You're checking your website's Google search results and something looks very wrong. Pages you never created are showing up — titles and descriptions filled with Japanese characters, links to pharmaceutical products, or spam content that has nothing to do with your business.

Your site hasn't been defaced. Your homepage looks completely normal. But something has taken over your search presence.

This is the Japanese Keyword Hack — one of the most common and damaging SEO spam attacks in existence. And if you're seeing it, you need to act fast.

What Is the Japanese Keyword Hack?

The Japanese Keyword Hack is a black-hat SEO attack where hackers gain unauthorized access to your website and inject thousands of auto-generated spam pages — typically filled with Japanese keywords, pharmaceutical terms, or other high-volume search queries.

The goal isn't to deface your site visibly. It's far more calculated than that. Attackers exploit your domain's existing authority to rank spam pages in search engines, driving traffic to affiliate sites, counterfeit product stores, or phishing pages — all while your actual website appears completely normal to you.

The name comes from the Japanese text that frequently appears in these injected pages, though the attack is used globally and the injected language varies.

Why Your Site Gets Targeted

Your website is valuable to attackers not because of what it sells — but because of the trust it has built with search engines. A domain with age, backlinks, and consistent traffic is a ready-made platform for ranking spam content quickly. The higher your Domain Authority, the more attractive your site is as a target.

How the Attack Works

Understanding the mechanism helps you find every trace of it during cleanup.

Step 1 — Infiltration Attackers gain access through a vulnerability — an outdated plugin, a weak admin password, a compromised theme, or a server-level security gap.

Step 2 — Backdoor Installation Before injecting any content, attackers plant a backdoor — hidden code that maintains their access even after you change passwords or update software.

Step 3 — Spam Page Generation Thousands of pages are automatically generated and added to your site, often in subdirectories or as hidden files. These pages are invisible when you browse your site normally — they're served selectively to search engine crawlers and users arriving from search results.

Step 4 — Search Engine Manipulation The injected pages are optimized for specific keywords — Japanese pharmaceutical terms, luxury goods, or other high-volume queries. Search engines index these pages under your domain, associating your site with the spam content.

Step 5 — Traffic Monetization Visitors who click through from search results are redirected to affiliate pages, scam stores, or phishing sites — generating revenue for the attackers while destroying your site's reputation.

How to Detect the Japanese Keyword Hack

The attack is specifically designed to be invisible to site owners. Here's how to find it.

Method 1: Google Search Operator

Search Google for your domain with this query: site:yourwebsite.com

Scroll through the results. If you see pages with Japanese characters, pharmaceutical keywords, or content you don't recognize — your site is compromised.

Try also: site:yourwebsite.com viagra site:yourwebsite.com casino site:yourwebsite.com yen

Method 2: Google Search Console

Log into Google Search Console
Go to Coverage → check for pages Google has indexed that you don't recognize
Go to Security & Manual Actions → Security Issues — Google may have already flagged the hack
Check Performance → Pages — look for URLs with Japanese characters or unexpected paths

Method 3: Run a Malware Scan

Use these tools to scan for injected content:

Sucuri SiteCheck — sucuri.net — comprehensive malware and blacklist check
Google Safe Browsing — checks if Google has flagged your domain
Wordfence (WordPress) — deep file and database scanning
VirusTotal — multi-engine URL and file scanning

Method 4: Check for Hidden Files

Via FTP or File Manager, look for:

Unfamiliar directories in public_html
PHP files with random names (e.g. xd3kf9.php)
Recently modified core files you didn't touch
New subdirectories containing .html or .php files with Japanese or spammy filenames

Method 5: Check Your .htaccess File

Open your .htaccess file and look for suspicious redirect rules — particularly ones that redirect search engine crawlers (Googlebot) or referral traffic to external URLs while showing your normal site to direct visitors. This is a classic cloaking technique used in this attack.

How to Fix the Japanese Keyword Hack

Work through these steps in order. Skipping steps — especially backdoor removal — is the most common reason sites get reinfected.

Step 1: Take the Site Offline

Put your site into maintenance mode or temporarily restrict access while you clean. This prevents further damage to visitors arriving from compromised search results.

Step 2: Change All Passwords and Revoke Access

Before touching any files:

Hosting control panel password
FTP / SFTP credentials — delete any FTP accounts you don't recognize
Database password — update in both the database and your CMS config file
CMS admin password (WordPress, Joomla, Drupal, etc.)
Domain registrar account

Enable two-factor authentication on every account immediately.

Step 3: Back Up the Compromised Site

Back up the infected version before cleaning — you need it as a reference to identify every compromised file. Store it off-server.

Step 4: Find and Remove Injected Pages

For WordPress:

Check these locations for injected files:

wp-content/uploads/ — attackers often hide PHP files here
wp-content/themes/[your-theme]/ — check for added files
Root directory — look for unfamiliar .php files
Any new subdirectories you didn't create

Delete every file and directory you don't recognize.

Search your database for injected content. In WordPress, check wp_posts for posts with Japanese content, and wp_options for suspicious entries. Use phpMyAdmin or a database scanning plugin.

Step 5: Remove the Backdoor

This is the step most people miss — and why reinfection is so common.

