Japanese keyword hack on WordPress: how to remove it from Google

What it looks like

Search Google for site:yourdomain.com. If you are affected, you will see results with Japanese titles at addresses that do not exist on your site, often in folders with random names. When you click, one of three things can happen: you see a fake store page, you get redirected to another site, or you see your normal site.

Seeing your normal site means nothing. This hack usually relies on cloaking: it shows the spam to Google and your content to everyone else, so the owner takes longer to notice. To see what Google sees, use URL Inspection in Search Console with one of those addresses and click Test Live URL. You can also request the page as if you were Googlebot:

curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://yourdomain.com/suspicious-path/ | head -50

Other signs:

• Search Console shows a security issue for hacked content, or a sudden jump in indexed pages.
• A new owner appears in Search Console that you did not add. Attackers verify themselves as owners so they can submit their own sitemaps.
• Google verification files (google…html) in the root that are not yours.
• A sitemap you do not recognize in Search Console or in the site's root.

Why it happened to you

The pages are generated by a script the attacker has installed on your site, usually after getting in through an outdated plugin or theme or with a stolen password. The business model is to borrow your domain's authority in Google to rank counterfeit stores. Your site is not the target: it is the tool. That is why these hacks are usually automated and hit thousands of sites at once.

Cleaning the site

The order Google's guide suggests for this hack, with what I add for WordPress:

1. Make a full copy of the files and the database as they are, before deleting anything.
2. Remove unknown owners from Search Console (Settings → Users and permissions) and delete their verification files from the root. Otherwise the attacker can keep submitting sitemaps.
3. Check .htaccess: attackers use it to serve the spam pages and to redirect. If you have no custom rules, replace it with the WordPress default. Check the .htaccess files in subfolders too.
4. Reinstall core, plugins and theme from their official sources, so any modified file is replaced. With WP-CLI, wp core verify-checksums tells you which core files do not match.
5. Look for the rest: PHP files with obfuscated code (long meaningless strings, base64_decode, eval), recently modified files, PHP inside wp-content/uploads/, administrator users you do not know and strange scheduled tasks. Google names index.php and wp-load.php as files that are commonly modified.
6. Check the database: sometimes the spam pages are stored as posts or as options in wp_options.
7. Close the way in: update everything, remove plugins you do not use, change every password and regenerate the keys in wp-config.php.

To know you are done, open the spam URLs again: they must return 404 (not found) or 410 (gone). If any still responds with content, something was left behind. Do not redirect them to the home page: Google needs to see that those pages no longer exist.

A simplified example of the kind of rules I usually find in the .htaccess of a site with this hack: rules that send any nonexistent address to an attacker's script, which generates the spam page on the fly. That is why there are thousands of URLs and no file for each one:

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([a-z0-9]+)/(.*)$ wp-content/uploads/2023/05/cache.php?id=$1&p=$2 [L]

It looks a lot like the normal WordPress rules, and that is the point. The difference is the destination: WordPress always sends to index.php, never to a PHP file inside uploads. The name and path of the script change from case to case.

Cleaning Google (Search Console)

1. Request a review if there is a warning

If Security & Manual Actions → Security issues shows hacked content, request a review with Request Review once the site is clean, explaining what was there, what you did and how you closed the way in. Google says security reviews take from a few days to a few weeks. The full process is in Google says my site is dangerous.

2. Clean up the sitemaps

Under Sitemaps, remove any you did not submit yourself and submit yours again (in WordPress it is usually /wp-sitemap.xml or the one from your SEO plugin). That way Google crawls your real pages sooner.

3. Hide the urgent ones with Removals

The Removals tool hides URLs from the results temporarily, for about six months. It is useful to quickly remove the most visible results (for example, the prefix of a whole spam folder), but it does not delete them from the index: what makes them go away for good is that they return 404 or 410. That is why there is no point in using it before cleaning.

Do not block the spam URLs in robots.txt: if Google cannot crawl them, it cannot see that they no longer exist, and they may stay in the index longer.

4. Be patient with the rest

The pages you have not removed by hand will drop out as Google crawls them again and finds the 404. On a site with thousands of spam URLs, that can take weeks or months. Watch the progress in the Pages report in Search Console: the number of indexed pages should go back to normal.

Meanwhile, it is normal for organic traffic to take time to recover and for Search Console to show a spike in 404 errors. Those 404s are good: they mean Google is checking the spam addresses and finding that they no longer exist. Do not “fix” them with redirects.

How to keep it from coming back

• Updates kept current, especially plugins. Most break-ins come through plugins with published vulnerabilities.
• Fewer plugins: every one you do not use is one more door, even when it is deactivated.
• Unique passwords and two-factor authentication for administrators, the hosting account and the Google account with access to Search Console.
• Review the Search Console owners every so often. A new owner you do not know is an early warning.
• File-integrity monitoring: knowing that a core file changed on the day it changes is the difference between cleaning three files and cleaning ten thousand pages.
• Check site:yourdomain.com now and then, or set up Search Console email alerts.

If you want me to handle it

This hack is one of those that comes back if the backdoor is not found. In my WordPress malware removal service (€219, with a 90-day guarantee) I clean the files and the database, close the way in, check Search Console and request the review from Google. On PrestaShop or another CMS, it is the same work under hacked website repair. If your site has other symptoms, start with the guide to recover a hacked website or with the free scan.

Sources

• Google (web.dev): fix the Japanese keyword hack
• Google: Search Console Removals tool
• Google: Security issues report