The Japanese keyword hack is one of the most damaging WordPress SEO spam infections.

The site may look normal when you visit it directly, especially while logged in as an administrator. But Google Search may show Japanese titles, spam descriptions, fake product pages, casino terms, pharmaceutical content, or thousands of strange URLs under your domain.

This happens because the malware is often cloaked. That means it can show clean content to normal visitors and administrators, while showing spam content to Googlebot, search visitors, or users from specific locations.

If ignored, the Japanese keyword hack can damage rankings, reduce visitor trust, trigger Google security warnings, and leave thousands of spam URLs indexed under your domain.

This guide explains how to detect, clean, and prevent the Japanese keyword hack on a WordPress website. It also explains where the Securewp Remote Security Scanner and SiteFort Security Plugin can help during detection, cleanup, and prevention.

What Is the Japanese Keyword Hack?

The Japanese keyword hack is a type of SEO spam attack where attackers inject auto-generated Japanese text, spam titles, fake product pages, or hidden links into a compromised website.

Google’s own guide describes it as a hack that creates auto-generated Japanese text on a site. These pages may be generated in random directory names or shown only to search engines.

Common signs include:

  • Japanese characters appearing in Google Search results for your domain
  • Spam titles and meta descriptions you did not create
  • Thousands of indexed URLs that do not exist in WordPress
  • Fake product or shopping pages
  • Spam pages that return clean or normal content when you visit directly
  • Redirects from Google Search results to suspicious websites
  • Unknown sitemaps submitted in Google Search Console

This attack is not always visible from the WordPress dashboard. In many cases, it is designed specifically to hide from site owners.

Japanese keyword hack showing spam search results

What Is Malicious Content Cloaking?

Content cloaking means showing different content to different visitors.

In a malicious WordPress hack, the attacker may show normal content to you, but spam content to Googlebot or search visitors.

For example:

  • Logged-in administrators see the normal website.
  • Googlebot sees Japanese spam pages.
  • Visitors from Google Search are redirected to spam sites.
  • Mobile users see a different version from desktop users.
  • Users from one country see spam while users from another country see clean content.

Google’s spam policies list cloaking and sneaky redirects as spam tactics that can cause pages or whole sites to rank lower or be omitted from Search.

This is why checking the site only from your logged-in browser is not enough.

The Japanese keyword hack is part of a larger group of SEO poisoning attacks. The exact language or topic may change, but the goal is usually the same: abuse your domain’s trust to rank spam pages or redirect visitors.

Pharma Hack

Pharma spam usually injects pages or snippets promoting fake or unauthorized healthcare products.

Normal visitors may see the real website, while search engines see spam titles, drug-related keywords, or hidden links.

Pharma hack example in search results

Casino, Betting, and Adult Spam

Some hacked WordPress sites are used to promote casino, betting, or adult keywords. This often appears in Google Search as strange titles, hidden landing pages, or redirects.

Fake Product or Shopping Spam

Attackers may create fake product pages under your domain to capture search traffic. These pages may not exist inside WordPress as normal posts or pages, which makes them harder to find from the dashboard.

Clickbait and Redirect Spam

Some infections use misleading titles to attract clicks, then redirect visitors to scam pages, fake browser updates, suspicious downloads, or affiliate spam.

Why the Japanese Keyword Hack Is Hard to Detect

This hack is difficult because the visible website may not look infected.

Attackers often hide the spam using:

  • User-agent checks
  • Googlebot detection
  • Search referrer checks
  • Mobile-only redirects
  • Country-based cloaking
  • Cookie-based one-time redirects
  • Database-generated spam pages
  • Rewrite rules that create fake URLs dynamically

This means a normal file scan may miss the visible symptom, and a normal browser visit may show a clean site.

For proper detection, you need to check the website from more than one view:

  • What Google Search shows
  • What a logged-out visitor sees
  • What a mobile visitor sees
  • What a remote scanner sees
  • What the WordPress files and database contain

How to Detect the Japanese Keyword Hack

Use the following checks to confirm whether your site is affected.

Search your domain in Google:


site:yourdomain.com

Then search for common spam patterns:


site:yourdomain.com Japanese
site:yourdomain.com viagra
site:yourdomain.com casino
site:yourdomain.com inurl:index.php?
site:yourdomain.com inurl:product
site:yourdomain.com inurl:shop

Look for:

  • Japanese characters
  • Spam titles
  • Strange meta descriptions
  • Random query-string URLs
  • Fake product pages
  • Pages you never published

2. Check Google Search Console

Google Search Console is one of the most important tools during SEO spam cleanup.

