Find and Remove WordPress SEO Spam (the Japanese Keyword Hack)

This article is a localized edition of the Japanese original. Read the Japanese original

SEO spam (an SEO spam hack) is an attack in which a compromised site is made to generate large numbers of fake product pages and links, sending search traffic to the attacker's online stores and similar sites. When the pages are stuffed with Japanese product names, Google's own guidance calls it the "Japanese keyword hack".

The steps in this article are based on Google's "Fix the Japanese keyword hack" guide on web.dev and the official WP-CLI documentation, checked as of November 2026.

What it looks like

• A site:example.com search lists URLs you never created (for example, directories with random alphanumeric names), with Japanese product names and "bargain" style descriptions
• The "Security issues" report in Search Console reports hacked content
• An owner you don't know has been added to your Search Console users
• When you open the page in your browser you see a normal page or a 404, but Google alone is shown the spam (cloaking)

Because of cloaking, a page that looks fine in your browser isn't proof that you're clean. Use Search Console's "URL Inspection" to check what Googlebot actually received.

Before you start

1. Make a backup. Save the files and the database somewhere off the server. It gives you material for the investigation and a way back if you make a mistake.
2. Change admin passwords after you close the way in. If you change them first, an attacker may get back in through a backdoor that is still there. Do, however, change your hosting control panel, FTP and database passwords early, from a different device.

The commands below assume WordPress is in /var/www/html and that you can use WP-CLI over SSH. On a shared hosting plan without SSH, check the same locations with the file manager or FTP.

1. Find out how far the infection goes

Check Search Console

• Under "Security & Manual Actions" → "Security issues", look at the sample pages Google detected.
• Under "Settings" → "Users and permissions", remove any owners or users you don't know. Also delete the HTML file used to verify ownership (an .html file whose name starts with google) or the rewrite rule in .htaccess used for verification. If you don't, the attacker gets re-added as an owner.
• Inspect the spam URLs with "URL Inspection" and use "View crawled page" to see what Google saw.

Look for recently changed files

You can sometimes narrow down tampered files by their modification time.

# PHP files changed in the last 30 days (newest first)
find /var/www/html -type f -name '*.php' -mtime -30 -printf '%TY-%Tm-%Td %TH:%TM %p\n' | sort -r | head -50

# PHP files in the uploads directory (normally there should be none)
find /var/www/html/wp-content/uploads -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \)

# Every .htaccess (they can be planted in out-of-the-way places)
find /var/www/html -name '.htaccess' -printf '%TY-%Tm-%Td %p\n'

Modification times can be faked, so don't rely on this result alone; combine it with the checks below.

Look for obfuscated code

Google's guide lists code made unreadable with base64_decode, rot13, eval, strrev, gzinflate and similar functions as a clue. Legitimate plugins use these functions too, so read the contents of each file you find before deciding.

grep -rlE 'eval\(|base64_decode\(|gzinflate\(|str_rot13\(|strrev\(' /var/www/html/wp-content --include='*.php' | head -50

Malicious code is sometimes added to index.php, wp-load.php, or a theme's 404.php.

Check whether WordPress files were modified

Use WP-CLI to compare core files and plugins distributed through WordPress.org with the official checksums.

cd /var/www/html
wp core verify-checksums
wp plugin verify-checksums --all

Files that don't match, and files that shouldn't exist, are reported. Premium plugins and themes from outside WordPress.org can't be checked this way, so reinstall them from their vendor.

Check the database

Spam can also be created as posts, or links can be embedded in widgets and settings.

# List administrators (look for accounts you don't recognize)
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# Recently created posts, pages and other content
wp post list --post_type=any --post_status=any --orderby=date --order=DESC --posts_per_page=30 --fields=ID,post_type,post_status,post_date,post_title

# Check that the site URLs haven't been changed
wp option get siteurl
wp option get home

# Search the whole database for a spam string (e.g. the domain of a URL you found)
wp db search 'spam-domain.example' --all-tables

# Suspicious scheduled events
wp cron event list

For wp db search, use a string that actually appears in the spam, such as the domain of a URL or a product name you found with the site: search.

wp-content/mu-plugins/ doesn't stand out in the admin plugin list, so attackers sometimes use it to plant files. Check it for files you didn't put there.

2. Remove the spam and malicious files

Restore .htaccess

Google's guide recommends replacing .htaccess files with a clean or default version. The standard WordPress content is shown below (the paths change if WordPress is in a subdirectory).

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

If you added your own redirects or IP restrictions, check them and add only those parts back. For .htaccess files in places where you never created one, such as under wp-content, save a copy and then delete them.

Note that wp rewrite flush --hard only rewrites the section between # BEGIN WordPress and # END WordPress; malicious rules added outside it are not removed.

Reinstall core, plugins and themes

Overwrite the core files with the same version you're running now. Set --locale to the site's language (ja for a Japanese site). With --skip-content, the default themes and plugins in wp-content are not overwritten. wp-config.php and wp-content are left alone.

wp core download --version=$(wp core version) --locale=ja --skip-content --force

Reinstall plugins and themes from fresh files from their source as well. Those from WordPress.org can be overwritten with the following commands.

wp plugin install plugin-slug --force
wp theme install theme-slug --force

Delete plugins and themes you don't use. If you've edited your theme yourself, reinstalling it will wipe your changes, so compare with your backup before restoring them.

Delete malicious files and data

• Check the contents of PHP files in the uploads directory before deleting them.
• Delete suspicious files found during the investigation that belong to neither core nor any plugin.
• Delete administrator accounts you don't know (wp user delete ID --reassign=YOUR_USER_ID).
• Delete spam posts after confirming their IDs. Bulk-deleting every post that matches a string risks deleting legitimate posts too.

wp post delete 1234 1235 --force

Change passwords and secret keys

Once the way in is closed, change every administrator's password and the authentication keys (salts) in wp-config.php. Changing the keys invalidates every logged-in session.

wp user update YOUR_USER_ID --user_pass='a-long-random-password'
wp config shuffle-salts

If you changed the database password, update DB_PASSWORD in wp-config.php to match.

3. Confirm the cleanup

• Open the spam URLs you found with the site: search and confirm they return 404 or 410.
• Inspect the same URLs with Search Console's "URL Inspection" and confirm Google no longer sees the spam either.
• Check your sitemaps for unfamiliar URLs and for sitemap files you didn't create. Resubmit your legitimate sitemap under "Sitemaps" in Search Console.

Google's sitemap ping (google.com/ping?sitemap=) was retired in 2023, so submit sitemaps through Search Console or a Sitemap: line in robots.txt.

4. Let Google know

• If the issue was reported under "Security issues", fix everything first and then click "Request review". A request sent while problems remain won't pass.
• It takes time for spam URLs to drop out of search results. To hide prominent URLs sooner, use the "Removals" tool in Search Console to hide them temporarily. Because this is only temporary, the pages themselves must return 404 or 410.

Prevent reinfection

According to Google's guide, about 20% of hacked sites are hacked again within a day. If the way in remains open, the cleanup is quickly undone.

• Update WordPress, plugins and themes, and replace plugins that are no longer maintained
• Limit administrator accounts to the people who need them, and use two-step authentication
• Prevent PHP from running in the uploads directory
• Run a virus scan on the computers you use for administration
• Take regular backups, and receive Search Console notification emails so you notice tampering

How to find backdoors is covered in "How to detect and remove WordPress backdoors", and the overall recovery process in "How to clean up and recover from a WordPress malware infection".

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)