Japanese keyword hack: Japanese text in Google

You type your company name into Google. Instead of your normal title and description, results show Japanese text. Product names like watches, handbags, or pharmaceuticals often appear mixed in. The site looks completely normal when you open it, and that's exactly what makes this type of attack so sneaky. SEO and security teams call this the "Japanese keyword hack." The name sounds odd. Still, it hits thousands of WordPress sites worldwide, including sites across the Balkans. It often appears alongside other signs a site is hacked.

This guide explains exactly what this attack is, why it's so hard to spot, and how it's properly removed.

What the Japanese Keyword Hack Actually Is

It is SEO spam. An attacker injects hundreds or thousands of fake pages. They hold Japanese text and links to shady stores. Common targets are counterfeit goods, OTC pharmaceuticals, or gambling sites. Then the attacker rides your existing Google trust. Fake pages climb fast for Japanese search terms.

The name comes from that origin. Early waves used Japanese text. The same method now ships Chinese, Russian, or other languages. It depends on the product being pushed.

Why This Attack Is So Hard to Spot

Other hacks take the site down or change it visibly. With this one, the site looks normal in a browser. There are a few reasons for this.

Cloaking, the Site Shows Different Content to You and to Google

Attackers use cloaking. The server checks if the request is Googlebot or a regular visitor. If the visitor is a regular user, they see the site's normal content. If the request comes from Googlebot, it gets served the fake Japanese content instead. That's why you, as the site owner, can visit your own site for years and never notice anything unusual.

The Fake Pages Don't Show Up in Normal Navigation

These pages don't exist in your site's menu, the sitemap you can see, or in WordPress admin in the usual places. They're generated dynamically, often directly through code injected into theme or plugin files, without leaving a trace in the database that you'd normally review.

It's Usually Discovered Through Google Search or Search Console

Most owners learn late. A customer or partner may Google the company name and see a strange result. Search Console may also report a spike in indexed pages. Often there are thousands of new URLs you never created.

Signs That Point to This Infection

Even though the site is visually clean, there are a few signals you can check yourself.

An Unusual Number of Indexed Pages

In Google Search Console, under Coverage/Pages, check the total number of indexed pages. If your site has, say, 50 real pages but Google shows 3,000 indexed, that's a clear sign fake pages exist that you don't know about.

Suspicious Traffic From Japan or Other Unexpected Countries

Check Analytics for traffic from Japan, China, or other unexpected countries. If those visits bounce immediately, people often arrived via fake search results.

A Drop in Rankings for Your Own Company Name

Ironically, legitimate pages often drop too. Google grows suspicious of the whole domain. Heavy spam volume drives that distrust.

A Direct Check Using the "site:" Search Operator

Type site:yourdomain.com into Google and review the results. If you see titles or descriptions in Japanese, Chinese, or similar languages and your site isn't targeting that market, the infection is confirmed.

How the Japanese Keyword Hack Is Removed

Cleanup is harder than standard malware. The infection is built to hide from a normal review.

Locating the Cloaking Code

The first step is identifying exactly where the code lives that detects Googlebot and serves it different content. This requires reviewing the .htaccess file, theme functions, and often deeply hidden PHP files that load before the main WordPress code runs.

Scanning the Database for Injected Fake Pages

In many cases, the fake pages are actually stored in the database, they're just hidden from a normal review through the admin dashboard. A thorough search through the tables is needed for any foreign-language content or suspicious links.

Removing All Fake URLs From the Google Index

After cleaning the code, remove fake URLs in Search Console. Google will not drop them fast on its own. Without a removal request, that can take weeks.

Submitting a Review Request If the Site Was Penalized

If Google already applied a manual action, submit a review request after cleanup. Explain the remediation steps clearly.

Closing the Entry Point

Also find the entry point. Outdated plugins or themes are common. Close that hole so cloaking code cannot return.

Why a Fast Response Matters

Every day a japanese keyword hack stays active, Google indexes more fake pages. Cleanup then takes longer. Search reputation recovers more slowly. Longer infections raise the chance of a domain-wide manual action. Rankings then recover even harder after cleanup.

What to Do Next

A japanese keyword hack is compromise, not a cosmetic SEO glitch. After cleanup, check whether the domain also landed on a Google blacklist.

The Japanese keyword hack is one of the hardest-to-spot forms of website compromise precisely because the site looks completely normal to visitors. Strange Google results for your company name are a serious signal. So is a spike in indexed pages. Unexpected foreign traffic matters too. This will not disappear on its own.

To check whether your site has a japanese keyword hack, run a free analysis on hakovansajt.com or call 065 402 5000: the analysis includes a detailed check of the Google index and cloaking code, not just a surface-level file review.