The Japanese keyword hack: detect it, remove it, keep it out

Updated 2026-10-16 · 7 min read · by the IsHacked team

You search for your business and Google shows titles in Japanese, selling knock-off brands or gambling. The site looks normal when you open it. That is the Japanese keyword hack: thousands of auto-generated spam pages, shown mainly to search engines, riding on your domain's reputation.

Check for cloaked spam now

How it works

• Generated pages. A script on your server answers made-up URLs with Japanese spam, usually from a template plus a keyword list. The files may live in an innocent-looking folder or be produced by a PHP file disguised as part of WordPress.
• Cloaking. The spam is served to Googlebot, while people get your real page or a 404. That is why the owner rarely notices.
• Sitemaps and Search Console. The attacker submits sitemaps listing the spam URLs. Often they verify themselves as an owner of your Search Console property to do it.

Confirm it from outside

1. Search site:example.com in Google. Japanese titles confirm it; add site:example.com ジャパン or a brand name to narrow the results.
2. Fetch a spam URL from the results as Googlebot and as a normal browser and compare:

   curl -s -A 'Googlebot/2.1 (+http://www.google.com/bot.html)' 'https://example.com/spam-url' | head -40

3. Open /sitemap.xml and /robots.txt. Look for URL patterns you never created, or sitemap lines pointing elsewhere.
4. In Search Console, check Users and permissions for owners you don't know.

Clean it up

1. Take a full backup first (files and database), so nothing is lost if a step goes wrong.
2. Find the generator. Compare WordPress core and plugins against official checksums (wp core verify-checksums, wp plugin verify-checksums --all), and list PHP files in places where they don't belong, like wp-content/uploads. Check .htaccess for rewrite rules that send unknown URLs to a PHP file.
3. Remove every backdoor, not only the generator. Work through the cleanup checklist: rogue admins, fake plugins, must-use plugins, cron jobs, database payloads.
4. Make spam URLs return 404 or 410. Once the generator is gone they should, without any extra rule.
5. Fix Search Console. Remove unknown owners and their verification tokens, delete sitemaps you didn't submit, submit your real sitemap, and use the Removals tool for the worst spam URLs.
6. Rotate credentials: WordPress admins, database password, salts in wp-config.php, hosting and SFTP accounts.

Prevent it coming back

Most reinfections happen within days, through a backdoor that was missed. Keep plugins and themes updated, remove the ones you don't use, and watch the site from outside every day: a sudden jump in sitemap URLs, Japanese text served to Googlebot, or a new sitemap line in robots.txt are the first signs, and they show up long before rankings fall.

FAQ

Why can't I see the Japanese pages on my site?

The pages are usually cloaked: they are generated only for Googlebot, or only for URLs you never visit. Load the site with a Googlebot user agent, or search site:yourdomain.com in Google, to see them.

How long does it take Google to drop the spam pages?

Usually days to a few weeks after the pages return 404 or 410. Removing them from the sitemap and requesting removal in Search Console speeds it up.

Do I need to remove unknown owners from Search Console?

Yes. The hack often adds the attacker as a verified owner so they can submit sitemaps for your domain. Remove them and delete the verification file or tag they used.