Japanese Keyword Hack: How to Clean It Up

Japanese Keyword Hack: How to Clean It Up

You Google your own site name and something is very wrong. Instead of your homepage title and description, Google is showing rows of Japanese characters — page after page of them, URLs you’ve never seen, product listings for designer handbags or pharmaceuticals in a language you don’t speak. Your actual site looks fine when you visit it. That’s what makes this one so unsettling.

This is the Japanese keyword hack, and I’ve cleaned it from well over thirty WordPress sites since 2011. It’s one of the oldest and most persistent spam campaigns targeting WordPress, and it’s still very much active. Here’s what’s actually happening, and how to get rid of it.

What This Hack Actually Does

The attacker’s goal is simple: use your domain’s authority to rank Japanese-language spam pages — usually fake luxury goods or pill sites — in Google Japan. They don’t care about your business at all. Your site is just infrastructure.

What makes it hard to catch is that the infected pages are deliberately hidden from logged-in admins and from direct visitors. The hack detects whether the visitor is a search engine crawler, and only shows the spam content to Googlebot. You visit the URL yourself, it looks normal. Googlebot visits it, gets a screen full of japanese seo spam. This technique is called cloaking, and it’s why site owners usually find out from Google Search Console — or worse, from a client who Googled them.

I had one client, a small accounting firm in Melbourne, who found out because a prospective customer emailed asking why their website was selling Gucci bags. They’d been hacked for at least four months before anyone noticed.

Where to Look First

Open Google Search Console immediately. Go to URL Inspection and check a few of your real URLs — then do a site search on Google using site:yourdomain.com and look at what’s actually indexed. If you see japanese characters in google search results under your domain, you have confirmation.

Now get into the files. The hack plants itself in a few predictable places, though attackers do change their methods over time. The most common spots I find on sites I’m cleaning:

• wp-content/uploads/ — PHP files have absolutely no business being here. Any .php file in your uploads folder is suspicious.
• wp-includes/ — Modified core files, or entirely new files that don’t belong to WordPress core.
• The root .htaccess file — This is a favourite. The cloaking logic often lives here, redirecting Googlebot to the spam content while normal visitors see nothing wrong.
• A compromised or nulled plugin or theme — This is the entry point more often than not.

Run a Wordfence scan if you have it installed. If you don’t, install it now — the free version will catch most of what you need. Wordfence flags modified core files and unknown files in places they shouldn’t be. When I run a scan on a freshly compromised site, the results list can be 40-50 items long. Don’t panic. Work through it methodically.

For a step-by-step on what to do in the first hour after discovering a hack, I’d point you to Your WordPress Site Got Hacked. Do This First. — covers the triage process before you start touching files.

How I Actually Remove It — My Approach

This is where I’ll give you a firm opinion: do not just delete flagged files and call it done. That’s how sites get re-hacked within a week.

The sequence that works, based on cleaning dozens of these:

First, find and remove the backdoor. The spam pages are a symptom. The backdoor is the actual problem — a hidden PHP file, usually base64-encoded to evade basic scans, that lets the attacker write new files whenever they want. Search your entire file system for eval(base64_decode. On a hosting account with SSH access, this one command saves a lot of time:

grep -r "eval(base64_decode" /path/to/your/wordpress/ --include="*.php" -l

That will list every PHP file containing that pattern. Not every result is malicious — some plugins use base64 legitimately — but you’ll quickly spot the ones that don’t belong.

Second, replace WordPress core files. Download a fresh copy of the same WordPress version from WordPress.org and replace wp-admin/ and wp-includes/ entirely. Don’t touch wp-content/ yet — that’s where your themes and plugins live. Replacing core takes ten minutes and eliminates any tampering in those directories.

Third, audit every plugin and theme. Delete anything you’re not actively using. Delete nulled or pirated themes — full stop. They almost always contain shells. Update everything that remains. If a plugin hasn’t been updated by its developer in over two years and has fewer than a thousand active installs, seriously consider replacing it with something maintained.

Fourth, check your database. The japanese keyword hack sometimes injects spam content directly into the wp_posts table or adds hidden admin users. Check your users list — go to Users in the WordPress dashboard and look for accounts you don’t recognise. In the database, run a search in wp_options for unexpected entries in siteurl or home, and look through wp_posts for posts with Japanese titles you never created.

For a detailed walkthrough of manual file-level cleaning, How to Remove Malware From WordPress Manually goes deeper on the process I use.

After Cleanup: Don’t Skip These Steps

Cleaning the infection is only half of it. Here’s what finishes the job properly.

Change every password. WordPress admin accounts, FTP, cPanel, database — all of them. The attacker may have credentials stored. Reset your WordPress secret keys too, in wp-config.php — WordPress provides a fresh key generator at api.wordpress.org/secret-key/1.1/salt/.

Submit a reconsideration request in Google Search Console once the site is clean. Google is generally reasonable about wordpress seo spam cleanup situations — they know this hack pattern well. Use the URL Removal tool first if there are specific spam URLs indexed under your domain that you want cleared faster. The index cleanup can take two to six weeks, sometimes longer. That’s normal.

Set up monitoring so you’re not the last to know next time. Wordfence with email alerts on, Google Search Console alerts turned on, and ideally a server-side monitoring tool that checks file integrity. I run daily Wordfence scans on client sites I manage — costs nothing, catches early signs of reinfection fast.

One last thing: look at how it got in. If you identify the vulnerable plugin or theme, report it. Other sites are probably running the same thing.

---

When to Call In a wordpress seo spam cleanup Specialist

Look, I get it — you’ve run Wordfence, deleted the flagged files, and the scan’s coming back clean. But two days later Google Search Console is still showing thousands of indexed Japanese URLs under your domain, and your client is blowing up your phone. That’s the moment you realize the initial infection was just the surface. A proper wordpress seo spam cleanup isn’t just deleting malicious PHP files — it’s submitting removal requests in GSC, fixing the sitemap the hack silently rewrote, and auditing every user account and file-modification timestamp going back to whenever that first suspicious login slipped through.

If this is more than you want to handle yourself — or if you’ve tried and the Japanese characters keep coming back — I take on this kind of work at swsDreams. Happy to take a look.