You search for your own business and find something strange: pages under your domain, in Japanese, selling branded goods you have never stocked. Thousands of them.
You click one and it looks fine. You check the dashboard and the pages are not there. The Japanese keyword hack is one of the more disorienting compromises precisely because it is invisible from where you are standing.
What it actually is
Despite the name, this is not really about Japan. It is a search-engine spam operation that uses your domain's reputation to rank pages selling counterfeit goods.
Your domain has something the attacker wants: age, trust, and standing with search engines. A brand new spam domain ranks for nothing. Yours has years of credibility behind it.
So they generate thousands of pages under your domain, get them indexed, and collect the traffic. You get none of the revenue and all of the consequences.
Why you cannot see it
The technique is called cloaking. The malicious code checks who is asking before deciding what to serve.
- Googlebot gets the spam page, fully rendered and indexable
- A logged-in administrator gets the normal page
- A visitor arriving from a search result gets the spam page, or a redirect
- Someone typing your address directly gets the normal site
That is why the dashboard looks clean and the site looks fine. You are being deliberately shown the version that keeps you from noticing.
Being invisible to the site owner is not a side effect of this attack. It is the design goal.
How to confirm it
Four checks, all free, none requiring server access.
- Search
site:yourdomain.comin Google. Spam pages appear here even when they are invisible on the site itself. Page through several results — they are often buried - Open Search Console → Performance and look at your search queries. Terms in another language, or for products you do not sell, are conclusive
- Check your indexed page count. A twenty-page site reporting four thousand indexed pages tells you everything
- Use the URL Inspection tool on one of the spam URLs and choose "View crawled page". This shows what Googlebot sees, which is the whole point
That last one is the clincher. It lets you see the cloaked version directly.
Where the code lives
This hack is more thorough than most, which is why partial clean-ups fail so often. Expect to find components in several places:
- Injected files in the web root, often with plausible-looking names
- Modified core files, particularly
index.php - Database entries holding the spam content and templates
- A modified
.htaccesshandling the cloaking rules - A rogue sitemap submitted to Search Console to get the spam indexed faster
- A new administrator account, sometimes with a name resembling a real one
- Multiple backdoors, because the operation depends on retaining access
That sitemap point is worth checking specifically. Attackers often verify themselves as a Search Console owner and submit their own sitemap. If you do not remove that verification, they keep visibility into your search data even after the site is clean.
Removing it
The clean-up follows the standard process, with a few additions specific to this attack. Our guide to removing malware from WordPress covers the core work — replace core files, reinstall themes and plugins from official sources, clean the database, find every backdoor.
On top of that:
- Check Search Console users and owners. Remove any verified owner you do not recognise, and delete verification files or DNS records they added
- Remove rogue sitemaps from the Sitemaps report
- Regenerate
.htaccessfrom scratch rather than editing it - Check for scheduled tasks — WordPress cron entries that regenerate the spam
- Audit administrator accounts carefully, including ones with familiar-looking names
If the spam returns within days, a backdoor or a cron job survived. That is the usual explanation.
Cleaning up the search damage
Removing the code does not remove the thousands of indexed URLs. That part takes longer and needs handling deliberately.
Serve a 410 Gone for the spam URLs where you can — it is processed faster than a 404. Submit a clean sitemap containing only your real pages. Use the Removals tool for anything prominent while permanent removal processes.
Do not redirect spam URLs to your homepage. It reads as manipulation and slows removal down.
Our guide to SEO recovery after a hack covers the full process, and reading the Search Console security report covers verification.
How they got in
Nothing exotic. Almost always an outdated plugin with a published vulnerability, a nulled theme or plugin carrying a backdoor, a weak administrator password, or a compromised neighbouring account on shared hosting.
The scale of the attack makes it feel sophisticated. The entry point rarely is.
What it costs
More than most compromises, because the damage is to your search presence specifically.
Your rankings fall as Google loses confidence in the domain. You may be flagged for hacked content, showing a warning to visitors. Thousands of junk URLs consume crawl budget that should go to your real pages. And recovery takes months rather than days, because the index has to be cleaned as well as the site.
The longer it runs before discovery, the worse each of those gets — which is the entire argument for monitoring.
Catching it earlier
This attack is invisible on the site and highly visible in your search data. That is precisely what monitoring is for.
File integrity checks flag the injected files within hours. Server-side scanning catches the database entries. And a monthly glance at Search Console — indexed page count and search queries — catches it long before a customer does.
Our security monitoring service covers the automated side, with a person reading the alerts.
If you are seeing spam pages now
This one is worth acting on quickly. Every day it runs, more junk gets indexed and the recovery gets longer.
Our WordPress security and error fixing service handles this specific hack regularly — files, database, cron jobs, Search Console clean-up, and the backdoors that make it recur. There is a clean-or-free guarantee.
Send us your web address and we will tell you what Google is currently seeing.
Get Shielded
We build, host, secure and monitor business websites — cleaning up hacks and keeping sites online for clients across the UK, USA, Australia and the UAE.
