Security
The Japanese keyword hack: why your site is selling handbags in Google
6 September 2026 · 7 min read
On this page
You search your own domain and find hundreds of pages in Japanese, selling branded handbags, watches or sportswear. Your WordPress admin shows nothing unusual. Your homepage is fine.
This is the Japanese keyword hack, sometimes called Japanese SEO spam, and it is one of the most common WordPress compromises. It is also one of the most damaging, because it directly targets the thing you are least able to see — your search presence.
What it actually does
The attacker is not interested in your visitors. They are using your domain's reputation to rank spam pages in Google.
The injected code generates pages on the fly. They exist only when Googlebot asks for them, which is why they never appear in your Pages list and why your site looks entirely normal to you. Often the attacker also adds themselves to your Search Console property, so they can monitor the results and submit sitemaps of their own.
Typical signs:
site:yourdomain.comreturns pages in Japanese you never created- Search Console shows a spike in indexed pages
- Search Console shows queries in Japanese getting impressions
- Google may show "This site may be hacked" under your listing
- A new sitemap appears that you did not submit
Why it is hard to find
Three reasons this one frustrates people more than most.
It is conditional. Content is served to Googlebot and not to ordinary visitors, so browsing your own site tells you nothing. You have to fetch the page as Google to see it.
It hides outside WordPress. The payload is frequently in a PHP file above the WordPress directory or buried in uploads, not in a theme file where people look first.
It reinstalls itself. Almost every instance we see includes a scheduled task or a modified core file whose job is to restore the payload. Clean the visible spam without finding that, and it is back within days.
How to confirm it
- Search
site:yourdomain.comand page through the results - Use the URL Inspection tool in Search Console on one of the spam URLs, and choose "Test live URL" — this fetches as Googlebot and shows what Google actually sees
- Check Search Console users under Settings → Users and permissions, and remove anyone you do not recognise
- Check for unfamiliar sitemaps under Indexing → Sitemaps
That third step matters more than it sounds. If the attacker still has Search Console access, they will keep resubmitting spam sitemaps after you clean the site.
Removing it
The mechanics are the same as any injection, with two additions specific to this one.
The standard part: replace core, plugins and themes with clean copies; delete every PHP file from uploads; clean the database; remove unknown admin users; rotate all credentials including the salts.
The specific parts:
Find the reinfection mechanism. Check WordPress scheduled tasks (WP Crontrol makes this readable) for jobs you did not create. Check for PHP files sitting above the WordPress folder, where most people never look.
Deal with Search Console. Remove any unknown users, delete sitemaps you did not submit, and then use the Removals tool to temporarily hide the worst spam URLs while Google re-crawls.
Do not simply block the spam URLs in robots.txt. That stops Google re-crawling them, which means it never learns they are gone, and they stay in the index far longer.
Cleaning up the search results
The site being clean is only half of it. The spam pages are still indexed.
- Make sure the spam URLs return a genuine 404 or 410, not a soft redirect to your homepage
- Use Removals in Search Console for the highest-volume offenders
- Request a security review if Google flagged the site
- Then wait. De-indexing takes weeks, and there is no way to accelerate it beyond the above
Rankings for your real pages usually recover within a month or two, provided the site stays clean.
Why it happened
Essentially always an outdated plugin with a published vulnerability. This particular hack is automated at scale — bots scan for known-vulnerable versions and inject without anyone choosing your site specifically.
Which means the prevention is unglamorous and completely effective: update weekly, delete what you do not use, and watch for disclosed vulnerabilities in the plugins you run. That is what a care plan does, and our free plugin will tell you today whether anything you have installed is currently vulnerable.
If it is already indexed and you want it gone, our cleanup is $249 and includes the Search Console work, which is the part that determines how quickly your search results recover.