The tech world is familiar with the Japanese keyword hack attack, a widespread SEO attack where hackers inject Japanese text and spammy keywords into a website, creating fake pages that appear in Google search results. These hacked pages have been known to promote unrelated products and can seriously damage your site’s SEO, reputation, and ultimately, user trust. If you notice Japanese content or strange URLs indexed for your site, or even meta / SEO titles suddenly showing unfamiliar Japanese terms, it’s a clear sign your website is compromised.
What Happens in the Japanese Keyword Hack?
- Hackers create fake pages on your website filled with Japanese words and links to shady stores.
- These spam pages show up in Google search results, making your site look hacked or untrustworthy.
- Your actual visitors might not see these pages, but Google and other search engines do, which affects your traffic and rankings.
3 Steps to Detect if Your Website is Hacked
1. Manual Check in Incognito Mode
- Open an incognito/private browser window (Ctrl+Shift+N)
- Search for your site using:
- Look for pages with Japanese titles or strange URLs (like .html, .shtml, etc.)
- Open random suspicious pages to see if they return 404 errors or unwanted content
2. Using Google Search Console (GSC)
- Add your website to Google Search Console, if you haven’t already
- Go to the “Pages” section on the left sidebar
- Check to see if the number of indexed pages is higher than the actual pages you created
- Review both “Indexed” and “Not Indexed” tabs for strange URLs
- Export the list of suspicious URLs for review
3. Checking Internal Links and Backlinks
- In GSC, check the “Links” section (from the left sidebar)
- If you see hundreds or thousands of internal links to pages you never created, that’s a sign of spam
- Hackers may also create spammy backlinks to your URLs to increase the visibility of fake pages
6 Steps to Remove the Japanese Keyword Hack
You can use a special sitemap to help Google quickly find and remove spammy URLs from its index. Here’s what you should do.
Export the list of spam URLs
- In GSC, export all suspicious URLs (the ones you didn’t create)
- Save them in a text file (e.g., sitemap.xml)
Upload the spam URL file to your website
- Use a plugin to upload sitemap.xml to your website’s root directory (WP File Manager can come in handy here)
Submit the spam URL file in GSC
- Go to the “Sitemaps” section in GSC
- Submit the path to your sitemap.xml file. This helps Google crawl and de-index these spam URLs faster
Create and upload a clean sitemap
- Generate a fresh sitemap (sitemap.xml) containing only your actual, valid pages (sitemap)
- Remove all spammy URLs from this sitemap
- Upload the new sitemap to your website and submit it in GSC
Update your robots.txt file
- Create a new robots.txt file
- Add rules to disallow common spam extensions:
- Add the path to your clean sitemap:
Sitemap: https://yourwebsite.com/sitemap.xml
- Upload the updated robots.txt file to your website’s root directory
Wait and monitor
- Give Google a 48-hr timeframe to process your new sitemap and spam URL file
- In GSC, check to see if the indexed spam pages still remain
- Repeat the export and removal process for those remaining URLs
Quick Reference Table
| Step | What to Do | Tool/Location |
|---|---|---|
1. Export spam URLs | Export from GSC | Google Search Console > Pages |
| 2. Upload spam-url.txt | Upload to the root directory | WP File Manager |
| 3. Submit spam-url.txt | Submit as a sitemap in GSC | Google Search Console > Sitemaps |
| 4. Create a clean sitemap | Only include actual pages, remove spam | Sitemap Generator |
| 5. Update robots.txt | Disallow spam extensions, add sitemap path | Root directory |
| 6. Monitor and repeat | Check for remaining spam, repeat the process if required | Google Search Console |
Additional Security Steps
To make your site defensibly strong, start by changing the default WordPress admin URL to something unique. Install a trusted security plugin like Wordfence and make it a habit to run scans regularly. If you’re comfortable with the terminal, WP-CLI scans are faster; otherwise, a GUI works fine. Always keep WordPress, your theme, and any installed plugins updated, and remove the ones you don’t actually need. Finally, use strong passwords and limit admin access so only the right people can get in.
Summary
- You can speed up the removal of pages affected by the Japanese keyword hack by exporting all spam URLs from Google Search Console, putting them in a spam-url.txt file, and uploading it to your website.
- Submit this file as a sitemap in GSC so Google can crawl and de-index it.
- Keep your main sitemap clean and only include real, actual pages.
- Monitor GSC for progress and repeat the process if new spam pages appear.
This guide will help you understand, detect, and remove this SEO spam attack easily. Any confusion? See the expert answers in the Google Support.
Fix the Hack Fast
By Digillex
