How to Fix Japanese SEO Spam on WordPress: Malware Removal and SERP Recovery
A practical technical recovery guide to identifying the Japanese Keyword Hack, removing backdoor PHP files, cleaning infected databases, and purging spam URLs from Google Search.
Website malware warning screen and recovery investigation
Discovering that Google has indexed thousands of Japanese character spam pages on your WordPress website is a severe security issue. Known as the Japanese Keyword Hack (or Japanese SEO Spam), this attack injects auto-generated doorway pages selling counterfeit goods or foreign gambling into search engine results, rapidly destroying your organic visibility.
This technical guide explains how Japanese SEO spam functions, how to locate and eradicate backdoor malware files from your server, clean database injections, and purge indexed spam URLs using Google Search Console.
1. Symptoms of the Japanese Keyword Hack
The hack usually exhibits clear diagnostic symptoms: • Searching `site:yourdomain.com` in Google reveals hundreds or thousands of titles in Japanese text. • Google Search Console reports a sudden spike in 404 errors, crawl requests, or 'Security Issues' warnings. • Strange query parameters appear in search traffic logs (such as `?id=12345` or `/goods/123.html`). • Cloaking: The hacked URLs return spam when visited by Googlebot (User-Agent check), but redirect to a normal 404 or homepage when visited directly by normal browsers.
2. Initial Investigation & Isolating the Infection
Before making changes, create an immediate full backup of your website files and MySQL database via your hosting control panel (cPanel, hPanel, or Plesk). Put the site in maintenance mode or temporarily place it behind Cloudflare to inspect incoming traffic.
3. Finding and Removing Malicious Backdoor Files
Attackers maintain access through hidden PHP scripts disguised as legitimate WordPress core or plugin files. Connect via SSH or FTP and run the following inspection steps:
# 1. Search for recently modified PHP files within the last 30 days
find /var/www/html/ -type f -name "*.php" -mtime -30
# 2. Check for unauthorized PHP scripts inside the uploads folder (should never contain PHP)
find /var/www/html/wp-content/uploads/ -type f -name "*.php"
# 3. Look for common backdoor patterns and eval/base64 obfuscation
grep -rn "eval(base64_decode" /var/www/html/wp-content/
grep -rn "gzinflate(base64_decode" /var/www/html/wp-content/Common malicious filenames include `class-wp-cache.php`, `lock360.php`, `wp-tmp.php`, or randomly named files like `a7x9c.php`. If suspicious scripts are found in `wp-content/uploads/`, delete them immediately and disable PHP execution inside uploads using `.htaccess`.
4. Checking the Database and Admin Users
Attackers often create hidden administrator accounts or inject malicious javascript into your database tables (`wp_users`, `wp_options`, and `wp_posts`): 1. Log into phpMyAdmin and inspect the `wp_users` table for unfamiliar usernames with administrator capabilities. 2. Check `wp_options` for modified `siteurl` and `home` values, or suspicious base64 strings in autoloaded options. 3. Replace all WordPress core files by downloading a fresh copy of WordPress from wordpress.org and overwriting `wp-admin` and `wp-includes` (keep `wp-config.php` and your audited `wp-content`).
5. Cleaning Rogue Sitemaps and Injected Redirects
Inspect your `.htaccess` file in the root directory. Attackers often prepend rewrite rules that serve spam content exclusively to search engine crawlers:
# Standard clean WordPress .htaccess
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPressAlso check your root directory for rogue sitemaps such as `sitemap_japan.xml` or dynamically generated PHP sitemaps, and remove them immediately.
6. Search Console Remediation & Purging Indexed Spam
Once the server is clean, you must instruct Google to de-index the spam URLs: 1. Ensure all deleted spam URLs return an HTTP 404 (Not Found) or HTTP 410 (Gone) status code. Do NOT redirect spam URLs to your homepage, as this creates soft 404s and delays de-indexing. 2. Open Google Search Console ➔ **Removals** ➔ **New Request**. 3. Select **Remove all URLs with this prefix** and enter the subfolder or prefix where spam was generated (e.g., `https://yourdomain.com/japan/` or `https://yourdomain.com/goods/`). 4. Submit your clean XML sitemap under **Sitemaps** to encourage Googlebot to re-crawl your legitimate pages.
“For a real-world incident walkthrough involving over 1 million spam URLs cleaned from Search Console, see our Appletlogic Recovery Case Study and specialized Malware Removal Service.”
7. Security Hardening and Ongoing Prevention
To prevent reinfection: • Reset all database, FTP, hosting panel, and WordPress admin passwords. • Enforce Two-Factor Authentication (2FA) for all WordPress administrator accounts. • Update PHP to a supported release (PHP 8.2 or 8.3) and update all themes and plugins. • Install a Web Application Firewall (WAF) such as Cloudflare or Wordfence to block automated exploit probes.
- Take an immediate full file and database backup before cleanup.
- Identify and delete backdoor PHP scripts using find and grep commands.
- Audit wp_users and wp_options in phpMyAdmin for unauthorized admin users.
- Ensure spam URLs return HTTP 404 or 410 headers; avoid 301 redirects to homepage.
- Use Search Console Link Prefix Removals to suppress bulk spam folders quickly.
- Submit a clean XML sitemap and enable Two-Factor Authentication on all admin accounts.
Digital marketer and web developer working across web development, technical SEO, performance marketing, website security and analytics.
