If you are searching for your site on Google and seeing pages with Japanese titles you never created, your site has the Japanese keyword hack. It is alarming, but it is a well known, fixable attack. Your site is being used to host auto generated Japanese spam, and with a methodical cleanup you can remove it and recover. This guide explains what the hack is, how to confirm it, the full WordPress fix walkthrough, how to close the door, and the Google cleanup.
What the Japanese keyword hack is
The Japanese keyword hack is an attack where intruders inject thousands of auto generated pages full of Japanese text into your site, usually advertising counterfeit goods. These pages are created automatically and indexed by Google under your trusted domain, which is exactly what the attackers want.
The hack typically uses cloaking, meaning it shows the Japanese spam to search engines and to certain visitors, while often looking normal to you when you browse your own site logged in. This is why you may first discover it through Google search results rather than by seeing anything wrong on your site directly. Attackers use Japanese because there are profitable spam markets in that language, and they exploit your domain’s existing search trust to rank their spam quickly.
Understanding that this is an automated, profit driven attack, not something personal, helps you approach the cleanup calmly and systematically. It also explains why acting quickly matters: the longer the spam stays indexed, the more it damages your domain’s trust with Google, so a fast, thorough cleanup limits both the ranking harm and the time your reputation is exposed.
How to confirm it
Before cleaning, confirm the hack so you know what you are dealing with. The clearest check is a site search: search your domain in Google using the site operator and look through the results for Japanese language pages or spammy URLs you never created. Seeing them confirms the hack.
Next, check Google Search Console. The Performance report may show a strange spike in impressions or clicks for Japanese queries, and the coverage or pages report may list many unfamiliar URLs. Look for a fake sitemap, since this hack often adds its own sitemap file to get its spam pages indexed faster, so check for sitemap files you did not create.
Finally, check the users in Search Console, because attackers frequently add themselves as verified owners to control your Google presence, so remove any account you do not recognize. Together, these checks confirm the hack and reveal its scope before you start cleaning.
The fix walkthrough for WordPress
Here is the step by step cleanup for a WordPress site. Take a backup of the hacked state first for safety, then work through each step. Screenshot placeholders would show each stage.
First, clean the file locations this hack uses. It often adds malicious PHP files in your core, theme, uploads, or root directories, so compare your files against clean originals and remove anything injected, paying attention to recently modified files and odd file names. Second, inspect your htaccess file, since this hack frequently adds rules there to enable cloaking and redirects, so restore it to a clean default.
Third, remove the fake sitemap the hack created so it stops feeding spam URLs to Google. Fourth, remove rogue admin users from WordPress and any unrecognized verified owners from Search Console, cutting off the attacker’s access. Fifth, clean the database, since the hack can inject spam content and options into your database tables, so inspect and remove anything malicious, ideally with guidance if you are unsure. Work carefully through each location, since leaving any part behind lets the spam or the attacker return. Once every step is done and verified, the active infection is removed.
Closing the door
Cleaning is pointless if the attacker walks back in, so close the entry point this hack typically uses. The Japanese keyword hack usually gets in through outdated plugins, themes, or WordPress core with known vulnerabilities, weak or stolen admin passwords, or compromised hosting credentials.
Update everything to the latest secure versions immediately, since an unpatched vulnerability is the most common entry. Replace all passwords, hosting, admin, database, and FTP, with strong unique ones, and add two factor authentication to your admin login. Check file permissions and remove any leftover backdoors or scheduled tasks the attacker created. This step is the most important of all, because reinfection is the usual reason cleanups fail, so do not consider the job done until the specific hole is genuinely closed. For lasting protection, follow our guide to WordPress security settings.
The Google cleanup
After the site is clean and secured, deal with the spam URLs Google has indexed. There are typically many, so you have two approaches. For urgent removal, you can use the removals tool in Search Console to hide the worst spam URLs quickly, which is useful when the spam is prominent in your results.
For the bulk, letting the deleted spam pages return a not found response and being patient works, as Google drops them from the index over time as it recrawls. If Google flagged your site with a security warning or manual action, request a review once the site is genuinely clean, documenting what you found and fixed. Resubmit your real sitemap so Google refocuses on your genuine content.
The combination of removing the worst URLs quickly and letting the rest drop naturally, plus a review request if flagged, restores your clean presence in search. For the full recovery process, see our guide on SEO recovery after a hack.
Recovery timeline expectations
Set realistic expectations for recovery. Removing the active infection is quick once you work through the steps, often within a day. Getting any Google warning lifted after a review usually takes a few days to a couple of weeks.
The spam URLs dropping fully from Google’s index can take several weeks as it recrawls, and your genuine rankings recovering their normal positions can take a few weeks to a couple of months as trust rebuilds. So the site can be clean fast, while the search results fully returning to normal takes patience. Keep the site secure and monitored throughout, since the biggest risk in this window is reinfection from a missed entry point.
With a thorough cleanup and a closed door, most sites recover well from the Japanese keyword hack, so treat it as a serious but solvable problem. The panic you feel on first seeing those Japanese pages is understandable, but this is a known attack with a known fix, and working through it methodically almost always restores your site. See our pillar on hacked websites and SEO for the wider context.
Frequently asked questions
Why is my site showing Japanese pages on Google?
Your site is showing Japanese pages on Google because of the Japanese keyword hack, an attack that injects auto generated Japanese spam pages into your site to sell counterfeit goods, using your domain’s search trust. The hack often cloaks the spam, showing it to search engines while looking normal to you. Seeing unexpected Japanese pages in a site search of your domain is the classic sign of this specific, fixable hack.
How did the Japanese hack get in?
The Japanese keyword hack usually gets in through an outdated plugin, theme, or WordPress core with a known vulnerability, or through weak or stolen admin, hosting, or FTP credentials. Loose file permissions can also allow it. Attackers use automated tools to find and exploit these weaknesses. This is why closing the entry point, by updating everything and replacing all credentials, is essential, since cleaning without fixing the hole leads to reinfection.
Do I need to remove every spam URL manually?
No, you do not need to remove every spam URL manually. Once you clean the site so the spam pages no longer exist and return a not found response, Google drops them from its index over time as it recrawls. You can use the removals tool to quickly hide the most prominent spam URLs, but the bulk can be left to drop naturally with patience, so manual removal of every single URL is unnecessary.
Will the removals tool fix it faster?
The removals tool in Search Console can hide spam URLs from search results faster, which helps for the most visible ones, but it is a temporary hiding rather than a permanent fix, and it does not clean your site. The real fix is removing the malicious files and content and closing the entry point. Use the removals tool to speed up hiding the worst URLs, but rely on genuine cleanup for the lasting solution.
Can it come back?
Yes, the Japanese keyword hack can come back if you clean the spam but do not close the entry point the attacker used, since reinfection is the most common reason cleanups fail. To prevent it returning, update all software, replace every credential with strong unique ones, add two factor authentication, remove any backdoors, and monitor the site closely for at least a few weeks after cleanup so any return is caught immediately.