You search for your business on Google and something is off. Under your domain name are listings you have never seen: page titles in Japanese, product names for cheap designer bags, or drug names. You click one and land on your normal home page. You log in to WordPress and there is no sign of these pages anywhere.
That gap, between what Google shows and what you can see, is the signature of an SEO spam infection. The Japanese keyword hack is the best-known version, but the cleanup is much the same for all of them.
What the Japanese keyword hack is
An attacker gets into the site and installs a script that generates spam pages on demand. Each page is stuffed with Japanese text and links, usually promoting counterfeit goods or other shady shops. The pages are not normal WordPress posts. They are usually produced by a PHP file the attacker uploaded, so they do not appear in your Posts or Pages screens at all.
The point is to borrow your site’s reputation in Google. Your domain is trusted, so pages on it can rank, and the attacker uses them to send search traffic to their own sites.
Most of these infections use cloaking. The script checks who is asking for the page. Googlebot gets the spam. A normal visitor, or the site owner, gets the real site or a redirect. This is why the infection can sit there for a long time before anyone notices.
A common extra step in this hack is that the attacker verifies themselves as an owner of your property in Google Search Console. From there they can submit their own sitemaps full of spam URLs, which gets the pages indexed faster.
The pharma hack and other relatives
The Japanese keyword hack is one member of a larger family. The pharma hack injects names of prescription drugs into your page titles, descriptions or content, often only when the visitor is a search engine. Casino and gambling spam, essay-writing spam, and fake shop pages work the same way. Some create thousands of new pages. Others quietly add hidden links to pages that already exist.
This is different from comment spam, where bots post junk in your comment section and you can see it in the dashboard. If that is your problem, how to stop WordPress comment spam covers it. SEO spam lives in your files or database and is deliberately hidden from you.
How to spot it
Search Google for your own site
Type site:yourdomain.com into Google, using your real domain. Scroll through several pages of results. Then try adding a likely spam word after it, such as a drug name, “casino” or a luxury brand. Japanese titles, products you do not sell, or URLs with long random strings are clear signs.
Check Search Console
- Settings, then Users and permissions. Look for owners or users you do not recognise. An unknown owner is a strong sign of this specific hack.
- Sitemaps. Look for sitemaps you did not submit.
- Pages (the indexing report). A sudden jump in the number of indexed or discovered pages, with no new content from you, is a warning sign. Look at the example URLs.
- Performance. Search queries in Japanese, or for products you do not sell, show what Google thinks your site is about.
- Security issues. Google may already have flagged hacked content here, with sample URLs.
See what Google sees
Take one of the spam URLs and run it through the URL Inspection tool in Search Console using the live test. Because Googlebot is doing the fetching, cloaked spam often shows up here even when your own browser shows nothing.
Check WordPress itself
Look for administrator accounts you did not create, plugins you did not install, and recently modified files, especially PHP files in the root folder, in uploads, or in folders with random names.
Cleaning the infection
The site needs a proper malware cleanup first. Removing spam URLs from Google is pointless while the script that creates them is still running. Our guide to fixing a hacked WordPress website walks through the full process. For SEO spam, pay particular attention to these.
- Remove unknown owners from Search Console, and also remove their verification method, such as an HTML verification file in your root folder or a meta tag. If the token stays, they can verify themselves again.
- Find the generator. Look for PHP files that do not belong to WordPress core or to any plugin or theme you use, and check .htaccess for rewrite rules that send unknown URLs to a strange file.
- Check the database for injected titles, hidden links, and spam in posts and options, which is where the pharma hack often lives.
- Replace core, plugins and themes with fresh copies, change all passwords, and update everything so the way in is closed.
Spam redirects often come along with this. If visitors are also being sent to other sites, read WordPress site redirecting to spam sites as well.
Getting the spam URLs out of Google
Once the site is clean, the spam pages are still in Google’s index. They drop out as Google recrawls them and finds them gone. You can help that along.
Make the spam URLs return 404 or 410
When Google requests a spam URL, your server should answer that the page does not exist. A 404 means “not found”. A 410 means “gone”, and is a slightly clearer signal that the page will not come back. Either works. Check a few spam URLs with a redirect or header checker to confirm what your server actually returns now.
Do not redirect all the spam URLs to your home page. Google tends to treat that as a soft 404, and it can keep the spam URLs around longer. Do not block them in robots.txt either. If Google cannot crawl them, it cannot see that they are gone, and they can stay in the index.
Clean up your sitemaps
Delete any sitemaps the attacker submitted, and make sure the sitemap your SEO plugin produces, whether Yoast, Rank Math or another, lists only your real pages. Then resubmit it in Search Console so Google has an accurate picture of the site.
Use the Removals tool for the worst ones
The Removals tool in Search Console can hide specific URLs, or everything under a URL prefix, from Google Search results. It is temporary and does not delete anything from the index permanently, so use it alongside the 404 or 410 responses, not instead of them. It is most useful for a handful of embarrassing results that show up when people search for your business name.
Request a review if Google flagged the site
If the Security issues report lists a problem, request a review there once you are sure the cleanup is complete, explaining what you found and fixed.
Expect this part to take time. On a site with many spam pages, old URLs can keep appearing in results for a while after the site is clean. Watch the Pages report and your site: search results. If new spam URLs appear after the cleanup, the generator is still somewhere on the server.
If you want help
SEO spam is hard to clear completely because it is built to stay out of your sight. If you would rather hand it over, our WordPress malware removal service removes the infection and the backdoors behind it and handles the Google review. A standard cleanup is a flat ₹2,999. Badly damaged or repeatedly reinfected sites are reviewed first and quoted before we start.
For a cleanup done for you, see our SEO spam cleanup service, and once the site is clean, how we remove hacked pages from Google.
Next in this series: Website Firewalls (WAF) Explained for Small Businesses
