You searched for your own site and Google returned pages of Japanese keyword hack results — listings in Japanese text you never wrote, or spammy pharmaceutical and counterfeit-goods pages living on your domain. It’s disorienting, especially when your actual site looks completely fine. Take a breath. This is a specific, well-documented WordPress compromise, and it has a known cleanup path. This guide explains what the Japanese keyword hack (and its pharma-spam cousin) actually is, how to find and purge the injected pages, and how to get Google to re-crawl a clean site.
What the Japanese keyword hack is
The “Japanese keyword hack” is an SEO-spam attack. Once an attacker gets into your WordPress site, they generate large numbers of auto-created spam pages — often in Japanese, often selling knock-off brand goods, but the same attack shows up as pharmaceutical spam, gambling pages, or other junk in any language. The goal isn’t to deface your site or scare visitors. It’s quieter and, in a way, more parasitic: they hijack your domain’s reputation in Google to rank their spam, and they siphon your search visibility to do it.
That’s why the site “looks fine.” The attack is aimed at Google’s crawler, not at you. These pages usually aren’t linked from your normal menus — they exist only to be indexed. You often won’t know until your listings in search fill up with content that isn’t yours, or Google starts labeling the site. If that label has already appeared, it connects directly to “this site may be hacked” showing under your results.
How to spot the injected pages
A few quick checks confirm it and show you the scale:
- Search
site:yourdomain.comin Google. This lists what Google has indexed for you. If you see hundreds or thousands of pages you didn’t create — Japanese text, pharma keywords, odd URLs — that’s the injection. - Check the Search Console coverage and pages reports. A sudden explosion in indexed pages, or a pile of unfamiliar URLs, is the fingerprint. We cover reading these reports in Search Console “Security issues detected”.
- Look for cloaking. These hacks frequently show one thing to Googlebot and another to normal visitors, so a URL that looks harmless to you in a browser may serve spam to the crawler. Search Console’s URL inspection (“view as Google”) is how you catch that.
How to purge it and get re-crawled clean
1. Back up first, then find the source
Take a full backup of the site as-is before you change anything. Then find where the spam is coming from. The injected pages are generated by malicious code planted on the site — commonly rogue files dropped into the site, entries added to the database, a malicious sitemap the attacker created to feed Google the spam URLs fast, and injected rules in .htaccess (a server settings file) that handle the cloaking.
2. Remove the malware, not just the pages
This is the mistake that traps people: they delete the spam pages from Google and think they’re done, but if the malicious code is still on the site, it simply regenerates them. You have to remove the source. Scan for and delete the rogue files, clean the injected database entries, remove the malicious sitemap, restore tampered WordPress and settings files from clean copies, and — most importantly — find the backdoor the attacker left so they can’t just walk back in and rebuild the whole thing. That last part is the hard, unglamorous work that decides whether the fix holds. The full sequence is in how to fix a hacked WordPress site.
3. Close the hole, then ask Google to re-crawl
Close the way they got in before you tell Google anything is fixed: update WordPress itself, all plugins, and all themes; delete anything unused; reset every password and turn on strong login protection. Then, in Search Console, request a review if a security issue was flagged, and let Google re-crawl the cleaned site. As Google re-crawls, the spam pages fall out of the index and your real pages reclaim their place.
The honest part: Google controls how fast it re-crawls and re-indexes, and no one can promise a timeframe. Because these hacks can inject thousands of pages, clearing them all from the index takes longer than removing a single warning — it’s a gradual cleanup as Google revisits. What you control is making sure the source is gone so the pages don’t come back mid-recrawl and reset your progress.
How SolutionHippo handles this
We’ll be straight about where we fit. This is the situation our managed hosting is built to keep you out of in the first place. Malware and content scanning is part of the care that’s included with every plan — not an upsell, not a separate retainer — so an injection that starts spinning up spam pages tends to get caught and removed early, before it floods your search listings. That’s prevention, not a guarantee: our scanning is designed to catch it before it spreads, backed up well: a strong firewall stops bad traffic early, breached-password login defense keeps stolen logins out, and off-site backups 3 times a day mean even a bad day is just a restore. After any change, we verify the site still looks and works right.
And if your listings are already full of spam pages? That’s work we do for sites we host, so the offer is simple: move your site to us, and we clean it as part of the move and keep it clean. We’ve purged Japanese-keyword and pharma-spam injections, removed the malicious sitemaps and database entries feeding them, found the backdoor that kept regenerating them, and closed the hole the attacker used — then requested the re-crawl so a clean site could reclaim its place in search. We won’t promise a re-index deadline we don’t control, but we will remove the source properly so it doesn’t just grow back.
Watching spam pages take over your Google results right now? Deleting them alone won’t hold. Move your site to us: we clean it as part of the move and keep it clean. Start my move — your move starts as soon as you sign up. We’ll purge the injection at the source, close the door behind it, and request the re-crawl so your real pages come back. Flat pricing at $29.99 a month for a managed site, or starting at $39.99 for a store, with the protection built in — no metering, no surprises.