Japanese Keyword Hack: Diagnosis and Cleanup

What is happening?

The attacker injects thousands of pages on your domain, usually selling counterfeit goods in Japanese, riding on Google's trust in your site and its rankings. These pages are shown to search engines and to visitors arriving from them, but hidden when you open the site directly or while logged in.

That's why most owners discover it through a strange search result or a Search Console alert, not on the site itself.

"Japanese" is a symptom, not a rule; the same pattern is used for casino, pharma and loan spam in other languages.

Document from Search Console

Open Security Issues, then the Pages report. A sudden jump in indexed pages while you've published nothing new is a clear sign of injection.

Export a sample of the injected URLs and save their first-seen dates; they help pin down when the infection began.

Also check the users and owners on the property: some attackers add themselves as owners to submit their own sitemaps. Remove any owner you don't recognise.

Scan your sitemap

Paste your sitemap into the Japanese hack checker here: it looks for Japanese characters, spam terms and odd paths, and shows a clear confidence level for each signal.

Legitimate Japanese sites can produce false positives, so focus on paths and spam terms rather than the language alone.

Clean on the server and close the vector

You can't delete these pages from the WordPress dashboard; they're usually generated by code in theme files, the .htaccess file, or PHP files planted in unexpected folders. Find the generator and remove it.

Then fix how they got in: an infected plugin or theme, a leaked admin account, or loose file permissions. Cleaning without closing the door means the pages return within days, usually in larger numbers.

Check .htaccess in particular; many of these infections add rules there that send only Google visitors to the fake pages.

find . -type f -name "*.php" -mtime -30 -not -path "./wp-content/cache/*"

Clean the index and request review

Make the injected URLs return 410 (gone for good) or 404; 410 tells Google clearly the page won't come back. Then submit a clean sitemap containing only your real pages.

Don't rely on the temporary removal tool alone; it hides URLs for a few months and fixes nothing on the server.

Request a review from Security Issues only after full verification. Results then drop out of Google gradually, at a pace Google sets based on your site's size and the number of pages.