← All Guides

Japanese pages are showing under your domain in Google

Search for your own business and you get pages of Japanese text selling handbags. Visit your website and it is completely normal. This is a specific, well-documented attack, and the cleanup has two halves — the server and the search index.

What you're seeing

Search Google for site:yourdomain.com.au and instead of your handful of real pages you get hundreds or thousands of results with Japanese titles, usually selling branded goods at implausible prices. Click one and you may get a 404, or your normal site, or a fully built storefront that has nothing to do with you.

Other ways it announces itself:

  • Search Console reports a sudden jump in indexed pages — from 40 to 4,000 over a fortnight.
  • Impressions appear from Japan, for queries in a language you do not sell in.
  • Google shows "This site may be hacked" underneath your listing.
  • Search Console emails you about new pages, or about a new owner being added to the property.

Browsing your own website shows nothing wrong, because the spam is served to Google's crawler and not to ordinary visitors. That is deliberate, and it is why this can run for months.

Why it happens

This is usually called the Japanese keyword hack, and it is a commercial SEO spam operation rather than vandalism. Someone gets write access to your site — nearly always through an out-of-date or abandoned plugin — and then does three things:

  • Generates pages on demand. Rather than uploading thousands of files, a small script builds spam pages at request time, which is why you cannot find them by browsing your folders.
  • Shows them only to search engines. The script checks whether the visitor is Googlebot and serves the spam only then. Everyone else gets your real site.
  • Verifies themselves in Search Console. This is the part people miss. Once they are a verified owner of your property they can submit sitemaps full of spam URLs to get them indexed faster, and watch how the campaign is performing.

The pages carry affiliate links for counterfeit goods. Your domain is being borrowed for the trust it has already earned, and the operator has no interest in your business at all.

Safe first steps you can try

  1. Work out the scale. Run site:yourdomain.com.au in Google, then open Search Console and look at the Pages report. Knowing whether this is 40 URLs or 40,000 changes how the cleanup is approached.
  2. See what Google sees. Paste one of the spam URLs into Search Console's URL Inspection tool and choose Test live URL, then view the rendered HTML. This is the clearest way to confirm the site is behaving differently for the crawler than it does for you.
  3. Back up files and database. Before changing anything at all.
  4. Check who owns your Search Console property. Settings → Users and permissions. Remove any owner or user you do not recognise. This matters more than it looks — while they hold ownership, they can keep re-submitting spam sitemaps no matter how clean the server is.
  5. Remove their verification method too. Removing an owner is not enough if the thing that verified them is still in place: a stray google​xxxxxxxx.html file in your web root, or a google-site-verification TXT record in your DNS that you did not add.
  6. Check the submitted sitemaps. Still in Search Console. Delete any sitemap you did not submit — they are usually named to look plausible.
  7. Look for what changed on the server. Sort your files by modification date. Check .htaccess, wp-config.php, your theme's functions.php, and wp-content/mu-plugins/. Check the WordPress user list for administrators you did not create.
  8. Reinstall core, update everything, rotate everything. Dashboard → Updates → Reinstall Now, then every plugin and theme, then every password, plus the keys and salts in wp-config.php.
  9. Make sure the spam URLs are properly gone. Once the site is clean they should return a 404 or 410. Then request a review in Search Console if the site was flagged, and let Google recrawl.

What not to do

  • Don't treat the Removals tool as the fix. It hides URLs from search results for about six months. It does not delete anything, and when it lapses the pages are still there if the site was never cleaned.
  • Don't redirect the spam URLs to your homepage. A 301 tells Google those pages moved to your homepage, which is the last association you want. Gone means 404 or 410.
  • Don't clean the server and ignore Search Console. If an unknown owner is still verified on the property, they can start the whole thing again from outside your hosting.
  • Don't delete folders wholesale to be safe. Spam generators sit next to files WordPress needs. Removing a directory because it looks unfamiliar is how a hacked site becomes a hacked site that also will not load.
  • Don't assume a small number of pages means it's minor. Forty spam URLs today is the same infection as four thousand next month. The generator is the problem, not the page count.

When it's beyond DIY

If the spam pages keep coming back after you clean them, if there are thousands of them, or if you cannot work out where they are being generated from — this one rewards experience. The site cleanup and the search-index cleanup are two separate jobs and skipping either one means doing it all again.

We answer 24/7 and the diagnosis starts the moment you call. You get a fixed quote before any work starts, and if we can't help, the assessment costs nothing. See what malware removal and site cleanup involves, or just pick up the phone.

Call 1300 932 767 Email sos@websiterescuers.com.au

That's 1300 WEB SOS. Emergency Website Rescue starts from $1,500 + GST.

Common Questions

Why Japanese, when my business is in Australia?

It has nothing to do with you or your customers. The spam pages sell counterfeit goods to Japanese-language searchers, and the campaign needs domains that Google already trusts to get them indexed. Your domain was chosen because a scanner found a way in, not because of anything about your business.

How do I get the spam pages out of Google?

Clean the site so those URLs genuinely return a 404 or 410, then let Google recrawl. There is no button that empties them out — for thousands of pages it takes weeks rather than days. Search Console's Removals tool hides URLs temporarily while that happens, but it does not remove anything and the pages come back if they still exist.

Is this hurting my normal rankings?

While it runs, yes. Your crawl budget is spent on spam pages instead of your real ones, the domain can be flagged as hacked in search results, and thousands of low-quality pages under your name is not a signal that helps you. Sites that are cleaned properly generally recover as the spam pages drop out of the index.

Want this never to happen again? Protection Plans keep the software updated, monitored and backed up — from $249/month + GST.