Backdoors are hidden in:

Core CMS files that have been modified
Legitimate-looking plugin files with injected code
The .htaccess file
Database entries
Image directories (PHP files disguised as images)

Look for these common backdoor signatures in PHP files:

eval(base64_decode
exec(
system(
passthru(
shell_exec(
preg_replace.*\/e
assert(

For WordPress, reinstall core files completely:

Download a fresh copy of WordPress from wordpress.org
Replace the wp-admin and wp-includes folders entirely
Replace index.php and other root-level core files
Do not overwrite wp-config.php or wp-content

Step 6: Update and Clean Everything

Update WordPress core, all plugins, and all themes to latest versions
Delete unused plugins and themes — every inactive one is an attack surface
Reinstall active plugins from official sources — don't trust files that were on the compromised server
Review and clean your .htaccess file — remove any rules you didn't add

Step 7: Remove Spam Pages from Google's Index

After cleaning your site, the spam pages may still appear in Google's index for days or weeks. Accelerate removal:

Use Google Search Console → Removals to request urgent removal of specific spam URLs
Submit an updated sitemap to Google Search Console — this helps Google recrawl and reindex your legitimate pages
Use the URL Inspection tool to request indexing of your key pages

Step 8: Request Google Security Review

If Google flagged your site:

Go to Google Search Console → Security Issues
Verify the issues are resolved
Click Request Review
Describe in detail what was found and what steps were taken

Google typically processes security reviews within 1–3 days. Once approved, any Safe Browsing warnings are removed.

How to Prevent the Japanese Keyword Hack

Once you've cleaned the infection, harden your site to prevent recurrence. The attack exploits known, preventable vulnerabilities.

Keep Everything Updated

The majority of successful attacks exploit known vulnerabilities in outdated software. Update your CMS, plugins, and themes immediately when updates are released. Enable automatic updates for security releases.

Use Strong, Unique Credentials

Weak admin passwords are one of the most common entry points. Use a password manager to generate and store strong, unique passwords for every account. Enable 2FA on your hosting panel, domain registrar, and CMS admin.

Implement a Web Application Firewall

A WAF blocks malicious traffic before it reaches your server — including the automated scanning tools attackers use to probe for vulnerabilities. Cloudflare (free tier) and Wordfence (WordPress) are the most widely used options.

Monitor File Integrity

File integrity monitoring alerts you when core files are modified unexpectedly — a key early warning sign of compromise. Wordfence includes this for WordPress. Server-level tools like AIDE work across any platform.

Audit Admin Accounts Regularly

Check your CMS user list periodically. Remove any accounts you don't recognize immediately. Restrict admin access to only the people who genuinely need it.

Secure Your Hosting Environment

Shared hosting environments carry inherent risks — a compromised neighboring site can sometimes affect yours. If you're running a business-critical website, consider upgrading to a managed web hosting solution that includes server-level malware scanning, automatic backups, and proactive security monitoring.

Schedule Regular Backups

Daily automated backups stored off-server give you a clean restore point if you're ever compromised. Test your backups periodically — a backup you've never restored is an untested backup.

The SEO Damage and How to Recover It

The Japanese Keyword Hack doesn't just compromise your security — it actively damages your SEO performance. The specific impacts:

Diluted domain authority — thousands of spam pages competing under your domain weaken topical relevance signals
Manual penalty risk — Google may apply a manual spam action to your domain if the hack goes undetected long enough
Index contamination — spam pages remain in Google's index even after you delete them, unless actively removed
Lost rankings — legitimate pages may drop in rankings as the domain becomes associated with spam signals

Full SEO recovery after a serious hack can take weeks to months. The faster you detect and clean it, the less damage compounds. For sites that have suffered significant ranking drops due to an attack, a structured SEO recovery strategy is often necessary to restore pre-hack performance.

If your business relies heavily on organic search traffic and you've experienced a significant hack, a technical SEO and security consultation can accelerate recovery and implement the hardening measures needed to prevent recurrence.

Frequently Asked Questions

How do I know if the Japanese keyword hack is affecting my site if my homepage looks normal? The attack is specifically designed to be invisible to site owners browsing directly. Search site:yourwebsite.com on Google and look for pages with Japanese text or unfamiliar content. Also check Google Search Console's Coverage report for URLs you don't recognize.

Will cleaning the infected files stop the reinfection? Not always. If you remove injected pages without finding and removing the backdoor, attackers can reinfect your site within hours. Backdoor removal is the most critical — and most commonly skipped — step in the recovery process.

Can the Japanese keyword hack affect non-WordPress sites? Yes. While WordPress is the most common target due to its market share, the attack affects Joomla, Drupal, Magento, and any other CMS or custom-built site with exploitable vulnerabilities.

How long does it take for spam pages to disappear from Google after cleanup? Without active removal requests, it can take weeks. Using Google Search Console's URL Removal tool for specific spam URLs and submitting an updated sitemap significantly accelerates the process. Most sites see cleanup in Google's index within 1–2 weeks of active removal requests.

Will my search rankings recover after fixing the hack? In most cases, yes — provided the hack is fully cleaned and the backdoor is removed. Rankings typically recover over 4–12 weeks as Google recrawls and reindexes your legitimate pages. Sites that received a manual penalty from Google may take longer and require a formal reconsideration request.

Should I hire a professional to clean a Japanese keyword hack? For straightforward infections on small sites, a methodical DIY approach following this guide is viable. For sites with extensive infections, persistent reinfection, or significant business impact from downtime, professional malware removal services like Sucuri or Wordfence Care offer guaranteed cleanup with faster turnaround and ongoing monitoring.

Japanese Keyword Hack: How to Detect, Fix and Prevent It