My Site Shows Japanese Text on Google: How to Clean Up the Japanese Keyword Hack

If searching for your site on Google shows pages with Japanese titles, branded goods or discount offers, your site has been hit by what's called the Japanese keyword hack. The attacker creates fake pages on your site and uses the trust Google has in your domain to rank their spam. Cleanup comes down to four jobs: removing the fake owners the attacker added to Search Console, cleaning out malicious files and the way in, making the spam URLs return 404 or 410, and submitting a clean sitemap to Google.

The sneaky part of this attack is that everything looks normal when you open the site in your own browser. The spam pages are often shown only to Google's crawler. It can run for months without you noticing.

How to tell

• Type site:yourdomain.com into Google. If the results include Japanese titles or URLs made of random letters and numbers (like yourdomain.com/abc123xyz.html), you've been hit.
• Japanese search queries and pages you don't recognise in Search Console's Performance report.
• A sudden jump of hundreds or thousands of indexed pages in Search Console's Pages report.
• A warning in the 'Security issues' report. Google doesn't report every case there, so an empty report isn't a clean bill of health.

First: the fake owners in Search Console

This attack's signature is that the attacker adds themselves as a verified owner of your Search Console property. That lets them submit their own spam sitemaps and even change your settings.

In Search Console, open 'Users and permissions' under Settings. If you see an owner you don't recognise, remove them. But removing them isn't enough; the attacker proved ownership with a verification method, and as long as that method stays in place they can add themselves back.

Use the 'Manage property owners' link to see how they were verified. Usually an HTML file starting with google has been placed in the site's root folder, or a verification tag added to the home page code. Delete that file or tag, then remove the ownership.

Check the Sitemaps section too. If there's a sitemap you didn't submit, delete it.

Find the way in and the malicious files

Deleting spam pages is pointless while the door stays open. The attacker most likely got in through an outdated plugin, a stolen admin password or a file dropped into an upload folder. Check these first:

• The .htaccess file. It's often modified in this attack, with rules that redirect visitors from Google, or Google's crawler, to spam pages. Compare it with a clean copy.
• PHP files that shouldn't be in the root folder or in upload folders like wp-content/uploads. Files with meaningless names or recent modification dates are suspicious.
• On WordPress, the theme's header.php and functions.php files, plus index.php.
• Admin accounts you don't recognise.
• Scheduled tasks (cron) in the hosting panel. Attackers can leave tasks that recreate the files you delete.

On WordPress, reinstalling core files from the official source and deleting and reinstalling themes and plugins is safer than hunting file by file. Change every password (admin, hosting, FTP, database) from a clean device. We cover the general response order in your site got hacked: the first 24 hours.

If you have a clean backup and know when the attack started, restoring is the fastest route. Just remember to close the hole afterwards, or the same attack returns within days.

How to confirm it's clean

Because the spam is shown specifically to Google's crawler, not seeing it in your browser isn't enough. Paste one of the spam URLs into Search Console's URL Inspection tool and choose 'Test live URL'. The tool fetches the page as Google sees it. The result should be 404 or 410.

Test your home page with the same tool. If the screenshot or HTML contains Japanese text or hidden links, the cleanup isn't finished.

Getting the spam pages out of Google

Google's advice is clear: spam URLs should return 404 or 410. Don't redirect them to your home page. A redirect tells Google these URLs are part of your site and have moved.

Then:

• Resubmit a clean sitemap containing only your real pages in Search Console.
• For the most visible spam URLs, request temporary removal with the Removals tool. It hides them for about six months; the permanent exit comes from the 404.
• If the Security issues report has a warning, request a review after cleaning up and briefly describe what you did.

With thousands of spam URLs, it can take weeks for all of them to drop out of the index. Watch the count in the Pages report meanwhile; if it's falling, you're on the right track.

Making sure it doesn't happen again

A site that is cleaned without closing the hole soon becomes a target for the same attack again. Update regularly, delete unused plugins and themes, turn on two-step verification for admin accounts, and use a security tool that alerts you to file changes. The full list of measures is in website security measures.

Cleanup takes care and time; miss one file and the spam comes back. If you're seeing these signs and don't know where to start, write to us. To keep updates and security checks running regularly after the cleanup, have a look at our maintenance and support plan.