Owners of blogs hosted on Google's Blogger platform began receiving removal notices on August 4, 2026, citing a malware policy, with dashboards displaying a countdown to permanent deletion within 89 days. Restorations started appearing the following day, in several documented cases without any appeal having been reviewed.

A wave of enforcement actions against blogs hosted on Google's Blogger service began on the evening of August 4, 2026, locking or removing sites that had operated continuously for more than a decade. Affected owners received notification emails referencing the "malware and similar malicious content policy," according to a post published to the r/blogspot subreddit by an account using the handle MMORPGDev, which characterised the action as coming from an automated system.

The public-facing consequence was immediate. Visitors to at least one affected address, iintechmy.blogspot.com, encountered a Google-served page reading "Blog has been removed" and stating that the address was not available for new blogs. The dashboard view presented to the owner told a different story: a red padlock graphic above the notice "this blog has been locked," attributing the action to a violation of Blogger's Community Guidelines and offering a Request Review button. That screen carried a deletion warning of 89 days.

Two notices, two stated reasons

The discrepancy between the two interfaces is more than cosmetic. Notification emails, according to accounts posted in the subreddit thread, named the malware and malicious content policy specifically. The dashboard notice named Community Guidelines generically. Neither surface offered the affected owner a description of what had been detected, on which URL, or at what time.

The 89-day figure introduces a second inconsistency. One forum participant, posting under the handle WebLovePL, described the review entitlement as a 90-day window. The dashboard screenshot circulated on August 5 showed 89 days remaining, consistent with a 90-day clock that had already started counting on the day of the lock. For an owner reading the notice for the first time, the difference between a review period and a deletion countdown is not academic.

Search Console and Safe Browsing showed nothing

The most consequential technical detail reported by affected owners is the absence of any corroborating security signal. A commenter using the handle Right_Process1707 wrote that two blogs were locked simultaneously under the malware classification and that both Search Console and Safe Browsing showed no issues. Another, posting as hanapim, reported auditing the affected blog and finding it clean.

That gap matters because Google's own malicious practices category, which covers malware distribution and unwanted software, normally surfaces through Search Console. When Google began sending Search Console warnings for back button hijacking in April 2026, the notices included sample URLs and links to the relevant policy documentation. Blogger's enforcement surface, by contrast, produced a padlock and a countdown.

The malicious practices category itself is the same bucket Google used when it classified back button hijacking as a spam violation on April 13, 2026, grouping navigation manipulation alongside malware distribution. Blogger blogs flagged in the August incident landed in that same conceptual territory without the diagnostic tooling that accompanies enforcement on the Search side.

Age of the affected sites

Several owners recorded the age of the properties involved. A commenter posting as eccentricyethappy described a 12-year-old site maintained without violation and reported waking after 4am Manila time to the notification email. Tipodeincognito reported an 18-year-old blog locked on the same day. AprTompkins wrote that an author site was hosted on the same platform. VolleyAddicted described a volleyball blog that had been functioning normally before the lock.

Two owners independently noted a pattern that narrows the plausible mechanism. Both eccentricyethappy and Tipodeincognito reported that inactive blogs in the same accounts were untouched, while active properties were locked. WebLovePL, who maintains a large number of blogs in a single dashboard as part of a theme and optimisation practice, reported that only one was affected: a hiking blog. A further observation, offered by eccentricyethappy without supporting data, was that blogs fronted by Cloudflare appeared to escape the action.

None of these patterns has been confirmed by Google. They are the observations of affected owners assembling a picture from the outside, which is precisely the position the enforcement design leaves them in.

Scale remains unquantified

No figure for the number of affected blogs has been published. The available proxies are indirect. A Blogger Community thread, numbered 457259506 and started by WebLovePL, functioned as the aggregation point; participants who clicked the "I have the same question" control appended themselves to a visible counter. A commenter using the handle cavansir reported being the 298th person on that thread. An Italian account posting as HTNovo referred on X to "thousands of blogs on Google's platform around the world," a characterisation the account did not source.

The thread's opening assessment, quoted into the subreddit by eccentricyethappy, framed the volume as diagnostic in itself: "Today's huge number of reports regarding blogs flagged/locked for the same reason -'Malware and Similar Malicious Content' - suggests misclassification by automated systems. False positives do occur from time to time, but not on this scale."

Glenn Gabe, an SEO and AI search consultant at G-Squared Interactive, brought the incident to a wider search-industry audience in a post published at 3:39 PM on August 5, 2026, which had drawn 1,606 views at the point of capture. "If these are false positives, this is terrible for the site owners," Gabe wrote, adding that "renting versus owning is a dangerous game" and closing with "Poof, gone. Hopefully Google rectifies the situation soon."

Restorations without appeals

By the afternoon of August 5, the thread had shifted register. A commenter posting as Large-Application-30 observed that the removal state was not final, writing that "even if it says 'Deleted,' it hasn't actually been deleted." EngBashar, who had earlier reported the loss of two blogs and "thousands of published posts," confirmed a restoration within the hour. Accounts posting as jolurove, AprTompkins and the original poster each reported blogs coming back online.

