How to remove Japanese SEO spam from WordPress
Japanese SEO spam is a WordPress compromise that creates fake search pages—often for products, brands, coupons, or profiles—while hiding them from normal visitors and administrators. Removing the visible URLs is not enough: the generator, backdoor, and original access path must also be removed.
Common signs of Japanese SEO spam
Japanese titles or descriptions appear for your domain in Google.
Thousands of unfamiliar product, coupon, brand, or profile URLs are indexed.
Search results lead to pages that are missing from the WordPress admin area.
Unknown XML sitemaps or Search Console properties appear.
Spam pages return after posts, files, or rewrite rules are deleted.
Google Search Console reports hacked content, deceptive pages, or unusual indexing growth.
Why the pages may not exist in WordPress
The spam URLs are not always ordinary posts. Malicious code can generate them dynamically from request paths, inject content into database options or metadata, alter rewrite rules, or serve different HTML only to search crawlers and visitors arriving from Google.
This is why checking the Pages and Posts screens may show nothing unusual even while search engines index thousands of fake URLs.
Where the infection can hide
- Modified theme, plugin, WordPress core, or must-use plugin files.
- PHP files placed inside uploads, cache, temporary, or backup directories.
- Injected database options, post metadata, widgets, transients, or custom tables.
- Malicious
.htaccess, Nginx rules, or dynamically generated sitemap files. - Unknown administrators, application passwords, scheduled WordPress events, or system cron jobs.
- Another compromised website within the same hosting account.
A safe cleanup process
- Record examples of spam URLs, titles, sitemaps, Search Console warnings, and the date the problem appeared.
- Preserve a backup of the current files and database before deleting evidence.
- Compare WordPress core with official checksums and review recently modified files.
- Inspect plugins, themes, uploads, must-use plugins, users, scheduled tasks, database options, and server rules.
- Remove malicious generators, injected content, backdoors, rogue access, and related payloads.
- Patch vulnerable software and rotate hosting, WordPress, database, SFTP, SSH, and API credentials.
- Test representative spam URLs to confirm they return the correct status and no longer serve malicious content.
What to do in Google Search Console
Search Console is useful for confirming the scope and monitoring recovery, but it does not clean the website. First stop the site from serving the fake content. Then submit the legitimate sitemap, inspect important URLs, review security issues and manual actions, and request a review when Google provides that option.
Old spam results may remain visible for days or weeks while Google recrawls the site. The Removal tool can temporarily hide selected URLs, but it is not a substitute for cleaning the infection or returning correct HTTP responses.
Why the spam often returns
Recurrence usually means a persistence mechanism or entry point was missed. Deleting one sitemap, resetting permalinks, or removing the indexed pages may temporarily reduce the symptoms while a hidden PHP loader, cron task, stolen credential, vulnerable plugin, or neighbouring hacked site restores them later.
When professional cleanup is justified
A complete investigation is advisable when the spam returns after deletion, the site contains custom or ecommerce functionality, the host has suspended the account, several installations share one hosting account, or you cannot establish a trustworthy clean baseline.
Japanese SEO spam still appearing?
Send the website URL and examples of the indexed spam. The assessment covers the visible pages, likely generator, persistence mechanisms, and required recovery work.