How to Fix the Japanese Keyword Hack and Clean Up Google Results

Japanese titles in Google for pages you never wrote usually mean one thing: your site has what Google calls the Japanese keyword hack. An attacker has added pages of auto-generated Japanese text to your site. Those pages sell fake brand goods through affiliate links, and Google shows them under your domain.

Fix it in this order: confirm the hack, contain it, remove the spam pages and the backdoor, close the way in, then tell Google. Spam URLs need a 404 or 410, your sitemap needs cleaning, and a flagged site needs a review request. Expect the results to take weeks to clear, not days.

I have fixed more than 20 hacked sites, most of them on WordPress. The plan below follows Google’s own guides for hacked sites, with notes on the entry points I see most often.

How to tell if you have the Japanese keyword hack

Google’s guide, Fix the Japanese keyword hack, describes “a type of hack that creates autogenerated Japanese text on your site”. The pages sit in random folders, such as ltjmnjp/341.html in Google’s example. They “are monetized using affiliate links to stores selling fake brand merchandise and then shown in Google Search.”

Google’s spam policies treat this as hacked content: “any content placed on a site without permission, due to vulnerabilities in a site’s security.” You are the victim, but the spam still sits on your domain. Check for these signs:

• A site: search shows Japanese results. Search Google for site:yourdomain.com and click through several pages. A site: search is one of the first checks I run on any audit.
• The Security Issues report lists a problem. New spam pages match Google’s “Hacked: URL injection” label. Google defines it as: “A hacker has created new pages on your site, often containing spammy words or links.”
• The Performance report shows strange queries or pages. Look in the Queries and Pages tabs for Japanese text or folders you do not recognize.
• Search Console has an owner you do not know. Google’s help is blunt: “If you’ve found an owner that you don’t recognize, you might have been hacked.”
• A sitemap you did not create. Google notes that “Hackers often modify your sitemap or add new sitemaps to get their URLs indexed more quickly.”
• “This site may be hacked” appears under your results. Google shows this label “when we believe a hacker might have changed some of the existing pages on the site or added new spam pages.”

Why the spam pages look fine when you open them

This hack often uses cloaking: Google gets the spam, while you get your normal page or a “not found” message. Google’s spam policies say this is “not uncommon”, used “to make the hack harder for the site owner to detect.”

So do not trust your browser. Paste a spam URL into the URL Inspection tool instead, which shows the page as Google sees it. Open “View crawled page” to read the HTML Google got on its last crawl.

The URLs in the Security Issues report are only examples. Google calls the list “just a sample of pages on your site affected by the selected issue.” Your site: search and the Performance report fill in the rest.

Step 1: Contain the hack before you clean anything

Cleaning while the attacker still has access is wasted work. Take a copy first, then shut every door you know about.

1. Back up the infected site. Copy all files and the database as they are. Google’s guide says, “Better yet, back up your entire site before you start the cleanup process.” The copy shows what changed and gives you a fallback.
2. Tell your hosting company. WordPress.org’s hacked-site FAQ warns that the hack may have spread beyond your site, especially on shared hosting.
3. Change every password. That means the hosting panel, FTP or SFTP, the database and every admin account. On WordPress, also generate new secret keys in wp-config.php to log everyone out.
4. Scan the computers your admins use. Google and WordPress.org both say to, because a stolen login can start on the admin’s own computer.
5. Delete user accounts you did not create, in the CMS, the hosting panel and on the server.

Google’s quarantine guide goes further. It suggests taking the site offline, or pointing DNS to a static 503 page on another server. If the hack is redirecting visitors or serving malware, take that advice.

Remove unknown owners from Search Console

Google’s guide says the hacker “will typically add themselves as a property owner in Search Console”. Open Settings, then Users and permissions, and remove anyone you do not recognize. Only property owners can see this page.

Removing the person is not enough. Google’s help on owners warns: “If you do not delete these tokens, the removed owner will be able to re-verify ownership if they choose to.” Delete their verification file or meta tag from your site.

Some hacks fake the token instead. If you find no token file, Google’s guide says to check .htaccess for a rewrite rule. Look for one that sends google*.html requests to a PHP file. Then open a made-up token URL, such as /google1234.html. If it returns a 404, the fake token is likely gone.

Step 2: Find and remove the spam pages and the backdoor

The spam pages are only the visible part. The backdoor is a hidden script that lets the attacker back in. If you delete the pages but miss it, the attacker can rebuild them.

Restore a clean backup, if you have one

Google’s clean-up guide starts here: “First, check that your backup was created before your site was hacked.” If it is clean and recent, restore it. If it is clean but old, restore it and carry over only content you know is clean. Either way, you still have to close the way in.

