How to Remove the Japanese Keyword Hack from WordPress

If Google shows search results for your website filled with Japanese text, your site has been compromised by SEO spam. Here is the step-by-step process to locate the malicious files, restore your clean WordPress installation, and request a fresh crawl from Google.

Confirming the Japanese keyword hack on your site

The Japanese keyword hack is a form of search engine optimization (SEO) spam. Attackers add code to your site that generates thousands of pages full of auto-generated text and links to foreign store pages selling counterfeit goods. This spam is usually hidden from normal visitors but shown directly to search engine crawlers, a technique known as cloaking.

You will often first notice this problem when your traffic drops or when you search for your brand name on Google and see Japanese text in the snippet descriptions. To confirm whether your site is affected, start by checking Google Search Console.

Log into Google Search Console and navigate to the Pages report under the Index section. Look for a sudden spike in indexed pages, or search the list for unexpected URLs. If you see hundreds or thousands of URLs containing random characters or terms you never published, your site has been indexed with spam.

Next, confirm how your site appears to search engines by fetching a page as Googlebot. You can do this inside Google Search Console using the URL Inspection tool. Enter your homepage URL or an affected page URL, click Inspect , and then view the tested page HTML. If the HTML response contains Japanese text, Japanese titles, or links to external shopping domains that do not appear when you open your site in a normal browser, cloaking is active on your site. For a deeper look at why this happens, read our guide on how Japanese keyword hack cloaking works.

Finding where the spam script runs from

Before you can remove the spam, you must locate the code that generates it. Malware behind this hack usually consists of two parts: a door opener file that intercepts incoming requests, and a generator script that fetches spam content from a remote server.

Check the following places in your WordPress directory structure through your hosting control panel file manager or FTP client:

• Start-up and core root files: Open index.php, wp-config.php, .htaccess, and wp-settings.php in your main website folder. Look for unusual code near the top of these files, particularly lines that use functions like base64_decode, gzinflate, eval, or curl_exec.
• Must-use plugins: Open the folder wp-content/mu-plugins/. Code inside this directory runs automatically on every request without appearing in your main WordPress admin plugin list. If you see files here that you or your developer did not intentionally install, inspect their contents.
• PHP files in the uploads folder: Media uploads should only contain images, documents, and standard media formats. Open wp-content/uploads/ and search for any file ending in .php. Executable scripts placed in uploads are almost always malicious. Learn more about identifying these scripts in our article on PHP files in the WordPress uploads directory.
• Altered core or plugin files: Hackers frequently insert small snippets of code into official core files inside wp-includes/ or existing plugins to ensure the spam regenerates even if you delete a stand-alone malware file. Review our guide on checking WordPress file integrity to see how modified files are identified.

Restoring WordPress core, plugins, and themes from official releases

Attempting to clean individual infected files manually is slow and risks leaving hidden code behind. The safest and fastest way to clean a site is to replace all core, plugin, and theme files with fresh, original files from official sources.

Follow these exact steps to replace your core WordPress files:

1. Download a fresh copy of the official WordPress release from wordpress.org that matches your current installed version.
2. Extract the ZIP archive on your computer. Delete the wp-content folder from the extracted files on your computer so you do not accidentally overwrite your uploads or custom code.
3. Using your FTP client or hosting file manager, delete the existing wp-admin and wp-includes directories on your server.
4. Upload the fresh wp-admin and wp-includes directories from your computer to your server.
5. Replace the root files in your main site directory (such as index.php, wp-login.php, wp-settings.php) with the fresh versions from the official download. Leave your existing wp-config.php file in place.
6. Open your server's .htaccess file and replace its contents with the default WordPress rewrite rules.

Next, clean your plugins and themes. Go to wp-content/plugins/ on your server. Delete each plugin folder and re-download fresh copies directly from the WordPress.org plugin directory or your commercial vendor accounts. Repeat this process for your themes inside wp-content/themes/, ensuring you replace every file with an unmodified original copy.

