Japanese search results in Google

If Google shows pages with Japanese text under your domain, the site is hacked. The attack is known as the Japanese keyword hack. The attacker adds code that generates thousands of pages with Japanese text and links to shops selling counterfeit goods. The pages may sit in folders with random names.

The attacker may also have added themselves as an owner of the site in Google Search Console. As an owner, they can submit their own sitemaps, so Google finds the spam pages faster. Google describes the attack and the clean-up in its own guide.

See how much Google has found

1. Search Google for site:yourdomain.com and go through a few pages of results. Note some of the Japanese URLs.
2. Open one of them. A 404 page doesn't mean the page is gone. The code can check who is asking and serve the spam page to Googlebot while you get an error page (cloaking). Paste the URL into URL Inspection in Search Console and run a live test to see the page as Googlebot gets it.
3. Open the Security Issues report in Search Console and see whether Google has found anything.
4. Scan the site with Sucuri SiteCheck. It only sees what is publicly visible, but it shows whether the site is blocklisted and whether it contains known spam.

Remove unknown owners in Search Console

1. Go to Settings → Users and permissions in Search Console. Remove owners you don't know.
2. Delete their verification as well, or they can verify ownership again. Look for an HTML file in the root folder with a name starting with google, or a rule in .htaccess that serves such a file from a script:

RewriteEngine On
RewriteRule ^google(.*)\.html$ dir/file.php?google=$1 [L]

3. Open https://yourdomain.com/google1234.html in your browser. If you get a 404 page, the rule is gone.
4. Go through the sitemaps submitted in Search Console and remove any you don't recognise.

Clean up the files

1. Back up the files and the database before you delete anything.
2. Connect with FTP or the file manager in your hosting panel and show hidden files. Find every .htaccess file. The one in the root folder should only hold the WordPress block between # BEGIN WordPress and # END WordPress, blocks from active plugins and any rules your hosting provider added, for example for the PHP version. Also keep any rules you or your developer added, for example a redirect to https. Remove the rest.
3. Open sitemap files you don't recognise, and delete the ones that only hold spam addresses. The sitemap WordPress makes itself isn't stored as a file.
4. Before you reinstall anything, sort the files by modification date and size, and take a closer look at files changed around the time the attack started. Pay special attention to index.php, wp-load.php and 404.php. Look for eval, base64_decode, gzinflate and str_rot13 next to long strings of random characters.
5. Reinstall WordPress, the plugins and the themes from clean copies.
6. Check with WPScan whether any plugin or the theme has known vulnerabilities, and update them.

Finally, paste the Japanese addresses into URL Inspection and run a live test. If they return a 404, the pages are gone from the server.

Get the spam pages out of Google

Google drops the pages from its results as it crawls them again and gets a 404, which can take a while. To hide them faster, use the Removals tool in Search Console. If the pages sit in one folder, you can remove all addresses that start with that folder. A removal lasts about six months, so the pages must be deleted from the server before it expires.

If the Security Issues report lists anything, request a review there once the site is clean. Describe what you found and what you did.

When you're stuck

If new Japanese pages appear after the clean-up, a backdoor is still in place and the security hole the attacker used is still open. Deleting the pages again won't help. A developer with WordPress security experience has to go through all the files, the database and the server logs to find the backdoor and the hole. If you don't have access to Search Console yourself, one of the verified owners has to remove the unknown owners.