Japanese Keyword Hack: How to Spot It and Clean It Up

You search site:yoursite.com in Google and find hundreds of pages in Japanese selling branded trainers and watches. Meanwhile the site opens normally: same homepage, same sections, nothing suspicious. That is what the japanese keyword hack, also called japanese SEO spam, looks like.

It is one of the most common WordPress compromises, and Google documents it separately in its guidance for owners of hacked sites. Here is how it works, why the owner is the last to find out, and what to do about it.

What the attacker actually does

Once inside, the attacker does not deface your homepage. They want something else entirely: your domain, with its history and its standing in Google, should start selling counterfeits.

So they do three things:

• Generate thousands of pages in Japanese inside randomly named folders on your site. The text is machine-written and the products are counterfeit clothing, shoes and watches.
• Create their own sitemap and feed it to Google so those pages get indexed faster.
• Add themselves as a property owner in Search Console if they can reach your files. That way they see the moment you start noticing.

Why everything looks fine in your browser

The reason this hack survives for months is cloaking. The malicious code checks who is asking for the page.

If it is Googlebot, it serves the Japanese spam page. If it is an ordinary visitor, it serves normal content or redirects to the homepage. Sometimes it also checks the referrer: arriving from search gets you spam, typing the address directly gets you the real site.

The owner opens their site, sees everything working, and relaxes. Google, at the same moment, is looking at a completely different site.

Seven signs this is what happened

1. A site:yoursite.com search returns Japanese titles or URLs you never created.
2. A sudden jump in indexed pages in Search Console. It was 40, now it is 4,000.
3. An email from Google Search Console about a hacked site and spammy content.
4. A new property owner in Search Console that you did not add. Check Settings, then Users and permissions.
5. A sitemap in your site root that you did not create, often with a random filename.
6. New administrators in WordPress, or a user with an odd email address.
7. Rankings for your own keywords dropping and search traffic falling, although you changed nothing.

How to check it yourself in 15 minutes

1. Look through Google's eyes

The fastest check is the site:yoursite.com search. If Japanese titles appear, the question is settled.

The second check is more precise: in Search Console open URL Inspection, paste a suspicious address and run a live test. Google will show you what it sees, not what your browser sees. This is where cloaking becomes visible.

2. Check the users

In Search Console: Settings, Users and permissions. Any owner you did not add is someone else's access, and it has to go.

In WordPress: Users, filtered by the Administrator role. Remove anyone who should not be there.

3. Look for traces in the files

The usual hiding places:

• .php files inside wp-content/uploads, where they have no business being;
• appended rules in .htaccess;
• foreign code in wp-config.php, index.php or the active theme;
• a plugin you never installed, often with no settings page.

Markers in PHP: eval(, base64_decode(, gzinflate(, str_rot13(, long strings of meaningless characters. Legitimate plugins almost never write like that.

The order of the cleanup

Sequence matters. Get the steps out of order and you can clean the site and immediately reinfect it from your own backup.

1. Take a copy of the site exactly as it is. Yes, the infected one. You need it if something breaks during cleanup, and as evidence of how they got in.
2. Reinstall WordPress core at the same version over the existing files. That replaces tampered system files without touching your content.
3. Update or remove the vulnerable plugin or theme. This is usually the way in: an outdated plugin with a published vulnerability.
4. Clean the remaining code in the theme, uploads, .htaccess, wp-config and the database. In the database, spam often sits in the options table and inside posts.
5. Remove unknown users in WordPress and in Search Console.
6. Change every password: WordPress administrators, hosting panel, FTP and SFTP, database user. And update the security keys in wp-config.php, which logs out everyone currently holding a session.
7. Remove the spam pages properly. They should return 410, not 404 and not a redirect to the homepage. 410 tells Google the pages are gone for good, and they leave the index faster.
8. Delete the attacker's sitemap and submit your own again.
9. Request a review in Search Console under Security Issues, describing what you actually did rather than writing one sentence.

How long recovery takes

• Google's review after the request: usually a few days;
• spam pages dropping out of the index: a week to several weeks;
• your own rankings recovering: a month or longer.

The rule is simple: the earlier you catch it, the cheaper it is. A site that has been spamming for two days and one that has been spamming for six months are cleaned the same way, but the consequences differ.

What not to do

Just delete the pages you found. They will be regenerated, because the cause is the access, not the pages.

Roll back to an old backup and call it done. If the backup contains the same vulnerability, you will be hacked again the same way.

Install a security plugin on top of an active infection. It does not remove what is already inside.

How to avoid a second time

• update WordPress, plugins and themes instead of postponing it;
• remove anything you do not use: an inactive plugin is still vulnerable;
• never install themes or plugins from sites offering free premium versions - that is the most common way to receive a backdoor with your files;
• two-factor authentication for administrators;
• a dedicated database user without unnecessary privileges;
• regular backups stored somewhere other than the same server.