If you are searching for your site on Google and seeing pages with Japanese titles you never created, your site has the Japanese keyword hack. It is alarming, but it is a well known, fixable attack. Your site is being used to host auto generated Japanese spam, and with a methodical cleanup you can remove it and recover. This guide explains what the hack is, how to confirm it, the full WordPress fix walkthrough, how to close the door, and the Google cleanup.
What the Japanese keyword hack is
The Japanese keyword hack is an attack where intruders inject thousands of auto generated pages full of Japanese text into your site, usually advertising counterfeit goods. These pages are created automatically and indexed by Google under your trusted domain, which is exactly what the attackers want.
The hack typically uses cloaking, meaning it shows the Japanese spam to search engines and to certain visitors, while often looking normal to you when you browse your own site logged in. This is why you may first discover it through Google search results rather than by seeing anything wrong on your site directly. Attackers use Japanese because there are profitable spam markets in that language, and they exploit your domain’s existing search trust to rank their spam quickly.
Understanding that this is an automated, profit driven attack, not something personal, helps you approach the cleanup calmly and systematically. It also explains why acting quickly matters: the longer the spam stays indexed, the more it damages your domain’s trust with Google, so a fast, thorough cleanup limits both the ranking harm and the time your reputation is exposed.
How to confirm it
Before cleaning, confirm the hack so you know what you are dealing with. Google documents this attack itself, and the steps below follow its official guidance.
The clearest check is a site search. Type site:yourdomain.com into Google, replacing the domain with your own, and page through the results looking for Japanese language titles or URLs you never created. Seeing them confirms it.
Then open the Security Issues report in Search Console, which is where Google tells you directly that it has found hacked content on your site.
There is one check people miss, and it is the reason some owners conclude they are fine when they are not. Because this hack cloaks, a spam URL can return a normal 404 when you visit it in your browser while still serving spam to Googlebot. Run the suspicious URL through the URL Inspection tool in Search Console and look at what Google actually sees. That is the view that matters, not yours.
Next, check Google Search Console. The Performance report may show a strange spike in impressions or clicks for Japanese queries, and the coverage or pages report may list many unfamiliar URLs. Look for a fake sitemap, since this hack often adds its own sitemap file to get its spam pages indexed faster, so check for sitemap files you did not create.
Finally, check the users in Search Console, because attackers frequently add themselves as verified owners to control your Google presence, so remove any account you do not recognize. Together, these checks confirm the hack and reveal its scope before you start cleaning.
What the spam actually looks like
A guide to this hack that never shows you the spam is asking you to identify something you have never seen. Here is what turns up.
The words repeat, because the pages sell the same things. The overwhelming majority of this spam advertises counterfeit luxury goods, so a small vocabulary appears again and again.
Terms you will commonly see in the titles include 財布 (wallet), ブランド (brand), 激安 (very cheap), 通販 (mail order) and コピー (copy, as in replica).
You do not need to read Japanese. You need to recognise that your site is suddenly ranking for wallets and handbags.
The URLs are as distinctive as the text. The pages sit in directories with meaningless names, something like yoursite.com/kjhsdf/asdkj.html, generated in bulk rather than written.
Hundreds or thousands of them can exist, which is why the first symptom people notice is usually an impossible jump in indexed pages rather than the content itself.
Searching your own domain is the fastest confirmation. Run a site: search for your domain and page through the results.
If Japanese titles appear against your domain, you have it. This works even when the pages look invisible from your own browser, because it is showing you Google’s copy rather than yours.
And that gap is the whole trick. The pages are usually served only to search engine crawlers, so your site looks completely normal to you while Google sees a shop selling handbags.
This is why owners so often discover it from a customer, a Search Console message, or a collapse in traffic rather than by looking at their own website.
The fix walkthrough for WordPress
Take a backup of the hacked state first, then work in this order. The sequence matters, and it is Google’s own: locking the attacker out comes before cleaning files, or they simply undo your work.
