Threat library
Japanese Keyword Hack
An SEO spam attack that injects Japanese-language pages into a compromised site to hijack search listings. How it works, how to confirm it, and how to clean up.
Published 11 Jun 2026 · Updated 28 Aug 2026 · 4 min read
Short answer
A Japanese keyword hack is an SEO spam attack in which an attacker compromises a website and injects Japanese-language keywords and auto-generated pages into it, so those pages rank in search results and send visitors to unrelated affiliate or counterfeit-goods destinations.
How does the Japanese keyword hack work?
The attack has three stages. First the attacker gains write access, typically through a vulnerable plugin or theme, a reused administrator password, or an exposed upload endpoint. Second they install a generator: a PHP file, a modified template, or a database record that produces thousands of keyword pages on request. Third they make those pages discoverable by adding their own sitemap and, in many cases, by registering themselves as an owner in Google Search Console.
The generated pages use cloaking. When the request looks like a search crawler, the server returns the Japanese spam page. When the request looks like a normal browser — especially one with a logged-in session — it returns the real page or a redirect. That asymmetry is the reason owners often discover the problem from a customer email rather than from their own browsing.
- SEO spam
- The injection or generation of unwanted search-optimised content on a compromised website in order to rank for keywords the site owner never targeted.
- Cloaking
- Serving different content to search engines than to normal visitors, based on user agent, IP address or referrer.
- Doorway page
- A low-value page created only to capture a search query and pass the visitor on to another destination.
What are the common indicators?
- Search results for your domain show Japanese page titles and descriptions.
- Search Console reports a sharp rise in indexed URLs, often in directories that do not exist in your CMS.
- New sitemap files appear at the web root with names you did not create.
- An unfamiliar administrator account exists, frequently with a Gmail-style address.
- Files in the web root have modification timestamps clustered on a single date.
- Traffic from Japan appears in analytics with a bounce rate close to 100%.
- Search Console lists an owner or user you do not recognise.
Who is affected?
Any CMS-driven site can be hit, but the volume sits with WordPress installations that run outdated plugins, and with small business and non-profit sites where nobody owns patching. Sites with strong existing domain authority are actively preferred by operators, because injected pages inherit that authority and rank faster.
How do you detect a Japanese keyword hack?
STEP 01
Run a site: query
Search site:yourdomain.com in Google and page through the results. Japanese titles, or URLs in unfamiliar directories, confirm indexed spam.
STEP 02
Check Search Console coverage and users
Compare indexed page counts against your real page count, then review Settings → Users and permissions for owners you did not add.
STEP 03
Fetch pages as a crawler
Request a suspect URL with a Googlebot user agent and compare the response to a normal browser request. Different bodies mean cloaking.
STEP 04
Look for injected generators
Search the web root for recently modified PHP files, base64-encoded blobs, and sitemap files that your CMS does not own.
STEP 05
Audit accounts and scheduled tasks
List CMS administrators, cron jobs and scheduled events. Attackers use scheduled tasks to reinstate deleted files.
How do you remove it?
STEP 01
Take a forensic copy first
Archive files and database before changing anything. You will need the original timestamps to find the entry point.
STEP 02
Remove the injected content
Delete generator files, spam database rows, rogue sitemaps and modified template code. Restore core CMS files from official releases rather than editing them.
STEP 03
Close the entry point
Patch or remove the vulnerable plugin, theme or library. If you cannot identify it, rebuild from a known-good source rather than guessing.
STEP 04
Rotate every credential
CMS administrators, database users, hosting panel, SFTP and API keys. Remove unrecognised Search Console owners.
STEP 05
Clean up search
Return 404 or 410 for removed URLs, resubmit your real sitemap, and use the removals tool for the most visible spam URLs. Do not redirect spam URLs to your homepage.
STEP 06
Monitor for reinfection
Re-check indexed pages and file integrity weekly for at least a month. Reinfection within days usually means a backdoor was missed.
How do you prevent it?
- Patch CMS core, plugins and themes on a schedule, and remove anything you no longer use.
- Enforce multi-factor authentication on all administrative accounts.
- Make file writes to the web root the exception, not the default.
- Keep off-site backups you have actually tested restoring.
- Monitor indexed page counts — an unexplained jump is an early warning.
Sources
- Fixing hacked sites: hacked with spam — Google Search Central
- Spam policies for Google web search — Google Search Central
Prefer summary updates? Subscribe to the newsletter.