Japanese pages showing up for your site in Google? How to remove the Japanese keyword hack

You search for your business, or run a quick site: search on your domain, and below your homepage you find page after page of Japanese titles you never wrote, often advertising cheap brand-name bags, watches or shoes. Your customers can see them too. Google spends its time crawling spam instead of your products and services, your real pages can slip in the rankings, and a “This site may be hacked” label may appear under your listing.

This is the Japanese keyword hack, and it is one of the more stubborn WordPress infections, because the spam is often invisible from inside your own site. This guide explains how it works, how to find the code that produces the pages, and how to clear the spam out of Google once the site is clean.

How the Japanese keyword hack works

Someone gets into the site, usually through an outdated plugin or theme, a pirated (“nulled”) theme or plugin, or a stolen password. They then add code that creates pages full of Japanese text and links, typically pointing to shops selling counterfeit or heavily discounted branded goods. A few things make this hack hard to spot:

The pages are often not real WordPress pages. A single PHP file, together with a rewrite rule, can generate thousands of URLs on the fly. Nothing new appears under Pages or Posts in your dashboard.
The URLs look random. Spam often sits in folders or files with meaningless names, or as odd query strings on your homepage.
The spam may only be shown to Google. This is called cloaking. When you open a spam URL, you see a 404 or your normal homepage; when Googlebot opens it, it gets the Japanese page.
The attacker may take over your Search Console. By verifying themselves as an owner, they can submit sitemaps that list the spam pages so Google finds them faster.

Step 1: Confirm it and collect the spam URLs

Start by building a list of example spam URLs. You will need them to find the code and later to test that it is gone.

Search Google for site:yourdomain.com and note every result with a Japanese title, along with the pattern in its URL.
In Google Search Console, open the Performance report and look at the queries. Japanese search terms bringing impressions to an English-language site are a strong sign.
Check the Pages report for a sudden jump in indexed or discovered pages.
Paste a spam URL into URL Inspection, run Test live URL and view the tested page. If Googlebot gets Japanese content while your browser gets a 404, the site is cloaking.

Step 2: Lock down Search Console

Go to Settings → Users and permissions and look at every owner and user. Remove anyone you do not know. Then remove their verification method too, or they can verify again: usually an HTML file in your site’s root folder with a name like google1234abcd.html, a meta tag in your theme, or a DNS record.

Next, open Sitemaps and remove any sitemap you did not submit. Note its file name: the sitemap file itself is usually sitting on your server, and you will delete it during the cleanup.

Step 3: Back up, then find the code that makes the pages

Download a full copy of the files and export the database first, and label it as infected. Then look in these places, using the URL patterns from step 1 as clues.

The .htaccess file. Look for rules that send unknown URLs to a PHP file other than WordPress’s own index.php, and for conditions that check HTTP_USER_AGENT for Googlebot or other search engines. Those are how the spam pages get served and how they are hidden from you.

The root folder. Compare it with a fresh WordPress download. Unfamiliar PHP files, folders with random names, folders full of .html files and sitemap XML files you did not create are all suspects. Open index.php as well. Apart from comments, the real one contains only this:

<?php
define( 'WP_USE_THEMES', true );
require __DIR__ . '/wp-blog-header.php';

wp-content. Check the active theme’s functions.php, the plugins folder for anything you did not install, wp-content/mu-plugins for files you do not recognise, and wp-content/uploads for any .php file at all.

The database. Sometimes the spam is stored as real posts. In phpMyAdmin, list the newest entries and look for titles you did not write (your table prefix may not be wp_):

SELECT ID, post_title, post_type, post_status, post_date
FROM wp_posts
ORDER BY post_date DESC
LIMIT 100;

Finding the generator is the hardest part of this cleanup. It is often a single file with an innocent name, its code scrambled so that it does not look like anything, and there is usually a second backdoor next to it in case the first one is found. If you have looked and cannot find it, or you are not sure you found everything, we can find and remove it for you.

Step 4: Remove it and close the way in

Delete the generator files, the spam folders and the fake sitemaps, and restore a clean .htaccess. Then make sure nothing can put them back:

Reinstall WordPress core (Dashboard → Updates → Re-install) and, with WP-CLI, run wp core verify-checksums and wp plugin verify-checksums --all to spot modified files.
Replace every plugin and theme with a fresh copy from WordPress.org or the vendor, and delete any you do not use.
Delete administrator accounts you do not recognise.
Update everything, and remove pirated themes and plugins completely.
Change all passwords (WordPress, hosting panel, SFTP, database) and replace the secret keys in wp-config.php.

Our guide to finding and removing a WordPress redirect hack goes through these hiding places and steps in more detail.

Now test your list of spam URLs. Each one should return 404 or 410, including when the request claims to come from Google:

curl -s -o /dev/null -w "%{http_code}n" -A "Mozilla/5.0 (compatible; Googlebot/2.1)" https://yourdomain.com/spam-url/

Some hacks check Google’s IP addresses rather than the user agent, so curl alone cannot prove the site is clean. Repeat the live test in URL Inspection on a few samples. That is the version Google sees.

Step 5: Clear the spam out of Google

A clean site does not remove the spam from search results straight away. Google drops each URL when it recrawls it and finds it gone, which for thousands of URLs can take weeks or longer. You can help:

Return 404 or 410, never a redirect to your homepage. Google usually treats such redirects as soft 404s, and they slow the cleanup down.
Do not block the spam URLs in robots.txt. Googlebot then cannot recrawl them to see they are gone, and they can stay in the results.
If all the spam sits in one folder that nothing real uses, you can return 410 for that whole folder on Apache or LiteSpeed hosting by adding a line like RewriteRule ^spam-folder/ - [G] after RewriteEngine On and before the WordPress rules in .htaccess. Keep a copy of the file first; one wrong rule can take the site down.
Use the Removals tool for speed. In Search Console, Removals can hide every URL with a given prefix from Google results for about six months while Google recrawls. It hides them, it does not delete them, so the 404s still matter.
Resubmit your real sitemap so Google spends its crawling on the pages you want found.

If the Security issues report in Search Console lists a hacked site issue, you also need to request a review before Google removes any warning from your listing. Our guide to removing the “This site may be hacked” warning explains how to write a review request that gets accepted.

Quick checklist

List of example spam URLs collected from Google and Search Console
Cloaking checked with the URL Inspection live test
Unknown Search Console owners, their verification and fake sitemaps removed
Full backup taken before cleanup
Generator files, spam folders and rewrite rules removed
Core, plugins and themes replaced with clean copies
Unknown administrators deleted, passwords and secret keys changed
Spam URLs return 404 or 410, also for Googlebot, and are not blocked in robots.txt
Real sitemap resubmitted, review requested if Security issues lists one

Every spam page that leaves Google’s index gives your real pages back a little more of the attention they were built for.