The most telling entry came from lacbeetle: "Yesterday was removal. Today is reinstatement. No appeal sent."

Restoration without an individual appeal points to a server-side correction rather than case-by-case human review. It also means that owners who submitted appeals and owners who did not were returned to service on the same footing, which raises a question about what function the Request Review button served during the window. Right_Process1707 reported submitting reviews and seeing no change; TheWrestleManiac reported twelve hours elapsed with two blogs still locked.

Restoration was not uniform. Different accounts reported recovery at different intervals, and no public confirmation exists that every locked property has been returned.

The export gap

The incident produced a secondary technical finding about data portability. Several participants recommended Google Takeout as an immediate mitigation, with instructions to select Blogger and generate an export archive. Results varied. A commenter using the handle rarvesen reported that the resulting archive contained images and site data but none of the actual posts. Significant_Tie_6317 identified the location of the post content inside the archive structure, at Takeout, then Blogger, then Blogs, then the blog name, in a file named feed.atom, and noted that the export appeared incomplete on a blog holding more than 2,000 articles.

That file is an Atom XML feed, importable into other publishing systems. Its presence means content recovery is technically possible; the reported incompleteness on large archives means recovery is not guaranteed to be total. AprTompkins wrote that Google itself had pointed to Takeout as the route to an export.

Why this matters to publishers and marketers

Blogger occupies an unusual position in the publishing stack. The platform, launched in 1999 and acquired by Google in 2003, remains free, permits custom domains without charge, and does not inject advertising into hosted blogs. PPC Land documented that history in February 2026 when the original Blogger server resurfaced in Evan Williams' garage, noting that Google's Threat Analysis Group removed 1,177 Blogger blogs in the second quarter of 2024 as part of a coordinated influence operation takedown. Removal at scale is not new to the platform. Removal at scale of apparently legitimate long-running sites is a different proposition.

The August incident lands on a publisher base already under measurable pressure. Search's share of news publisher traffic fell from 51% in 2023 to 27% by the fourth quarter of 2025. Independent sites recorded losses of up to 95% following the September 2023 Helpful Content Update, a period PPC Land covered when algorithm changes pushed independent publishers toward closure. More recently, an eight-year-old Berlin immigration guide lost 70% of its search traffic to AI Overviews, and publisher ad supply fell by up to 40% in the second quarter of 2026.

Against that backdrop, an unexplained hosting lock is not an isolated inconvenience. It compounds.

There is also a track record on automated enforcement accuracy that bears on the incident. In November 2025, Google said improved AI systems had cut incorrect advertiser account suspensions by more than 80% and reduced appeal resolution times by 70%, with 99% of appeals resolved inside 24 hours. In July 2026, the company ended appeals for policy decisions older than six months. Those figures describe the advertising side of the business rather than Blogger, but they establish the pattern: automated classification operating at volume, producing a false positive population, with appeals as the designated remedy.

Platform stability incidents have followed a similar shape. A two-day failure in January 2026 cut AdSense publisher eCPMs by 50% to 90% as Ad Exchange match rates declined. A Search Console indexing quota blocked a publisherattempting to update 1,192 technical audits after five manual requests. In each case, the affected party learned the mechanism from the outside.

Google response

PPC Land contacted Google on August 5, 2026, asking whether the removals resulted from an error in an automated classification system, how many blogs were affected and restored, whether any content was permanently lost, whether affected owners would be notified proactively of the reversal, what review step exists between an automated malware classification and blog removal, and whether the company intends to publish an acknowledgement. No response had been received at the time of publication.

Absent that, the record consists of what affected owners documented themselves: an email, a padlock, a countdown, and a restoration that arrived without explanation.

Timeline

Summary

Who: Owners of blogs hosted on Google's Blogger platform in multiple countries, documenting the incident through the r/blogspot subreddit and Blogger Community thread 457259506. Glenn Gabe, president of G-Squared Interactive, amplified the reports to the search industry on August 5, 2026.

What: A wave of blog locks and removals attributed by affected owners to an automated classification system, with notification emails citing the malware and similar malicious content policy. Dashboards displayed a lock notice referencing Community Guidelines and a permanent deletion warning set at 89 days. Affected sites included properties operating for 12 and 18 years, several showing no findings in Search Console or Safe Browsing. Restorations began roughly a day later, in documented cases without an appeal having been reviewed.

When: Removals began on the evening of August 4, 2026. Restoration reports appeared through August 5, 2026.

Where: Globally across the blogspot.com domain and custom domains fronted by Blogger, with affected owners reporting from Europe, Asia and the Americas. Documentation is concentrated in the r/blogspot subreddit and the Blogger Community forum.

Why: No cause has been confirmed by Google. The community assessment points to misclassification by automated malware detection, based on the volume of simultaneous reports, the absence of corroborating security signals, and the pattern of restorations occurring without individual appeal review. PPC Land put six questions to Google on August 5, 2026, and had received no response at publication.