Or clean the site by hand

Without a clean backup, you work through the site file by file. These are the places Google and WordPress.org point to:

Outside scanners can help you find leftovers. Google’s guide lists VirusTotal, Sucuri SiteCheck and Quttera, but says it runs or supports only VirusTotal. Treat a clean scan as one piece of evidence, not proof.

When you think you are done, run the spam URLs through URL Inspection’s live test again. Each one should now return a 404 or 410.

Step 3: Close the way in

If you clean the site but leave the way in open, the attacker can simply come back. Most of the 20+ hacked sites I have fixed were WordPress. These are the entry points I see most often:

• Outdated plugins and themes. Google’s list of top ways sites get hacked agrees: “outdated or unpatched themes and plugins are a major source of vulnerabilities.”
• Weak passwords and brute-force attacks, where attackers keep guessing until one works.
• Bad browser extensions installed in Chrome on the computer someone uses to log in. Google’s vulnerability guide warns that on an infected admin computer, “the hacker might have installed spyware to record the site admin’s keystrokes.”
• Nulled plugins and themes, meaning pirated copies of paid ones. Delete them and use licensed or free versions from official sources.

Your server logs can show how and when the attacker got in. Google suggests looking for “multiple login attempts for an administrator.” Note the date, because it tells you which backups might still be clean.

Then install every available update and remove software you no longer use. Last, change all the passwords one more time, once the site is clean. On my own site, on 28 October 2026, I restricted the public users endpoint that listed usernames and turned off XML-RPC. I also deleted an unused theme and an unused plugin. My WordPress security checklist covers the full list in priority order.

Step 4: Tell Google the site is clean

Start this step only once the site is clean and the way in is closed. Then work through it in order:

1. Make every spam URL return 404 or 410. Google’s HTTP status code guide treats them the same, and says indexed URLs that return a 4xx “are removed from the index.” Do not redirect them to your homepage. Google needs to see that they are gone.
2. Do not block the spam URLs in robots.txt. Google’s Removals help says, “Do not use robots.txt as a blocking mechanism.” If Google cannot crawl a URL, it cannot see the 404.
3. Clean up your sitemaps. Delete the hacker’s sitemap files from the server, and remove them in the Sitemaps report. Removing them from the report alone is not enough: “Google won’t forget the sitemap or any URLs listed in it.” Then submit a clean sitemap of your real pages.
4. Use the Removals tool for the worst spam URLs. Google’s Removals help says you can “block any new URLs that the hacker created”. If the spam sits in one folder, “Remove all URLs with this prefix” covers it. A block lasts about six months, and the URLs still need their 404.
5. Request a review, if Search Console flagged the site. In the Security Issues report, select Request Review. Explain the problem, the steps you took and the result. Google’s review guide asks for “a brief explanation of how the site was cleaned” for each type of hacked spam.
6. Ask Google to recrawl your key pages. Use Request indexing in URL Inspection. There is a daily limit, so let the sitemap cover the rest.

Two warnings. Use the Removals tool only for URLs you never want in Google, never for your whole site. And be sure before you ask for a review. A premature request “will only prolong the period of time that your site is flagged as dangerous”.

How long until Google’s results are clean

Google gives no single date for a hacked site. It gives a timing for each step, and together they add up to weeks. Here is what Google says:

A large batch of spam URLs will not all be recrawled at once. Some can keep showing in a site: search after the site is clean, which is what the Removals tool is for. My guide to how Google crawls and indexes explains why some URLs get revisited sooner than others.

Track progress every week. Run the same site: search, and watch the “Not found (404)” count in the Page indexing report. The Japanese results should thin out as Google recrawls.

Keep it from coming back

A cleaned site is only safe while someone keeps watching it. Build these checks into a routine:

• Every week: a site: search for your domain, and the Performance report’s Queries tab for Japanese text.
• Every month: the Security Issues report, Search Console messages, and Users and permissions.
• Updates: keep the CMS, themes and plugins current, and delete what you do not use. Google’s guide notes, “Many sites get hacked because they’re running outdated software.”
• Logins: a strong, unique password for every account, and two-step authentication wherever it is offered.
• Backups: stored off the server, with restores tested. Find out how often your host really backs up.

I checked this on my own site in October 2026. The hosting plan only made weekly backups, and manual backups were locked. I am now setting up a daily off-site backup to Google Drive.

Google’s guide also suggests a paid security monitoring service. My website care service covers this routine each month: updates, off-site backups, malware scans and a watch on Search Console.

What to do next

If you see Japanese results for your domain today, start with two checks: a site: search and the Security Issues report. Then change every password and remove unknown Search Console owners before you delete anything.

If the spam is already in Google and your traffic has dropped, my traffic drop and penalty recovery service finds and fixes the search damage. That covers spam pages, injected links and security warnings in Search Console. For cleaning the server itself, I bring in a security specialist.