Securing administrator accounts, passwords, and security keys

Replacing files removes the active malware, but you must also close the entry points that allowed the attacker to upload the files in the first place.

First, log into your WordPress admin dashboard and go to Users. Review every account listed with the Administrator role. If you see accounts you do not recognize, delete them immediately and attribute any content they created to your primary account.

Second, change all passwords associated with the website. This includes:

• All WordPress administrator accounts
• Your hosting control panel login (cPanel, Plesk, or cloud dashboard)
• FTP, SFTP, and SSH user accounts
• Your WordPress database user password

Third, reset your WordPress authentication keys and salts. Open your wp-config.php file and locate the section containing AUTH_KEY, SECURE_AUTH_KEY, and related security definitions. Visit the official WordPress salt generator service at api.wordpress.org/secret-key/1.1/salt/ to generate a brand new set of random keys. Paste these new values over the old ones in wp-config.php and save the file. Changing these keys invalidates all existing logged-in sessions and cookies across the site, forcing anyone currently logged in to re-authenticate.

Requesting Google to recrawl your clean website

Once the malicious files are removed and your core files are restored, the spam pages on your site will return a 404 Not Found HTTP status code. However, search engine indexes may still display the cached Japanese titles and descriptions for several days or weeks until Google re-indexes the site.

To accelerate this recovery process, log into Google Search Console:

1. Use the URL Inspection tool to check your homepage and primary landing pages. Click Request Indexing to prompt Googlebot to fetch the fresh, clean version of your pages.
2. If you have an XML sitemap, regenerate it using your SEO plugin so it only lists valid, active pages. Go to Sitemaps in Search Console and resubmit your main sitemap URL.
3. Monitor the Pages report over the coming weeks. You will see the number of indexed spam pages drop steadily as Google attempts to crawl the old spam URLs and receives 404 responses.

Leave the spam URLs reachable: do not shut them off in .htaccess or robots.txt. Googlebot needs to access those URLs and receive a 404 or 410 response to confirm they are permanently gone and remove them from search results.

How OwnerTrail helps monitor your site for changes

OwnerTrail is a free WordPress plugin available on WordPress.org. It helps site owners stay informed about changes to their website environment before security issues lead to search engine spam.

Every day, OwnerTrail performs essential automated integrity checks:

• It checks WordPress core, plugin, and theme files against the official release of each one to spot unexpected code modifications.
• It reads files that nothing vouches for, looking for the shapes malware takes.
• It reports PHP and other code files located in folders where executable code does not belong, such as the uploads, languages, fonts, upgrade, and backup directories.
• It fetches your own pages as Googlebot to catch SEO spam, cloaking, and the Japanese keyword hack as early as possible.
• It watches who controls each plugin you have installed, flagging changes of ownership, new committers in public SVN commit history, dormant plugins that suddenly release updates, or plugins closed on WordPress.org.

OwnerTrail gives each plugin a trust score from 0 to 100 and can email you immediately when a finding needs your attention. It also features Code Lock, ensuring code on the site can only be modified over FTP unless a site owner explicitly loosens the lock. From version 1.3.6, when a plugin changes hands, its next update is held until the site owner acknowledges the change.

OwnerTrail detects and warns; it is not a firewall. To learn more about its detection capabilities and read detailed research, visit the official OwnerTrail website.

        <p><strong>About OwnerTrail.</strong> A free WordPress plugin that watches who controls every plugin on your site, flags plugins WordPress.org has closed, checks your code against WordPress.org's fingerprints, and fetches your pages as Googlebot to catch spam shown only to search engines. It detects; it is not a firewall. <a href="https://wordpress.org/plugins/ownertrail/">Free on WordPress.org</a>.</p>

Related: The Japanese keyword hack: SEO spam that hides from you and shows itself to Google and A PHP file in your uploads folder is never supposed to be there.