Check these areas:

  • Security issues: Look for hacked content, malware, deceptive pages, or social engineering warnings.
  • Manual actions: Check whether Google applied a manual penalty.
  • Pages report: Look for unexpected indexed or crawled URLs.
  • Sitemaps: Remove unknown or spam sitemaps.
  • Users and permissions: Remove unauthorized users or owners.
  • URL Inspection: Compare what Google sees for suspicious URLs.

Attackers sometimes verify themselves as Search Console owners or submit spam sitemaps. If you find an unknown owner or sitemap, remove it immediately and check how verification was added.

Google Search Console showing performance drop and indexing spike

3. Test as a Logged-Out Visitor

Open your website in an incognito/private browser window while logged out of WordPress.

Test:

  • Homepage
  • Top landing pages
  • Blog posts receiving search traffic
  • Pages shown in Google Search results
  • Suspicious URLs listed in Search Console

If the site looks different when logged out, investigate for cloaking or conditional redirects.

4. Click Your Results from Google Search

Some malware only triggers when the visitor comes from Google.

Search your domain, click several results, and compare:

  • Direct visit to the URL
  • Visit from Google Search
  • Visit while logged in
  • Visit while logged out
  • Visit from mobile

If only search-result visitors are redirected, the malware may be checking the referrer.

5. Run the Securewp Remote Security Scanner

The Securewp Remote Security Scanner is useful because it checks the public-facing version of your website from outside your WordPress admin session.

That matters because Japanese keyword hacks and cloaking attacks often hide from logged-in administrators.

The remote scanner can help identify:

  • Visible Japanese keyword spam
  • Suspicious redirects
  • Blacklist status
  • Malware indicators
  • Exposed sensitive files
  • Search-facing or guest-facing differences

securewp remote scanner detected content cloaking

6. Scan Inside WordPress with SiteFort

Remote scanning gives you the outside view. You also need an inside view of the WordPress installation.

SiteFort Security Plugin can help scan for:

  • Backdoors
  • Web shells
  • Malicious PHP
  • Injected JavaScript
  • SEO spam indicators
  • Suspicious redirects
  • Modified core files
  • Vulnerable plugins and themes
  • Exposed sensitive files

Using both tools together gives you two important perspectives:

  • Securewp Remote Security Scanner: What visitors and search engines may see from outside.
  • SiteFort: What is happening inside WordPress files, users, plugins, themes, settings, and logs.

Where Japanese Keyword Malware Usually Hides

The Japanese keyword hack can be stored or triggered from several places.

Check these areas carefully:

  • wp-config.php
  • .htaccess or Nginx rewrite rules
  • Theme files such as functions.php, header.php, footer.php, and index.php
  • Fake plugin folders
  • Modified plugin files
  • wp-content/mu-plugins/
  • wp-content/uploads/
  • wp_options table
  • Posts, pages, widgets, and page builder content
  • WordPress cron tasks
  • Server-level cron jobs
  • Hidden backdoor files

Suspicious patterns include:


eval
base64_decode
gzinflate
str_rot13
file_get_contents
curl_exec
String.fromCharCode
document.write
window.location
location.href
atob

These functions are not automatically malicious, but they should be reviewed carefully when found in unexpected places.

How to Clean the Japanese Keyword Hack

Cleaning this hack requires more than deleting spam pages from Search Console. You need to clean the website first, then clean the Google footprint.

1. Take a Full Backup First

Before deleting anything, take a backup of the current infected site and database.

This gives you a recovery point and preserves evidence for investigation. Store the backup safely and do not restore it later unless you are sure it is clean.

2. Remove Malware, Backdoors, and Spam Injections

Clean infected files and database entries. Look for:

  • Injected spam content
  • Malicious JavaScript
  • Suspicious redirects
  • Fake plugins
  • Backdoors
  • PHP files in uploads
  • Modified core files
  • Unknown admin users
  • Malicious cron jobs

Where possible, replace WordPress core, plugin, and theme files with clean copies from trusted sources instead of manually editing heavily infected files.

3. Remove Unauthorized Users

Check WordPress users and remove unknown accounts.

Pay attention to:

  • Administrator users
  • Recently created users
  • Users with strange email addresses
  • Users whose role changed unexpectedly
  • Hidden users in the database

Also check Google Search Console users and verification methods. Remove any owner or verification method you do not recognize.

4. Patch the Entry Point

If you only clean the spam but leave the vulnerable plugin, stolen credential, or backdoor active, the hack can return.

Patch the entry point by:

  • Updating WordPress core
  • Updating all plugins and themes
  • Removing abandoned plugins and themes
  • Removing nulled software
  • Resetting WordPress admin passwords
  • Resetting hosting, SFTP/FTP, database, email, and DNS passwords
  • Enabling 2FA for administrators

SiteFort can help with vulnerability alerts, login security, 2FA, weak or breached password checks, firewall rules, and hardening controls.

