Japanese Keyword Hack: Why Google Is Showing Japanese Characters for Your Site

The Japanese keyword hack, also called Japanese SEO spam, is malware that generates thousands of Japanese-language pages on your website and gets them indexed by Google. The pages usually advertise counterfeit goods — fake luxury brands, watches, sneakers — and exist purely to capture search traffic. Your site becomes a doorway for someone else’s business.

The attacker isn’t selling anything from your domain. They’re borrowing your domain’s credibility to rank pages that would never rank on their own.

The spam pages typically sit in randomly named subdirectories — something like /wp-content/cache/, /news/2025/12/, or a folder of gibberish characters. You’d never find them by browsing your site because nothing links to them from your actual pages.

It’s not a rare or exotic infection either. In Sucuri’s threat data, Japanese SEO spam was the most detected and most frequently remediated malware type, found on just over 10% of all infected websites.

Why Is Google Showing Japanese Characters for My Website?

Because your site is serving Japanese spam pages to Googlebot while serving normal pages to you. The malware uses cloaking — it checks who’s requesting the page and responds differently depending on the answer.

This is the single most confusing part of the whole thing, so it’s worth being precise about what’s happening.

When Googlebot visits, the malware serves an auto-generated page full of Japanese text and affiliate links. Google indexes it. When you visit the same URL in your browser, the malware serves a 404, or nothing at all.

Both responses come from your server. Both are real. You’re just not the audience.

This is the same mechanism behind redirect malware that hides from logged-in admins — different payload, identical trick.

The part that traps people: there’s often no warning

Here’s what makes this infection so persistent. Most of the time, you will not see anything in the Security Issues section of Google Search Console.

Think about what that means in practice. You see Japanese pages in the search results, you check the official tool that’s supposed to tell you if you’ve been hacked, it says nothing, and you conclude the search results are wrong.

They’re not. Google indexing spam pages on your domain and Google flagging your domain as hacked are two separate processes. You can absolutely have the first without the second.

If you see Japanese pages under site:yourdomain.com, that’s your confirmation. You don’t need a Search Console warning to believe it.

How to Confirm You’re Infected

Five checks, in order of speed.

1. Run a site search. Search Google for site:yourdomain.com and page through the results. Japanese titles, counterfeit brand names, or URLs you don’t recognize are conclusive.

2. Check your indexed page count. In Search Console, open Indexing → Pages. If a 40-page site is showing 4,000 indexed URLs, those extra 3,960 came from somewhere.

3. Look at your sitemaps. In Search Console → Sitemaps, look for sitemap files you never submitted. Attackers generate their own sitemaps to get spam pages indexed faster. Common names look legitimate on purpose — sitemap1.xml, sitemap_index.xml, and similar.

4. Check Search Console property owners. Settings → Users and permissions. Attackers add themselves as verified owners of your property. This is how they monitor whether their spam is still ranking, and it’s how they keep a foothold after you think you’ve cleaned up.

Almost nobody checks this. Do it now, even if you’re not infected.

5. Check your WordPress users. Users → All Users, filtered to Administrator. Any account you didn’t create is a problem.

Where the Infection Came From

Same entry points as every other WordPress compromise: an outdated plugin, an abandoned plugin, a nulled theme, or weak credentials.

Page-builder add-ons have been a leading entry vector for Japanese SEO spam in recent years, along with form plugins and shortcode-injector plugins. If you’re running Elementor extensions or WPBakery add-ons from small developers, those are worth auditing first.

Worth understanding: the Japanese keyword hack, the pharma hack, casino spam, and generic SEO spam are all the same attack wearing different clothes. Same entry points, same cloaking, same cleanup. The only difference is which keywords the attacker wants to rank for.

Which means fixing the symptom without fixing the entry point gets you a different flavor of the same infection next month.

How to Remove the Japanese Keyword Hack

This is a two-part job, and skipping the second part is why people say it “came back.”

Part one is cleaning your site. Part two is cleaning Google’s index. Your site can be spotless while Google still shows thousands of spam URLs, because Google doesn’t know they’re gone until it crawls them again.

Part one: clean the site

1. Take a full backup first, files and database, even infected. You need a rollback point.
2. Remove unauthorized Search Console owners. Do this early — otherwise the attacker watches your entire cleanup.
3. Delete the fake sitemaps from your root directory and any subfolders, then remove them in Search Console.
4. Replace WordPress core with a fresh download from wordpress.org. Everything except wp-content and wp-config.php.
5. Delete and reinstall every plugin and theme from official sources. Don’t clean in place. Don’t reinstall anything nulled.
6. Hunt for backdoors. PHP files in wp-content/uploads/, unfamiliar files in mu-plugins, anything with a harmless-sounding name in a folder that shouldn’t contain code.
7. Check .htaccess and wp-config.php for injected rules and code.
8. Clean the database. Look at wp_options for oversized encoded entries, wp_posts for spam content, and wp_users for accounts you didn’t create.
9. Delete the spam directories the pages were served from.
10. Rotate every credential. WordPress admins, database, hosting panel, SFTP, and the salts in wp-config.php.
11. Update everything and remove what you don’t use.

Part two: clean the index

This is the part most guides rush, and it’s where the lasting damage lives.

Return 410 for the spam URLs. Not 404 — 410. Both work, but 410 means “gone permanently” and Google acts on it faster than 404, which only means “not found right now.”

Most spam URLs follow patterns, so you can handle them in bulk with an .htaccess rule matching the directory or file extension rather than listing thousands of URLs individually.

Do not block the spam URLs in robots.txt. This is the most common mistake in Japanese keyword hack recovery, and it actively works against you.

Here’s the logic, because it’s counterintuitive: Google has to crawl a URL to see the 410 and drop it from the index. Block it in robots.txt and Google can’t crawl it, so it never learns the page is gone, so the spam URL sits in the index indefinitely. You’ve locked the door on the cleanup crew.

Do not redirect them to your homepage either. That tells Google the pages moved rather than died, and it hands your homepage a pile of spam signals.

Submit a clean sitemap. Replace the deleted spam sitemaps with your real one and resubmit it in Search Console.

Use the Removals tool for the worst offenders. Search Console → Removals hides URLs from search results within about a day. Understand the limit: this is temporary, roughly six months. It buys you breathing room while the 410s do the actual work. It is not a fix on its own.

Request indexing for your real pages. URL Inspection → Request indexing on your important pages nudges Google to recrawl your domain generally, which speeds everything up.

Request a review if you did get flagged. Search Console → Security Issues → Request Review. Explain what was wrong, what you did, and the outcome.