Core Update vs Spam Update vs Manual Action

A core update reassesses how all content is ranked and is not a penalty. A spam update algorithmically enforces Google’s spam policies against specific violations. A manual action is a human reviewer at Google penalising your site directly, and it is the only one of the three that appears as a notice in your Search Console. Getting this wrong is expensive: people file reconsideration requests for core updates (which does nothing), and disavow links after a core update (which also does nothing, and can cause harm).

The fastest way to tell them apart takes thirty seconds. Open Search Console, go to Security & Manual Actions. If there is no notice, you do not have a manual action. That eliminates the most feared possibility before you spend an afternoon speculating.

The difference at a glance

What is a core update?

A core update is Google adjusting the systems that judge relevance and quality across the entire index. Google uses consistent language each time: “a regular update designed to better surface relevant, satisfying content for searchers from all types of sites.” It used exactly that phrasing for both 2026 core updates.

Nothing is aimed at your domain. You can lose several positions without having changed anything, because Google’s assessment of what deserves to rank for that query moved and competitors were reassessed upward. Google’s own analogy is a best-films list refreshed a few years later: the films that slipped down did not get worse, but new films arrived and the criteria matured.

Recent rollouts ran 12 days (March 2026), 12 days (May 2026) and 18 days (December 2025). The full mechanics are covered in what a core update actually is, and every confirmed 2026 date sits in the 2026 update timeline.

What is a spam update?

A spam update is enforcement. Google’s spam policies are published and specific — cloaking, scraped content, doorway pages, link schemes, expired-domain abuse, scaled content abuse, site reputation abuse. A spam update pushes an updated version of the systems that detect those practices.

If a spam update hit you, something on your site matched a policy. That is a materially different conversation from a core update, because there is a concrete thing to remove.

Spam rollouts have become dramatically faster. The August 2025 spam update ran nearly four weeks. The March 2026 spam update started on 24 March and finished on 25 March — under 24 hours, the fastest on record. The June 2026 spam update ran 24 to 26 June, roughly two days. Google announced no new spam policies with either 2026 update, which indicates enforcement of existing rules rather than a change in what counts as spam.

One important nuance: recovery from algorithmic spam enforcement is not instant even after you fix the problem. The systems have to recrawl, reassess and re-run. Expect months, not days.

What is a manual action?

A manual action is a person at Google reviewing your site and applying a penalty. It is the rarest of the three and the only one you are told about directly.

The notice appears in Search Console under Security & Manual Actions, and it names the problem — unnatural links to your site, thin content with little added value, user-generated spam, cloaking, and so on. It also tells you whether the action is site-wide or affects only some URLs.

Because you are told what is wrong, the path is clearer than either algorithmic case: fix the specific issue, document what you did, and file a reconsideration request. A human reviews it. Full detail sits in how to tell if you actually have a Google penalty and manual action versus algorithmic suppression.

How do you tell which one hit you?

Work through this in order. Most self-diagnosed penalties turn out to be neither a penalty nor an update.

1. Check Search Console → Security & Manual Actions. A notice means manual action, and you can stop diagnosing. No notice means it is not a manual action.
2. Check the dates against Google’s Search Status Dashboard. Only Google confirms an update. Volatility trackers show that results moved, not that Google moved them — see confirmed versus unconfirmed updates.
3. Look at the shape of the drop. A core update usually shows a pattern: a content type, a template, a query cluster losing while others hold. Spam enforcement tends to be sharper and more localised to the offending pages or the whole site at once.
4. Ask honestly whether you match a spam policy. Bought links, AI-generated pages published at volume, doorway pages for locations you do not serve, a subfolder rented to a third party. If yes, you have your answer regardless of what the trackers say.
5. Rule out yourself. Deployments, migrations, robots.txt edits, a plugin change. This is the single most common cause of a drop blamed on Google. Was it an update or was it you walks the full sequence.

Why the distinction changes what you do

The wrong diagnosis leads to the wrong work, and some of that work is actively harmful.

If you treat a core update as a penalty, you go hunting for a violation that does not exist. People disavow perfectly good links, delete pages that dropped three positions, or rewrite content that was never the problem. Recovery from a core update comes from being substantially better by the time the next one runs — not from undoing an imagined infraction. The distinction matters more than it sounds.

If you treat a spam update as a core update, you write more content while the violating practice sits there continuing to trigger enforcement. No amount of quality work elsewhere offsets a link scheme you have not dismantled.

If you miss a manual action, you can spend months on content while a notice sits unread in Search Console. This happens more often than it should, because nobody checks a tab that is empty 99% of the time.

What to do in each case

Core update: wait for the rollout to finish before assessing anything. Then segment by page, query, device and country to find the pattern. Compare your losing pages honestly against the pages that gained and ask what theirs have that yours does not — usually specificity, first-hand experience, real numbers, or a named author. Then follow the 30-day recovery plan and expect the payoff at the next core update.

Spam update: read Google’s spam policies properly and audit against them honestly. Remove the practice. If it was links you bought, disavow is appropriate here — this is one of the few situations where it genuinely is.

Manual action: read the notice, fix exactly what it names, document the fix, file the reconsideration request. Do not file until the problem is genuinely resolved, because a rejected request costs you weeks.

The short version: core updates are a re-marking, spam updates are enforcement, manual actions are a person telling you what you did. Only one of the three sends you a message, and checking for it takes half a minute.

Frequently asked questions

What is the difference between a core update and a spam update?

A core update broadly reassesses how Google ranks all content and is not a penalty — nothing was flagged against your site. A spam update algorithmically enforces Google’s published spam policies against specific violating practices, so being hit means something on your site matched a policy. Spam updates also roll out much faster: the March 2026 spam update finished in under 24 hours, against 12 days for each 2026 core update.

How do I know if I have a Google manual action?

Open Google Search Console and go to Security & Manual Actions. If a manual action exists, a notice appears there naming the specific problem and whether it affects the whole site or particular URLs. If that section is empty, you do not have a manual action. This is the only one of the three mechanisms that Google notifies you about directly.

Should I file a reconsideration request after a core update?

No. Reconsideration requests apply only to manual actions, where a human reviewer has penalised your site and you have fixed the named problem. Core updates and algorithmic spam enforcement have no reconsideration process, because there is no human decision to appeal. Filing one after a core update accomplishes nothing.

Should I disavow links after a core update?

Generally no. Disavow is the right tool when you have a manual action for unnatural links, or you knowingly acquired links that violate Google’s link spam policies. After a core update there is no link violation to undo, and disavowing legitimate links can remove signals that were helping you. Google has repeatedly advised that most sites never need the disavow tool at all.

How long does recovery take from each type?

Core update recovery usually waits for the next core update, which in recent cadence means roughly two to six months. Algorithmic spam recovery requires removing the violating practice and then waiting for Google’s systems to recrawl and reassess — months rather than days. Manual action recovery is the most predictable: fix the named issue, file a reconsideration request, and a human reviews it, typically within a few weeks.

Sources

• Google core updates and your website — Search Central
• Google Search spam policies
• Manual Actions report — Search Console Help
• Google Search Status Dashboard