly; the next ones will probably be just as fast and more frequent. For sites, the consequence is that the window between a risky practice and its effect shrinks, and "we've done this for years without problems" is no longer an argument. The context of the 2026 updates and the adaptation plan are in the article on Google algorithm updates in 2026, and diagnosing a site suspected of old practices (inherited from former agencies) is part of the SEO audit.

Frequently asked questions

1. I dropped on 25 March, but I have never done spam. What do I do? Check for compromise and for links that arrived without your knowledge (old agencies, sites that copy you); if you find nothing, the drop may have another cause (season, competition, a change on the site).
2. Should I submit a reconsideration request? There is none for algorithmic updates; only for manual actions.
3. How long does recovery take? Weeks to months after cleanup; usually partial.
4. Can nofollow and sponsored links affect me? No; they are marked correctly and are not treated as manipulation.

Sources

• Google Search Central, spam policies: the practices targeted by the spam systems.
• Google Search Central, ranking updates log: the announcement and dates of the March 2026 update.

Source references

• Google Search Central, politicile privind spamul în Căutare
• Google Search Central, jurnalul actualizărilor de clasare