1. Remove unauthorised Search Console owners, and their tokens. This is the step almost every guide gets half right. Removing a rogue verified owner is not enough on its own, because attackers leave behind the verification token that let them verify in the first place, either an HTML verification file in your root or a rewrite added to .htaccess. Delete the owner and hunt down the token, otherwise they simply verify again and keep watching your Search Console.
2. Replace .htaccess with a clean default. This hack routinely writes redirect and cloaking rules here, along with those verification rewrites. Do not try to edit around the bad lines; restore WordPress’s default .htaccess and re-add only rules you recognise as yours.
3. Reinstall rather than repair. Google’s advice is to reinstall core files, themes and plugins from clean sources rather than attempting to spot every edit by eye. It is faster and far more reliable than comparing files manually.
4. Find the files that do not belong. Sort by modification date and look for recently changed PHP files, odd filenames, and PHP where PHP should not be, particularly inside wp-content/uploads. Then search your files for the obfuscation patterns Google names specifically: base64_decode, eval and gzinflate. On a server with shell access, this finds most of them:
grep -rEl "base64_decode|eval\(|gzinflate" /path/to/public_html --include=*.php
Read anything that turns up before deleting it, since legitimate code occasionally uses these functions. Combined with the modification dates, the injected files usually stand out immediately.
5. Delete the fake sitemap. The hack adds its own sitemap so Google indexes the spam faster. Check for sitemap files in your root that you did not create, and remove them.
6. Remove rogue WordPress admin users and reset every remaining account.
7. Clean the database. The spam can live in wp_posts and in wp_options as injected settings. Inspect before deleting, and get help if you are unsure, since a bad delete here is harder to undo than a bad file delete.
8. Verify with the URL Inspection tool that the hacked URLs now return Not Found to Google, not just to you. Given the cloaking, this is the only check that actually proves the cleanup worked.
Closing the door
Cleaning is pointless if the attacker walks back in, so close the entry point this hack typically uses. The Japanese keyword hack usually gets in through outdated plugins, themes, or WordPress core with known vulnerabilities, weak or stolen admin passwords, or compromised hosting credentials.
Update everything to the latest secure versions immediately, since an unpatched vulnerability is the most common entry. Replace all passwords, hosting, admin, database, and FTP, with strong unique ones, and add two factor authentication to your admin login.
One step Google includes that most cleanup guides leave out: scan your own computer for malware. If your credentials were stolen from an infected machine rather than guessed, you can clean the server perfectly and get reinfected the next time you log in. Check file permissions and remove any leftover backdoors or scheduled tasks the attacker created. This step is the most important of all, because reinfection is the usual reason cleanups fail, so do not consider the job done until the specific hole is genuinely closed. For lasting protection, follow our guide to WordPress security settings.
The Google cleanup
After the site is clean and secured, deal with the spam URLs Google has indexed. There are typically many, so you have two approaches. For urgent removal, you can use the removals tool in Search Console to hide the worst spam URLs quickly, which is useful when the spam is prominent in your results.
For the bulk, letting the deleted spam pages return a not found response and being patient works, as Google drops them from the index over time as it recrawls. If Google flagged your site with a security warning or manual action, request a review once the site is genuinely clean, documenting what you found and fixed. Resubmit your real sitemap so Google refocuses on your genuine content.
The combination of removing the worst URLs quickly and letting the rest drop naturally, plus a review request if flagged, restores your clean presence in search. For the full recovery process, see our guide on SEO recovery after a hack.
Recovery timeline expectations
Set realistic expectations for recovery. Removing the active infection is quick once you work through the steps, often within a day. Getting any Google warning lifted after a review usually takes a few days to a couple of weeks.
