Imagine searching for your own business on Google and finding a result under your domain with a title in Japanese, selling handbags you have never heard of. You click it. Your site loads normally. You search again, and there are hundreds more.
Welcome to the Japanese keyword hack. It is one of the strangest infections a WordPress site can get, and one of the most frustrating, because it is built to be invisible to you while being very visible to Google.
The good news is that it is well understood, and Google has published a fix. Here is how to spot it, clean it and make sure it does not return.
What the Japanese Keyword Hack Is
The Japanese keyword hack is a type of SEO spam. An attacker breaks into your site and creates large numbers of pages full of auto-generated Japanese text. Those pages usually carry affiliate links to stores selling fake brand merchandise, and the attacker earns a commission when somebody buys.
The pages tend to live in randomly named folders on your site, with numbered file names. Google describes this pattern in its own article on fixing the Japanese keyword hack. The goal is not to fool your visitors. The goal is to borrow your domain's reputation so the spam pages rank in search.
Why You Cannot See the Pages
Here is the trick. The hack uses cloaking, which means showing different content to different visitors. Googlebot (Google's crawler) sees the Japanese spam. You, visiting from your browser, see your normal site, a plain 404 error or a slightly broken page.
Some versions go further and redirect anyone who clicks a spam result from Google over to the shop. That is why the first sign is often a customer message or a strange search result, not anything you notice yourself.
Why Attackers Bother
A domain with a clean history ranks easily. By stuffing your site with thousands of keyword pages, the attacker gets free search traffic without building or paying for anything. Your site pays the bill in lost reputation, and your real pages can be pushed down in results.
How to Spot the Japanese Keyword Hack
Key takeaway: If Google shows pages you cannot find in your own dashboard, assume cloaking. Trust what Search Console shows over what your browser shows.
You do not need special tools. Three checks catch most infections.
1. Search Your Own Site on Google
Type site:yourdomain.com into Google, replacing it with your real domain, and scroll through several pages of results. You are looking for:
- Titles in Japanese characters, or product names that have nothing to do with your business.
- URLs in folders you do not recognise, often with random letters and numbered pages.
- A result count much larger than the number of pages you actually have.
Try adding a brand name that spammers like, for example site:yourdomain.com handbags, to flush out more. If one search engine looks clean, try another, since the results can differ.
2. Check Search Console
If you have not set up Google Search Console, do it now. It is free and it is the best window into how Google sees your site. Look at:
- Security Issues: Google may already have flagged hacked content.
- Performance: Unfamiliar queries (especially Japanese ones) driving impressions.
- Pages: A sudden jump in the number of indexed pages.
Then use the URL Inspection tool on one of the spam URLs. It shows the page as Google fetched it, which reveals the hidden content that your browser does not.
3. Look at Who Owns the Property
This one surprises people. According to Google's article, the hacker often adds themselves as an owner in Search Console, so they can change settings like geotargeting and submit their own sitemaps.
In Search Console, open the settings for your property and look at Users and permissions, and the ownership verification details. An owner you do not recognise is a strong sign of compromise. Remove them, and remove the verification token that proves their ownership. We come back to this in the cleanup steps.
Why This Hack Hurts More Than It Looks
At first the damage seems theoretical: some odd pages, who cares? In practice, there are real costs.
- Rankings fall. Thousands of low-quality pages dilute how Google sees your site.
- Security warnings appear. Google may label results "This site may be hacked", which makes people less likely to click you.
- Your crawl budget gets wasted. Googlebot spends time on spam instead of your real pages.
- Your hosting account can be flagged. Some hosts suspend sites that serve large amounts of malicious content.
It is also a sign that someone has write access to your files, and they are unlikely to have limited themselves to spam pages. Treat the Japanese keyword hack as the visible tip of a break-in. For a wider list of warning signs, see the signs your WordPress site has been hacked.
How to Clean Up the Japanese Keyword Hack
Take these in order. The order matters because each step stops the hack from undoing the next.
| Step | What you do | Why it comes in this order |
|---|---|---|
| 1 | Back up files and database | Evidence and a way back |
| 2 | Remove unknown Search Console owners | Stops the attacker managing your property |
| 3 | Replace .htaccess | Kills the rules serving spam |
| 4 | Remove malicious files | Removes the pages themselves |
| 5 | Fix sitemaps | Stops pushing spam URLs to Google |
| 6 | Remove spam URLs | Clears what is already indexed |
| 7 | Change every password | Closes the way in |
Step 1: Back Up Everything First
Before you delete a single file, save a full copy of your site files and database, and store it somewhere offline. It sounds backwards, but it gives you a record of what the attacker added and a way back if a clean-up step breaks something. Google's own advice starts here too.
