Injected PHP generators
Obfuscated files that assemble spam pages on demand — often in the site root, wp-content, or disguised as core files. Deleting spam URLs does nothing while a generator remains.
Guide · Japanese keyword hack
Japanese text in your search results means the Japanese keyword hack.
You search for your own site and Google shows titles and descriptions in Japanese, often advertising counterfeit brand goods — sometimes thousands of pages you never created. The site itself looks untouched. This is the Japanese keyword hack, one of the most common WordPress SEO-spam infections, and it is fully removable — but only when the cleanup covers more than the visible spam pages.
Published Last reviewed
- Symptom
- Japanese titles and pages for your domain in Google results
- Also called
- Japanese SEO spam, Japanese search spam
- Hiding places
- Generated pages, rewrite rules, sitemaps, Search Console access
- Risk
- Ranking collapse, spam indexing, “This site may be hacked” labels
What is happening
Your site is hosting someone else’s spam catalog
The Japanese keyword hack is an SEO-spam campaign. Attackers compromise the site, then use it to publish large volumes of auto-generated pages advertising counterfeit designer goods for Japanese-language searches. Your domain’s reputation is the asset being stolen: its standing in Google is what makes the spam rank.
The pages are usually cloaked. Requests from Googlebot receive the spam content, while normal visitors — and you, the owner — are shown the ordinary site or redirected. That is why the infection is routinely discovered in search results rather than on the site itself.
In many incidents the attacker also verifies themselves as an owner of your property in Google Search Console, using an uploaded verification file or token. That access lets them submit spam sitemaps and influence indexing — and it survives a file cleanup unless it is explicitly revoked.
Confirm it
How to see what Google is being served
- 01
Run the site: search
Search site:yourdomain.com and page through the results. Note spam URLs and take screenshots — the URL patterns tell the cleanup where to look.
- 02
Open Search Console
Check Security Issues, the Pages/indexing report for an unexplained jump, and Sitemaps for submitted files you do not recognize.
- 03
Review Search Console users and owners
Settings → Users and permissions. An owner or user you did not add is part of the attack and must be removed after the token or file that verified them is deleted.
- 04
Inspect a spam URL
Use URL Inspection on one of the spam results to see the crawled content — this confirms cloaking even when the URL shows you a 404 in the browser.
- 05
Preserve, do not delete yet
Keep copies of what you find. The generated pages, rewrite rules, and sitemap files are evidence of how the infection works.
Where it lives
The spam pages are the output, not the infection
Rewrite rules and .htaccess
Rules that route thousands of virtual spam URLs to the generator and cloak by user agent — the pages never exist as files at all.
Database records
Injected options, posts, or encoded content the generator draws on, restored automatically if only the files are cleaned.
Rogue sitemap files
Static or generated sitemap.xml variants that feed spam URLs directly to Google, sometimes registered in Search Console by the attacker.
Attacker Search Console access
A verification file or token that keeps the attacker’s owner access alive through cleanups that only look at malware.
The original entry path
The vulnerable plugin, theme, or stolen credential that admitted the attacker — untouched by any amount of spam deletion.
Fixing it
Cleanup, then de-indexing — in that order
A durable fix removes the generator files, rewrite rules, and database persistence; rebuilds core, plugins, and themes from trusted sources; rotates credentials; revokes the attacker’s Search Console verification; and closes the likely entry path. Only then is it worth dealing with the search results themselves.
The indexed spam clears through recrawling once the URLs genuinely return 404 or 410, and a review request in Search Console handles any active security flag. Expect residual spam results to fade over days to a few weeks — faster when the cleanup was complete, indefinitely when a generator survives and quietly rebuilds the catalog.
Common questions
Common questions about the Japanese keyword hack
Why is the spam in Japanese?
The campaign targets Japanese-language searches for counterfeit brand goods, where compromised foreign domains rank surprisingly well. Your site was chosen for its clean reputation, not its content or audience.
Will my rankings recover?
Usually yes, after a complete cleanup, removal of the spam from the index, and a passed review if the site was flagged. The longer the spam stays indexed, the slower the recovery — which is the argument against slow, partial cleanups.
I deleted the strange files but the Japanese results are still there.
Two possibilities, often both: Google has not yet recrawled the dead URLs, or a surviving generator and rewrite rules are still serving them to Googlebot. Verify with URL Inspection rather than assuming the index is just slow.
Do I need to check Search Console even if I never used it?
Yes — especially then. Attackers routinely verify themselves for properties whose owners have never opened Search Console. Claiming your own property is both a diagnostic step and a way to evict them.