Japanese or Pharma Spam Pages in Google for Your Site? How to Fix

How to tell if you have the Japanese keyword hack

Google's guide to the Japanese keyword hack describes autogenerated Japanese pages created in random folder names, for example example.com/ltjmnjp/341.html, monetised with affiliate links to shops selling fake branded goods. Pharma and casino spam works the same way with different content.

• Search for site:yourdomain.com on Google and page through the results. Look for Japanese titles, brand names you do not sell or folders you never created.
• Check Search Console's Security Issues report. Google may already list hacked URLs there.
• Look for a new Search Console owner. Google notes hackers often verify themselves as owners to change settings such as sitemaps. An email saying someone you do not know verified your site is a strong sign.
• Inspect a spam URL with URL Inspection. If you see a 404 in your browser but Google sees spam, the hack is cloaking content.

Why spam pages hurt more than your search ranking

The spam pages are a symptom. Someone has write access to your server, through an outdated plugin, a stolen password or a backdoor file. The same access can be used to add card-skimming code, redirect visitors or send spam email from your hosting.

There is also a business cost. Customers searching your name see fake goods, Google may label the site as hacked in results, and your real pages can lose visibility while thousands of junk URLs compete for crawl attention. Our general hacked website guide covers the first hour for any type of hack.

Clean the hack: steps from Google's documentation

Work through these in order. Google advises making an offline copy of every file before you delete it, and a full backup of files and database before you start.

1. 1

   Back up the whole site, hacked state included

   Copy all files and the database off the server. You may need them to find how the attacker got in, or to restore something you delete by mistake.

2. 2

   Remove unknown Search Console owners

   In Search Console, check Settings, then Users and permissions, and the verification details. Remove anyone you do not recognise and delete their verification token, often an HTML file in the site root or a rewrite rule in .htaccess.

3. 3

   Replace every .htaccess file

   Google says hackers use .htaccess rules to redirect users and generate spam pages. Replace each one with your CMS's default version. If you never configured one, the file you find is probably malicious.

4. 4

   Reinstall core files, themes and plugins

   Reinstall the CMS core and every theme and plugin from the official source. This overwrites injected code in files you might never think to open.

5. 5

   Check and clean sitemaps

   Hackers add sitemaps or edit yours so Google finds the spam faster. Delete sitemaps you did not create and remove spam URLs from yours.

6. 6

   Hunt for remaining malicious files

   Sort files by modified date and size. Google notes scripts are commonly injected into index.php, wp-load.php, 404.php and view.php. Compare against clean copies.

7. 7

   Close the hole and change every password

   Update everything, delete unused plugins and old users, and change admin, hosting, FTP and database passwords. Add MFA to admin logins.

If the steps above feel beyond you, Google's own guide recommends speaking with an experienced developer. Our WordPress hack repair guide explains what a professional clean-up should cover.

Remove the spam URLs from Google search results

Once the files are clean, the spam URLs should return a 404 (not found) or 410 (gone). Google drops them from results as it recrawls. For thousands of URLs this takes time, so there are two tools to speed it up.

Do not block the spam folders in robots.txt. Google's removal documentation says to remove the content instead, because blocked URLs cannot be recrawled to confirm they are gone. If real pages also dropped out, our guide on crawled but not indexed pages explains how to get them back.

Request a review and how long it takes

If Search Console's Security Issues report shows a hacked notice, open it and select Request a review. Google's request-a-review guide asks you to describe what you cleaned and how you fixed the vulnerability, for example removing spam content and updating an out-of-date plugin.

Check first with curl or wget that the homepage and a former spam URL load clean, and that the pages are not blocked by robots.txt or noindex. Google says reviews for spam hacks can take several weeks because they may involve manual checks. Once it finds the site clean, warnings in browsers and search results are removed within 72 hours. Requesting a review too early only prolongs the warning.

Stop the Japanese keyword hack coming back

Reinfection within weeks is common when the original hole is left open or a backdoor file survives. Put these in place before you consider the job finished.

Do it yourself or get help?

If you know your way around file managers, .htaccess and Search Console, Google's steps are manageable for a small site. The risk is missing one backdoor and starting again in a month.

We quote malware clean-up separately after looking at the site. Once it is clean, our Website Security Hardening (S$290) adds updates, login protection with 2FA, a firewall, security headers and off-site backups. If search traffic dropped, the Speed & SEO Fix (S$390) covers sitemap, indexing and on-page fixes to help Google recrawl the real pages.