5. Return 404 or 410 for Spam URLs

After cleanup, spam URLs that should not exist must return a proper status code.

Use:

  • 404 Not Found when the page does not exist
  • 410 Gone when the page is intentionally and permanently gone

Google’s Removals documentation explains that temporary removals last about six months and that permanent removal requires an actual site-side fix, such as returning 404/410, blocking access, or using noindex where appropriate.

Do not redirect hacked spam URLs to the homepage. Large numbers of spam redirects can create confusing signals and may not clean the index properly.

6. Remove Spam Sitemaps from Search Console

In Google Search Console, go to Sitemaps and remove anything you do not recognize.

Submit only a clean sitemap that contains legitimate, indexable URLs.

7. Use the Google Search Console Removals Tool for Urgent Cleanup

If spam URLs are actively visible in Google Search, use the Removals tool to temporarily hide them while Google recrawls your cleaned site.

Google says the Removals tool can temporarily hide pages from Google Search, and its support documentation states temporary removals last about six months.

Use it carefully for:

  • Individual spam URLs
  • Clear spam URL prefixes
  • Urgent search result cleanup after the site is already cleaned

Be careful with prefix removals. Do not remove broad paths that may include legitimate pages.

8. Request Review if Google Shows a Security Issue

If Search Console shows a security issue or manual action, request review only after the site is fully cleaned and secured.

In the review request, explain what was fixed:

  • Removed Japanese keyword spam
  • Removed malware and backdoors
  • Removed unauthorized users
  • Removed spam sitemaps
  • Updated vulnerable plugins and themes
  • Reset credentials
  • Added firewall, hardening, malware scanning, and monitoring

How Long Does Recovery Take?

There is no fixed recovery time.

After cleanup, Google needs to recrawl the site, process removed URLs, update snippets, and confirm that the hacked content is gone. Temporary removals can hide urgent URLs faster, but permanent cleanup depends on Google seeing the corrected status codes and clean pages.

For small infections, visible cleanup may happen relatively quickly. For large Japanese keyword hacks with thousands of indexed spam URLs, recovery can take weeks or longer.

The most important thing is to make sure the spam URLs no longer return hacked content. If they still return 200 OK with spam, Google may keep crawling or indexing them.

How to Prevent the Japanese Keyword Hack from Returning

After cleanup, focus on preventing reinfection.

  • Keep WordPress core, plugins, and themes updated.
  • Remove unused and abandoned plugins or themes.
  • Never use nulled plugins or themes.
  • Enable 2FA for administrators.
  • Use strong, unique passwords for WordPress, hosting, SFTP/FTP, database, DNS, and email.
  • Remove unknown admin users.
  • Disable file editing in the WordPress dashboard.
  • Block PHP execution in uploads where possible.
  • Protect sensitive files such as wp-config.php, backups, logs, and Git directories.
  • Restrict XML-RPC if unused.
  • Use a WordPress firewall and bot protection.
  • Monitor vulnerabilities.
  • Run regular malware scans.
  • Review audit logs for suspicious changes.
  • Check Google Search Console regularly.
  • Run periodic external scans with the Securewp Remote Security Scanner.

SiteFort helps with many of these layers by providing malware scanning, vulnerability alerts, hardening, firewall rules, bot blocking, login protection, 2FA, audit logs, and Cloudflare Sync.

When to Get Professional Help

Consider professional cleanup if:

  • The spam returns after cleanup
  • Google shows thousands of hacked URLs
  • You cannot find where the spam is generated
  • Search visitors are redirected but admins see a clean site
  • Unknown users or backdoors keep returning
  • The hosting provider has suspended the site
  • The site is business-critical and downtime is costly

Japanese keyword hacks can involve files, database content, cron jobs, Search Console abuse, vulnerable plugins, and hidden backdoors. If you only remove the visible spam, the infection may return.

If your site is already compromised, our WordPress malware removal service can help clean the infection and reduce reinfection risk.

Final Thoughts

The Japanese keyword hack is not just a cosmetic problem. It is a WordPress compromise that can damage search visibility, visitor trust, and domain reputation.

Start by confirming the problem in Google Search and Search Console. Test as a logged-out visitor. Use the Securewp Remote Security Scanner to check what outsiders and search engines may see. Then use SiteFort inside WordPress to scan for malware, suspicious redirects, modified files, vulnerable plugins, backdoors, and exposed sensitive files.

Clean the website first, remove backdoors, patch the entry point, reset credentials, and secure the site. Then clean the Google footprint by removing spam sitemaps, returning 404 or 410 for hacked URLs, using the Removals tool where needed, and requesting review if Google shows a security issue.

Most importantly, continue monitoring after cleanup. If the hack returns, the root cause is still active.