One of the most frustrating calls I get starts like this: “I searched for my business and Google is showing pages in Japanese.” Sometimes it’s Japanese text about luxury handbags. Sometimes it’s pharmacy keywords, replica watches or casino links. The site looks perfectly normal when the owner visits it, so they assume Google has made a mistake.
It isn’t a mistake. It’s a type of attack known broadly as SEO spam, and the Japanese keyword hack is one of its most common forms. Attackers use your site’s reputation in search engines to rank their own pages, often thousands of them, while hiding the spam from you.
Cleaning it up properly takes care, because these infections are designed to survive partial cleanups. Here’s how they work and how I remove them.
How SEO spam hacks work
The goal is simple: borrow your domain’s authority. A site that Google already trusts can rank new pages quickly. Attackers break in, usually through a vulnerable plugin or weak password, and plant code that generates spam pages.
These pages typically:
- Use auto-generated content in Japanese, or English pharmaceutical and product terms.
- Link to stores selling counterfeit goods or to other spam sites.
- Are listed in fake sitemaps submitted to Google.
- Are cloaked, meaning search engines see the spam but regular visitors don’t.
The cloaking is what makes these hacks so effective. The malware checks who’s visiting. If it’s Googlebot, it serves spam. If it’s a normal visitor, especially a logged-in admin, it serves the real site. Some versions only redirect visitors who arrive from search results, so customers clicking from Google end up on a spam store while you see nothing wrong.
Step 1: Confirm and measure the problem
Search Google
Search for site:yourdomain.com and look through the results. Then try:
Note the URL patterns of spam pages. They often share a format, like random folder names, numeric IDs or a particular file extension such as .html on a WordPress site that normally doesn’t use it.
Use Search Console
- The Security Issues report may list hacked content.
- The Performance report may show impressions for spam keywords you’ve never targeted.
- The Sitemaps report may show sitemaps you didn’t submit.
- Users and permissions may reveal an owner you didn’t add. Attackers often verify themselves so they can submit sitemaps and push spam pages into Google faster.
Remove unknown owners immediately and delete any verification file or meta tag they used.
Test for cloaking
Use the URL Inspection tool on one of the spam URLs and view the crawled page. If Google sees spam where you see a 404 or your normal site, you’ve confirmed cloaking.
Step 2: Back up and lock down
Before changing anything:
- Take a full backup of the current files and database. It’s infected, but it’s evidence.
- Change your hosting, SFTP and database passwords from a clean device.
- Reset passwords for all WordPress administrators and remove any account you don’t recognise.
Step 3: Find the spam generator
SEO spam can be generated in several ways, and many infections use more than one. Check each of these.
.htaccess rewrites
Attackers often add rules that send certain requests to a spam script, or redirect search engine visitors. Check every .htaccess file, including those in subfolders:
A clean WordPress .htaccess usually contains only the standard WordPress rewrite block plus any rules you or your plugins added deliberately. Look for rules mentioning user agents like Googlebot, referrers like google, or unfamiliar PHP files.
Modified core files
The index.php file in the site root is a favourite target. A clean one is only a few lines long and loads wp-blog-header.php. If yours contains extra code, especially obfuscated code, it’s been tampered with.
This lists any core files that don’t match the official version.
Backdoor files
Look for PHP files that don’t belong: in uploads, in the site root with random names, or inside plugin folders where they don’t match the original plugin.
Spam generators are sometimes large files that build pages on the fly from templates and keyword lists. Others are tiny loaders that fetch content from a remote server.
Database content
Some infections store spam directly in the database as posts, or inject them into the options table. Check for unusual post types, unexpected large numbers of posts or posts by unknown authors:
Fake sitemaps
Look for sitemap files in the site root that you didn’t create, often with names like sitemap1.xml or random strings. Delete them and remove them from Search Console.
Scheduled tasks
Check WordPress cron and the server’s crontab for tasks that recreate files:
A recurring task that downloads a file from a remote URL is a strong indicator of a reinfection mechanism.
Step 4: Clean everything
Once you’ve identified the components:
- Replace WordPress core with a fresh download, keeping wp-config.php and wp-content. Review wp-config.php manually for injected code.
- Delete and reinstall all plugins and themes from official sources. Remove unused ones permanently.
- Remove all backdoor files and PHP files in uploads.
- Restore clean .htaccess files.
- Delete spam posts, rogue users and malicious options from the database.
- Remove malicious cron jobs.
- Regenerate security keys and salts in wp-config.php.
After cleaning, test again with URL Inspection and with a Googlebot user agent to confirm the spam is gone.
Step 5: Find and fix the entry point
Check access logs around the date the first spam file was created. Look for POST requests to plugin files, login attempts or uploads that came just before the infection. Common causes for this type of hack are outdated plugins with file upload or privilege escalation vulnerabilities, compromised admin passwords and nulled themes or plugins.
Update or replace the vulnerable component. If you can’t identify the entry point, assume credentials may have been exposed and tighten security across the board: two-factor authentication, server-level PHP blocking in uploads and a firewall.
Step 6: Remove spam from Google
Cleaning the site doesn’t instantly remove spam from search results. Google needs to recrawl the URLs and see that they’re gone.
Return the right status codes
Spam URLs should return 404 or, better, 410 Gone. If the spam used a recognisable pattern, you can serve 410 for that pattern at the server level. Make sure the pattern doesn’t match legitimate URLs.
Avoid redirecting spam URLs to your homepage. That can look like a soft 404 and keeps the URLs hanging around longer.
Submit a clean sitemap
Make sure your sitemap only includes legitimate pages and resubmit it. Delete any spam sitemaps from Search Console.
Request review if flagged
If the Security Issues report showed hacked content, mark the issue as fixed and request a review, describing what you found and how you fixed it.
Use the Removals tool sparingly
For highly visible spam URLs, the Removals tool can hide them temporarily while Google recrawls. It doesn’t permanently remove pages, so it’s a supplement, not a fix.
How long recovery takes
For sites with a few hundred spam pages, results often clean up within a few weeks. For sites with tens of thousands, it can take a couple of months for all spam URLs to drop out of the index. Keep monitoring the site: search results and the Pages report in Search Console to make sure the numbers keep falling and no new spam appears.
Signs the cleanup missed something
- New spam URLs appearing in Search Console after cleanup.
- Files reappearing after you delete them.
- Unknown users or Search Console owners returning.
- .htaccess changes coming back.
If any of these happen, there’s still a backdoor or an open entry point. Go back to the investigation step rather than just deleting the new files.
Frequently asked questions
Why can’t I see the spam when I visit my site?
Because the malware uses cloaking. It shows spam to search engines and sometimes to search visitors, but shows the normal site to direct visitors and logged-in administrators.
Will my rankings recover after cleaning?
Usually, yes. Once the spam is removed and Google recrawls the site, legitimate rankings tend to return. The longer the hack was active, the longer recovery may take.
Can I just restore a backup?
Only if you’re certain the backup predates the infection, and you also fix the entry point. Otherwise the site will simply be reinfected. Spam hacks often go unnoticed for weeks, so many backups are already infected.
Do I need to disavow spam links?
Generally no. The issue with this hack is spam on your site, not links pointing to it. Focus on cleaning the site and removing spam URLs from the index.
Final thoughts
The Japanese keyword hack and similar SEO spam infections are designed to stay hidden and to survive quick fixes. Clean them methodically: confirm the scope, find every component, replace rather than repair files, remove spam content, close the entry point and help Google recrawl the site. It takes patience, but done properly, the spam disappears and your real content takes its place in search results again.
