How to Remove the Japanese Keyword Hack from WordPress (2026 Complete Guide)

You’re checking your Google rankings one morning and something is very wrong. Your homepage is fine. Your site loads normally. But in Google Search Console — or when you Google your own domain you see hundreds or thousands of pages in Japanese. Pages you never created. Pages with titles promoting spam content.

Your traffic has dropped off a cliff. And you have no idea how long it’s been happening.

This is the Japanese keyword hack one of the most common and most frustrating WordPress infections we clean up. The good news is that it’s completely fixable. We’ve removed it from over 300 sites. In this guide, I’ll walk you through exactly what we do, step by step.

What Is the Japanese Keyword Hack?

The Japanese keyword hack injects thousands of spam pages into your WordPress site. These pages are optimised for Japanese search terms — typically promoting counterfeit goods, adult content or pharmaceuticals.

Here’s the cruel part: these pages are usually completely invisible to you. When you visit your site normally, everything looks fine. But when Googlebot crawls your site, it sees them. When someone searches Google, they appear in your results.

The hackers are essentially using your domain’s authority to rank spam content in Japan. Your site takes the hit lost rankings, potential blacklisting, and Google flagging your pages as harmful.

How did they get in?

In almost every case we investigate, the entry point is one of four things:

• An outdated plugin with a known vulnerability (especially form plugins, SEO plugins, and file managers)
• A nulled or pirated theme or plugin downloaded from a shady source
• Weak admin credentials that were brute-forced
• A compromised hosting account where another site on shared hosting was infected first

Step 1: Confirm You Actually Have It

Before you start cleaning, confirm the infection. Don’t just rely on what you see in your browser the hack is specifically designed to hide from logged-in users.

Open a new incognito/private browser window and search Google for:

site:yourdomain.com

If the hack is present, you’ll see hundreds of Japanese-language pages in the results. You can also check Google Search Console → Coverage to see if there are pages indexed that you don’t recognise.

Step 2: Take a Complete Backup First

Before touching anything, back up your entire site files and database. Even a hacked backup is valuable. If something goes wrong during cleanup, you can restore and try again.

Use your host’s backup tool or download via FTP. If you can’t access the backend, contact your host most will provide a backup even if your account is suspended.

Step 3: Remove Any Unknown Admin Accounts

Go to WordPress Admin → Users. Look for any admin accounts you don’t recognise. Delete them immediately.

Also check Google Search Console go to Settings → Users and Permissions. Hackers frequently add themselves as Search Console owners so they can manipulate your sitemap and indexing. Remove any accounts you don’t recognise.

Step 4: Scan for Malware

Install and run a malware scanner. We recommend Wordfence for this specific hack because it has strong detection for Japanese keyword spam injections. Run a full scan not just the quick scan.

The scanner will likely find:

• Modified core WordPress files (usually wp-includes or wp-admin files with injected code)
• Unknown PHP files in your uploads directory (a common hiding spot)
• Backdoor files with names like wp-feed.php, wp-tmp.php or random strings
• Modified .htaccess file with redirect rules

Step 5: Clean Infected Files

For each infected file the scanner flags:

Core WordPress files — delete and replace with a clean version from WordPress.org. Don’t try to edit out the malicious code — just replace the whole file.

Plugin or theme files — delete the plugin/theme entirely and reinstall from the official source.

Uploads folder — any PHP file in wp-content/uploads/ should not be there. Legitimate uploaded files are images, PDFs and documents — not PHP scripts. Delete all PHP files from that folder.

Your .htaccess file — download it via FTP and look for any code you didn’t add. A clean WordPress .htaccess should contain only the standard WordPress rewrite rules. If there are redirect rules pointing to Japanese domains remove them.

Step 6: Clean the Database

This hack often stores spam content in your WordPress database, not just the file system. Access your database through phpMyAdmin and look for unknown posts with Japanese titles delete them. Also check the wp_options table for entries with seo_ prefixes or anything obviously injected.

If you’re not comfortable working directly in the database, this is the point where bringing in a professional makes sense. One wrong delete and you can break your site.

Step 7: Update Everything and Harden

Once the malware is removed:

• Update WordPress core to the latest version
• Update every plugin and theme
• Delete any plugins or themes you don’t actively use
• Change your WordPress admin password and database password
• Change your hosting cPanel/FTP password
• Add two-factor authentication to your WordPress admin
• Install a security plugin for ongoing monitoring

Step 8: Request Google Review

Once you’ve cleaned everything, tell Google. Go to:

Google Search Console → Security Issues → Request Review

In your review request, explain what happened, what you removed and what steps you’ve taken to prevent it. Be specific vague requests get rejected or delayed.

Also use the URL Removal tool in Search Console to request removal of the spam pages. This speeds up the process significantly.

Expect the spam pages to disappear from Google within 2–4 weeks after a successful review. Your rankings should start recovering within 4–8 weeks.

Why Does This Keep Coming Back?

If you’ve cleaned this hack before and it came back, there’s almost certainly a backdoor that survived your cleanup. A backdoor is a hidden file that lets hackers re-enter even after you change all your passwords.

Backdoors are often disguised as legitimate WordPress files. They can sit dormant for weeks before reactivating. Finding them all requires a thorough file-by-file inspection which is why many DIY cleanups end in reinfection within days.

Checklist Summary

• ☑ Confirmed hack via Google Search / Search Console
• ☑ Full backup taken
• ☑ Unknown admin accounts removed (WP + Search Console)
• ☑ Full malware scan completed
• ☑ Infected files cleaned / replaced
• ☑ Database cleaned of spam posts
• ☑ All passwords changed
• ☑ WordPress, plugins and themes updated
• ☑ Two-factor authentication added
• ☑ Google review request submitted
• ☑ Spam pages removed via URL Removal tool

Still struggling with the Japanese keyword hack? Get in touch with our team — we’ve removed this exact infection hundreds of times and can have your site clean today. Fixed price, no-fix no-fee.