Japanese keyword hack on WordPress

A Japanese keyword hack means Google is showing Japanese titles, descriptions, or pages on your WordPress site even though you never wrote them. The homepage you browse can look unchanged. The extra pages are usually spam stored in posts, files, or both, so other people find them through your domain.

What you are seeing

Search your site and some results are in Japanese. The titles are not translations of your pages. They are other topics, attached to URLs on your domain. Opening a result may show a Japanese page, a normal page of yours, or a redirect. Logged in, you often see none of this.

You may also find folders you did not create, odd sitemap entries, or a long list of URLs in Search Console that are not in your menu. The pharmacy version and the casino version look the same with different words. Google sometimes adds This site may be hacked under the result. That label is a consequence, not a separate problem.

If you deliberately publish Japanese, with a translation plugin and pages your team wrote, this is not your incident. The sign is content nobody on the team created.

Why it happens

The pages exist because your domain is already crawled. Someone who can change the site adds content Google will index, in a language you do not publish, and hides it from the way you normally look.

The content often lives in the posts table, including items not in any menu. The prefix may not be wp_. It can also be HTML or PHP in a new directory or in wp-content/uploads. A changed functions.php, header.php, footer.php, or a file in wp-content/mu-plugins can show that content to some visitors and skip it for you.

You do not need to learn how the text is hidden. You need pages you did not publish, and files that do not match a clean install. Reused passwords and packages from outside WordPress.org are the usual doors. See how those doors open. Delete the page and leave the loader, and new pages replace it.

How to check if you are affected

Laskyr's scanner below is read-only. It does not log in or edit anything. Doorway pages are sometimes returned only to a search crawler, so a quiet scan is not proof the site is clean.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds

1. Search site:yourdomain.com and read the titles. Logged out, open any URL you do not recognize. If a title is Japanese, you do not need to translate it to know it is not yours.
2. In Search Console, if the property is already verified, look for paths you did not publish. A review is not useful until that list is something you can explain.
3. View source on the homepage and on one odd URL. Look for Japanese you did not write, links to domains you do not own, or a style that hides a block of text.
4. Compare the active theme with a fresh copy. Pay attention to functions.php, header.php, footer.php, and extra PHP files the original package does not contain.
5. In SFTP, look for new directories of HTML and for PHP inside wp-content/uploads. The media folder should not be a second website.
6. In Posts and Pages, sort by date, including drafts. Check Menus and Widgets for links you did not add.

How to fix it yourself

1. Isolate the site if those URLs are still public. Skip any remover you do not already trust.
2. Back up files and the database, and label the archive as containing the spam. Restore an older backup only after passwords change, and only if it predates the Japanese URLs.
3. Delete the spam posts, pages, and files that are not part of a theme you installed. Trash alone, with a changed theme file left in place, is how this returns.
4. Replace core from wordpress.org: wp-admin, wp-includes, and root files such as index.php and wp-login.php. Keep wp-config.php. Do not delete wp-content.
5. Remove unknown administrators. Ask a developer or the host before removing an account they still use.
6. Replace the theme and each plugin from a clean copy. Delete packages that were never yours.
7. Reset administrator, SFTP, hosting, and database passwords. Update DB_PASSWORD in wp-config.php. Replace salts using the WordPress salt generator.
8. Remove unexplained PHP from wp-content/uploads and ask the host to disable PHP there. Nginx will not honor .htaccess.

DIY is a bad idea with no backup, if the pages reappear, or if the host has already suspended the account. Afterward, follow how to remove a Google hacked warning. Google does not drop old titles the moment you delete them.

When to get help

Get help if Search Console lists more URLs than you can match to real content, if the Japanese text comes back, or if the theme no longer matches any copy you can download. You do not need to translate the spam. You need to know which files are original.

Emergency Cleanup is a flat $499. The 30-day reinfection guarantee means we clean the site again, or we refund the fee if we cannot clean it. We start only after you confirm you own the site. No timer is attached. Email daniel@daniellasek.com or continue below.

Fix it now — $499 Talk to us by email

FAQ

The site looks normal to me. Why does Google show Japanese pages?

The extra pages are often hidden from a normal visit, or only returned to Google's crawler. Search with site:yourdomain.com and look in Search Console for addresses you did not publish.

Do I need to read Japanese to remove a keyword hack?

No. You are looking for pages, titles, and files you did not create. The language is the clue. You do not have to translate the spam before you remove it.

Will Japanese search results disappear as soon as I delete the pages?

No. Google has to recrawl, and you may need to request a review in Search Console. Cleaning the site and asking Google to look again are separate steps.

Is a Japanese keyword hack the same as a pharma or casino hack?

It is the same kind of problem with different words. Extra pages are added so strangers can find them through your domain. Remove the spam, remove whatever writes it back, and change passwords.