If Google shows pages on your site with Japanese text you never wrote, your site has been hacked with the Japanese keyword hack. Attackers have added hidden spam pages that only search engines see, to sell fake brand goods using your site’s reputation. Fixing it means removing the spam pages, the code that creates them and the way the attackers got in, then asking Google to recheck the site.
Key takeaways
- The spam is often hidden from you and shown only to Google, so your site can look normal.
- Check Search Console for unknown owners and strange sitemaps. Attackers often add themselves.
- Deleting the spam pages isn’t enough. The backdoor that creates them must go too.
- Google won’t lift warnings until every affected page is fixed, and its review can take days to weeks.
What is the Japanese keyword hack?
It’s a common type of SEO spam. Google describes it as a hack that “typically creates new pages with autogenerated Japanese text on your site in randomly generated directory names”. The pages are “monetized using affiliate links to stores selling fake brand merchandise” (web.dev).
The attackers aren’t after your customers directly. They want your domain’s standing with Google, so their spam ranks. Your business pays the price: search results full of gibberish, lost trust and sometimes a warning label next to your site.
How do I know if my site has the Japanese keyword hack?
Run these checks today:
- Search Google for
site:yourdomain.com.au. Scroll through the results for Japanese titles or odd addresses, such as long random folder names. - Open Google Search Console and look at the Security issues report.
- Check Search Console users. Google notes that “the hacker will typically add themselves as a property owner in Search Console”. An owner you don’t recognise is a strong sign.
- Check your sitemaps. Attackers add or edit sitemaps so Google finds their pages faster.
Security tools and browsers may also flag the site. Our website blacklist check guide explains how to see whether you’ve been listed.
Why can’t I see the spam pages myself?
Because of cloaking. The malicious code checks who is asking. Google’s crawler gets the spam page, while you and your customers get your normal site or a “page not found” error. Google warns: “Hackers will try to trick you into thinking the page is gone or fixed when it’s still hacked.”
To see what Google sees, use the URL Inspection tool in Search Console on one of the spam addresses.
How do I fix the Japanese keyword hack?
This is the process Google recommends, in plain English. It needs access to your hosting files and database. If that’s unfamiliar ground, skip to the section on getting help.
- Back up the hacked site. Copy all files and the database off the server first. You may need them to trace how the attackers got in.
- Remove unknown owners. In Search Console, remove any owner you don’t recognise and delete their verification file or token.
- Change every password. WordPress admins, hosting, FTP, database and email. Turn on two-factor login.
- Replace .htaccess files. Attackers use them for cloaking and redirects. Replace each one, including hidden copies in subfolders, with a clean default.
- Reinstall WordPress core, plugins and themes. Use fresh copies from trusted sources. Delete anything you don’t use.
- Hunt down the leftovers. Look for PHP files modified around the time of the hack, files outside the normal folders and scrambled code using functions such as
base64_decodeoreval. - Check the database and users. Remove unknown admin accounts and spam content stored in the database.
- Clean the sitemaps. Delete any sitemap you didn’t create, and resubmit your real one.
Our website hacked recovery guide covers the wider clean-up for other kinds of infection.
How do I get the spam pages out of Google?
Once the site is clean, the spam addresses should return a 404 (not found) or 410 (gone) error. Google drops them as it recrawls. To hide them faster, use the Removals tool in Search Console. It can remove every address that starts with the same folder, but a removal “lasts only about six months”, so the pages must really be gone (Google Search Console Help).
If Search Console listed security issues, click Request Review and explain what you fixed. Google says a review for hacked content “can take from a few days to a few weeks”. It also warns that fixing only some pages “will not earn you a partial return to search results” (Google Search Console Help).
Why does the Japanese keyword hack keep coming back?
Because the spam pages are a symptom. The cause is a backdoor, a stolen login or an out-of-date plugin, and a quick clean-up often misses it. Sucuri found backdoors on 49% of compromised sites and malicious admin users in 55% of infected databases (Sucuri). Google’s guide cites a study that found “20% of hacked sites are hacked again within one day”.
That’s why a proper malware removal service finds the entry point, not only the spam. It’s also why secure web hosting matters. Account isolation, a firewall and server-level scanning make reinfection harder.
When should I get professional help?
Get help if any of these apply:
- You can’t access your hosting files or database, or don’t feel safe editing them.
- The spam came back after you or someone else cleaned it.
- Your site takes payments or stores customer details. A hack may also be a data breach.
- Google shows a warning, or your traffic has dropped sharply.
Our hacked website repair service cleans the site, closes the way in and handles the Google review. After that, our website maintenance plans keep watch so it doesn’t happen again.
Frequently asked questions
Why does my website show Japanese characters in Google?
Almost always because it has been hacked. Attackers have created spam pages on your domain, usually selling fake brand goods, and hidden them from normal visitors. Google indexes them and shows them under your site’s name in search results.
Is the Japanese keyword hack dangerous for my customers?
The spam pages mainly target search engines, but the attackers have access to your site. They could add malware, steal form submissions or send spam from your server. Treat it as a full compromise, not a cosmetic problem.
How long does it take for the spam to disappear from Google?
It varies. Pages that return a 404 or 410 drop out as Google recrawls them, which can take weeks for a big infection. The Removals tool hides them faster. A security review, if needed, can take a few days to a few weeks.
Can I fix it by restoring a backup?
Only if the backup predates the hack and you then close the hole the attackers used. Otherwise they’ll be back quickly. You’ll still need to remove unknown Search Console owners, change passwords and clean the spam out of Google.
Does the Japanese keyword hack affect WordPress only?
No. It can affect any site an attacker can write files to. WordPress is hit often because it’s so widely used and plugins are a common way in, so keeping plugins updated is one of the best defences.
Sources
- Fix the Japanese keywords hack, web.dev (Google)
- Removals and SafeSearch reports tool, Google Search Console Help
- Security issues report, Google Search Console Help
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024