Quick answer
The Japanese keyword hack injects auto-generated Japanese spam pages into your WordPress site to hijack your Google rankings. Remove it by finding and deleting the injected pages and the backdoor generating them, cleaning the sitemap and database, closing the entry point, and requesting a Google review so the spam listings drop out.
Key takeaways
- It shows up as Japanese-text pages and titles in your Google results, not usually on your site's front end.
- The spam regenerates unless you remove the backdoor creating it.
- Cleaning the sitemap and requesting reindexing speeds up recovery of your real listings.
The Japanese keyword hack is sneaky because you often won't see it on your own site — you'll see it in Google. Your search listings suddenly show pages of Japanese text, selling counterfeit goods, under your domain. Here's how to clean it up.
What's actually happening
Attackers exploit a vulnerability to inject thousands of auto-generated spam pages, then feed them to Google through your sitemap. They ride on your domain's authority to rank, damaging your reputation and rankings in the process.
Confirm the infection
Search site:yourdomain.com on Google and look for pages you never created. Check Search Console for a spike in indexed pages and any security notices.
Remove the spam and its source
Find and delete the injected pages, then locate the backdoor generating them — often a malicious file plus altered database entries and a poisoned sitemap. Removing only the pages doesn't work; they'll regenerate.
Clean the sitemap and reindex
Regenerate a clean sitemap, remove the spam URLs, and request reindexing in Google Search Console so your real pages return and the spam drops out.
Close the entry point and harden
Update the vulnerable plugin or theme that let them in, rotate credentials, and harden the site. Then monitor Search Console for a few weeks to confirm the spam doesn't come back.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
Your WordPress site has been compromised and is generating spam pages in Japanese to piggyback on your domain's authority. It's a common SEO-spam hack.
Keep reading
How to Detect and Remove a Credit-Card Skimmer in WooCommerce
A card skimmer quietly steals customer payment details at checkout. Here's how to detect and remove one from WooCommerce.
Website Suspended by Your Host? How to Get It Back Online
If your host suspended your account for malware, here's how to clean the site to their standard and get it reactivated.
How to Request a Google Security Review After a Hack
Cleaned the hack but Google still warns visitors? Here's how to request a security review and get the warning lifted — the right way.