Moatline

Japanese or pharma spam in Google results? How to fix the WordPress hack

Your site appears in Google with Japanese titles, fake designer goods or online pharmacy pages you never made. This is a spam hack, and it is often invisible when you visit the site yourself. Here is how to find it and clean it properly.

By the Moatline team at Next Nova Technologies · Published 15 October 2026 · 4 min read

What this hack is

Attackers use your site’s good name in Google to rank their own spam. A PHP script on your server creates thousands of pages on your domain (Japanese product listings, fake designer bags, online pharmacies, casino pages) and serves them only to search engines. People who click those results get sent to the attacker’s shop.

Your real pages lose rankings, Google may label your site “This site may be hacked”, and the spam keeps growing until the script is removed.

Confirm it

  • Search Google for site:yourdomain.com and go through several pages of results. Look for foreign text, product names and strange URLs, often in folders you don’t have.
  • Try site:yourdomain.com viagra, site:yourdomain.com casino or site:yourdomain.com plus a brand name like “Louis Vuitton”.
  • Click one of the spam results. If you see a normal page, a 404 or your home page, the spam is being hidden from you.

Check Search Console first

  1. Settings → Users and permissions. This hack often adds the attacker as a verified owner so they can submit their own sitemaps. Remove any owner you don’t recognise, then delete their verification method: a google…html file in your site root, a DNS record, or a rewrite rule in .htaccess that creates the file on demand.
  2. Indexing → Sitemaps. Delete any sitemap you didn’t submit.
  3. URL inspection. Paste one spam URL, click Test live URL → View tested page. You will see the spam exactly as Google does.
  4. Security & Manual Actions. Note any issues listed: you will request a review once the site is clean.

Find the code

The spam generator is usually a few PHP files plus a rule that sends spam URLs to them. Check these places:

  • .htaccess files in the site root and subfolders, for rewrite rules pointing to a PHP file you don’t recognise. Find them all with find . -name ".htaccess". Moatline doesn’t check .htaccess rules, so do this by hand.
  • Modified core files. Attackers often add code to index.php or wp-load.php. Run wp core verify-checksums or reinstall WordPress core from Dashboard → Updates.
  • New PHP files in the site root, uploads and odd folders. Recently changed ones are the best lead: 
    find . -name "*.php" -mtime -30 -not -path "./wp-content/cache/*"
  • Fake plugins and must-use plugins, and plugin files that differ from the official copy.

The free Moatline Malware Scanner checks files, plugins, must-use plugins, the uploads folder and the database, and names known malware families. Our malware removal guide covers the full cleanup, including passwords and security keys.

When you’re done, open a few spam URLs again: they should now return 404 Not Found for everyone, including in URL inspection.

Clean up Google

  1. Request a review in Security issues, if Google listed any, describing what you removed and how the attacker got in.
  2. Submit a clean sitemap with only your real pages.
  3. Use the Removals tool (Indexing → Removals) for the worst spam folders, such as a whole /xyz/ folder prefix. This hides them for about six months while Google recrawls and drops them for good.
  4. Watch the Pages report over the following weeks. The number of indexed pages should fall back to normal.

Source: Google’s guide to fixing the Japanese keyword hack.

Frequently asked questions

Why can’t I see the spam pages when I visit them?
The hack uses cloaking: it shows spam to Google’s crawler and a normal page or a “not found” error to everyone else. Use URL inspection in Search Console to see exactly what Google gets.
How long until the spam disappears from Google?
Pages that now return “not found” drop out as Google recrawls them, which can take weeks for thousands of URLs. The Removals tool in Search Console hides them faster, for about six months, while Google catches up.
Should I redirect the spam URLs to my home page?
No. Let them return 404 or 410 so Google understands the pages are gone. Redirecting thousands of spam URLs to your home page looks like more spam.
Will my rankings recover?
Usually, once the spam is gone, the site is secure, and Google has recrawled it. If Google issued a security warning or manual action, clearing it with a review request is part of the recovery.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →