Google’s User-Generated Spam Update: What Builders Should Check

Google updated its guide to user-generated spam on 26 October 2026. The guide covers open comment forms and other places where visitors can publish content. Search Engine Land and Search Engine Roundtable both reported the change.

The update mainly targets platforms and tools. However, any builder with a WordPress site has open doors that spammers can try. So this guide explains what changed and what to check. First, a note. We are summarising press reports, so read Google’s own guide too.

What Google Changed

• Google added guidance on blocking indexing of link-shared content, and on monitoring abuse in Search Console.
• The scope now names tools that let users publish shared pages, generated content or web apps.
• Google says spammers may create large numbers of pages or sites that add little or no value.
• Google says it made the changes to keep user-created pages that are not meant for Search out of the index, and to detect spam earlier.

Search Engine Roundtable notes that some SEOs now expect action against AI tools and app builders. For a normal business website, the more useful part is the older advice in the guide.

What the Guide Still Recommends

A summary of the guide lists measures that suit any site with user input:

• Write a clear abuse policy.
• Give trusted users a way to report spam.
• Add a noindex on posts from new users with no reputation.
• Use nofollow or ugc link attributes on untrusted content.
• Require manual approval for suspicious activity.
• Use blocklists, and CAPTCHAs to stop automated sign-ups.

WordPress already helps with some of these. For example, WordPress announced in 2019 that it would mark blog comment links with rel=”ugc”. Still, you need to check your own settings.

Where Spam Can Reach a Builder’s Website

• Blog comments. Bots often post links to dodgy sites, so comments need checking.
• Contact and quote forms. Spam fills your inbox and hides real enquiries.
• User registration. Open sign-ups also let bots create accounts.
• Plugins and themes. Old code can let spammers inject pages.
• Directories and review widgets. Some accept links from anyone.

Spam also costs you trust and time. Real clients may give up on a site that shows odd content. So a quick check is worth the effort.

Check Your WordPress Settings

1. Go to Settings, then Discussion. Require manual approval, and hold comments that contain links.
2. Turn comments off on pages and on posts that do not need them.
3. Go to Settings, then General. Untick ‘Anyone can register’ unless you need it.
4. Set the default new user role to Subscriber.
5. Then delete user accounts you do not recognise.
6. Also add a CAPTCHA or spam filter to your contact form.
7. Install an anti-spam plugin, such as Akismet, if you keep comments on.

Also keep WordPress, plugins and PHP up to date. Our guide to PHP2Shell and WordPress explains a recent urgent patch.

Look for Spam in Google

1. Search Google for site:yourdomain.co.uk and scan the results.
2. Look for pages you did not create, or odd topics such as pills, casinos or loans.
3. Then open the Pages report in Search Console, and check for strange URLs.
4. Open the Manual actions report, and read any message.
5. Check your sitemap for pages you do not recognise.

Do this once a month. Spam found early is far easier to clean up.

If You Find Spam

1. First, remove the spam pages and comments.
2. Leave deleted pages as 404 errors, because Google says 404s are normal. Our guide to spammy backlinks and 404 errors explains why.
3. Change all admin passwords.
4. Update WordPress, plugins, themes and PHP.
5. Run a security scan, and look for hidden admin users.
6. If Search Console shows a manual action, fix the problem, then request a review.

For a fuller security checklist, read our guide to WordPress security in 2026.

What Not to Do

• Avoid leaving comments open on every post by default.
• Never approve comments just because they flatter your work.
• Skip bulk-deleting pages without a backup, because you may remove real content.
• Do not ignore a spike in odd traffic or odd search results.

How We Can Help

We can review your comment and form settings, scan your site for spam pages and clean up what we find. We can also set up monthly checks. See our construction website design service and our IT support service.

Book a free consultation at bilalwebstudio.co.uk or email [email protected].

Frequently Asked Questions

What did Google change in its user-generated spam guide?

Google added advice on blocking indexing of link-shared content and on monitoring abuse in Search Console. It also named tools that let users publish shared pages, generated content or web apps.

Does the update affect a normal builder website?

Mostly it targets platforms and tools. However, any site with comments, forms or sign-ups can attract spam, so the older advice still applies.

Should I turn off WordPress comments?

If you do not use them, yes. Turn them off, or require manual approval and hold comments with links.

How do I know if spammers have added pages to my site?

Search Google for site:yourdomain, check the Pages report in Search Console and review your sitemap for pages you did not create.

Further Reading

• WordPress Security 2026 for Construction Websites
• PHP2Shell: What WordPress Site Owners Must Do Now
• Google September 2026 Spam Update: What Builders Should Check
• Spammy Backlinks and 404 Errors: What Google Said This Week