The spam URLs dropping fully from Google’s index can take several weeks as it recrawls, and your genuine rankings recovering their normal positions can take a few weeks to a couple of months as trust rebuilds. So the site can be clean fast, while the search results fully returning to normal takes patience. Keep the site secure and monitored throughout, since the biggest risk in this window is reinfection from a missed entry point.
With a thorough cleanup and a closed door, most sites recover well from the Japanese keyword hack, so treat it as a serious but solvable problem. The panic you feel on first seeing those Japanese pages is understandable, but this is a known attack with a known fix, and working through it methodically almost always restores your site. See our pillar on hacked websites and SEO for the wider context.
Frequently asked questions
Why is my site showing Japanese pages on Google?
Your site is showing Japanese pages on Google because of the Japanese keyword hack, an attack that injects auto generated Japanese spam pages into your site to sell counterfeit goods, using your domain’s search trust. The hack often cloaks the spam, showing it to search engines while looking normal to you. Seeing unexpected Japanese pages in a site search of your domain is the classic sign of this specific, fixable hack.
How did the Japanese hack get in?
The Japanese keyword hack usually gets in through an outdated plugin, theme, or WordPress core with a known vulnerability, or through weak or stolen admin, hosting, or FTP credentials. Loose file permissions can also allow it. Attackers use automated tools to find and exploit these weaknesses. This is why closing the entry point, by updating everything and replacing all credentials, is essential, since cleaning without fixing the hole leads to reinfection.
Do I need to remove every spam URL manually?
No, you do not need to remove every spam URL manually. Once you clean the site so the spam pages no longer exist and return a not found response, Google drops them from its index over time as it recrawls. You can use the removals tool to quickly hide the most prominent spam URLs, but the bulk can be left to drop naturally with patience, so manual removal of every single URL is unnecessary.
Will the removals tool fix it faster?
The removals tool in Search Console can hide spam URLs from search results faster, which helps for the most visible ones, but it is a temporary hiding rather than a permanent fix, and it does not clean your site. The real fix is removing the malicious files and content and closing the entry point. Use the removals tool to speed up hiding the worst URLs, but rely on genuine cleanup for the lasting solution.
Can it come back?
Yes, the Japanese keyword hack can come back if you clean the spam but do not close the entry point the attacker used, since reinfection is the most common reason cleanups fail. To prevent it returning, update all software, replace every credential with strong unique ones, add two factor authentication, remove any backdoors, and monitor the site closely for at least a few weeks after cleanup so any return is caught immediately.
Why do the spam pages show 404 when I visit them?
Because the hack cloaks. It serves a normal looking 404 to ordinary browsers while still serving Japanese spam to Googlebot, which is why owners often conclude the problem is gone when it is not. Use the URL Inspection tool in Search Console to see what Google actually receives, and treat that as the real answer.
How do I find the injected files?
Sort by modification date first and look for recently changed PHP files, unusual filenames, and PHP inside wp-content/uploads where none should exist. Then search for the obfuscation functions Google names: base64_decode, eval and gzinflate. With shell access, grep -rEl “base64_decode|eval\(|gzinflate” across your web root with –include=*.php finds most of them. Read each result before deleting, since some legitimate code uses these functions.
I removed the hacker from Search Console but they came back. Why?
Because the verification token is still there. Attackers leave an HTML verification file in your root or a rewrite rule in .htaccess, and deleting the owner alone lets them re-verify immediately. Remove the owner and delete the token, then replace .htaccess with a clean default to be sure nothing is left behind.
What do Japanese keyword hack pages look like?
They advertise counterfeit luxury goods, so a small vocabulary repeats across the titles, including terms meaning wallet, brand, very cheap, mail order and copy. The URLs are equally distinctive, sitting in directories with meaningless generated names such as yoursite.com/kjhsdf/asdkj.html, often numbering in the hundreds or thousands. You do not need to read Japanese, you need to notice that your site is suddenly ranking for wallets and handbags. Run a site: search on your own domain to confirm, since that shows Google copy rather than yours.