Stack Guard Free can take a manual full or database-only backup that is verified before it counts, and it restores in one click with a 7 day keep-or-roll-back window.
Step 2: Remove Unknown Search Console Owners
Remove anyone you do not recognise from the verified owners list. Then remove their verification token, so they cannot re-verify. Google's article notes that a rewrite rule in .htaccess can generate fake verification files, so do the next step too.
Step 3: Replace the .htaccess File
.htaccess is a settings file on Apache and LiteSpeed servers. It is a favourite hiding place for this hack, because a few rewrite rules can serve spam pages from files that do not exist. Replace it with a clean WordPress default, then save your permalinks to regenerate the standard rules. Check subfolders for extra copies.
Step 4: Remove the Malicious Files and Scripts
This is the big one. Your goals:
- Reinstall WordPress core, all plugins and all themes from clean copies, so any modified file is overwritten.
- Hunt for extra PHP files. Look for files that are not part of a default install, recently modified files and unusually large ones. Google's article names files such as
index.php,wp-load.php,404.phpandview.phpas frequent targets. - Look for obfuscated code. Long strings of encoded text next to functions like
base64_decode,evalorgzinflateare how attackers hide what a file does. - Check the uploads folder. It should hold images and documents, not PHP files.
Doing this by hand across a large site is slow. Stack Guard's malware scanning checks every WordPress core file against the official copy and looks for patterns of known back doors, web shells and injected code, with a report of what it found and how serious it is. Manual scans are free. Pro can quarantine a suspect file (move it somewhere it cannot run, and remember where it came from) and restore core files from WordPress.org, which is gentler than deleting something you are not sure about.
Our guide to recovering a hacked WordPress site covers the full recovery order, and the guide to scanning WordPress for malware explains how to read scan results.
Step 5: Fix Your Sitemaps
Spammers often edit your existing sitemap or add a new one so Google finds their pages faster. Open your sitemap and look for URLs you do not recognise. Then check Search Console's Sitemaps report for any sitemap you did not submit. If one holds only spam, delete it.
Step 6: Remove the Spam URLs
Once the files are gone, the spam URLs should return a "not found" or "gone" response. Check a handful with the URL Inspection tool. When they return an error, Google drops them over time as it recrawls.
To speed it up, Search Console has a removals tool for hiding URLs from results temporarily, and you can ask for whole folders to be hidden if the spam lives under a random directory. It is a stopgap, not a fix, so make sure the pages are really gone first.
Step 7: Change Every Password
Change the passwords for WordPress administrators, hosting, SFTP and the database. Delete administrator accounts you do not recognise. Rotating your security keys signs out every active session, including a stolen one. Do this after the site is clean, then do it once more a week later to be safe.
Keeping the Japanese Keyword Hack from Coming Back
A cleaned site is not a protected site. Google's article is blunt about it, and recommends scanning your own computer, changing passwords, turning on two-step verification, keeping software updated and considering a monitoring service.
Here is what that looks like in practice.
Close the Way In
Most infections start with an outdated plugin, a weak password or a stolen login. Keep everything updated, delete plugins and themes you do not use, and require two-factor for administrators. Stack Guard Free includes two-factor with authenticator apps and email codes, lockouts for repeated failed sign-ins, and a hidden sign-in address.
Watch for New Files
The Japanese keyword hack works by adding files, so watching for new files is the most direct defence. File change monitoring, a Pro feature, records a fingerprint of every code file on your site, then tells you what was added, changed or removed on each scheduled scan. A new PHP file in a theme folder is one of the clearest warning signs there is, and you get told within a day instead of months later.
Make the baseline after the site is clean, not before. Otherwise you are teaching the monitor that the infection is normal.
Keep Checking Search Console
Once a month, glance at Security Issues, the number of indexed pages and the owner list. It takes two minutes, and it is the only place where you will see what Google sees.
Keep a Clean Backup
If it does return, a verified backup from before the infection gives you a clean place to start. The related article on the WordPress redirect hack covers a close cousin of this attack, where visitors are sent away instead of shown spam, and the WordPress pharma hack is the same trick with drug spam.
The Japanese keyword hack looks alarming because it is so strange. But once you know it is a file-and-ownership problem, not a mystery, it is a cleanup with a clear order and an end.