The Japanese keyword hack and the pharma hack

How they work

Google documents both and has cleanup guides for each. They’re usually the result of an out-of-date plugin, theme or platform.

• The Japanese keyword hack generates pages of auto-written Japanese text with links to counterfeit stores, on new addresses inside your site. Attackers often add themselves as an owner in Search Console and submit their own sitemap.
• The pharma or cloaked keywords hack injects pages or links about pills, replica goods or gambling, often shown only to search engine crawlers (cloaking), so the site looks normal to you.

How to find them

1. Search for themsite:yourbusiness.com japan, or site:yourbusiness.com with words like viagra, cialis, replica, casino.
2. Check Search ConsoleUsers and permissions for owners you didn’t add, Sitemaps for ones you didn’t submit, the Pages report for thousands of unfamiliar addresses, and Security issues.
3. See what Google seesUse URL Inspection on a spam address to view it as Googlebot.

How to clean them

Spam pages can linger in search results for weeks after cleanup while Google recrawls. Submitting your real sitemap helps.

• Remove unknown Search Console owners and their sitemaps first.
• Find and remove the injected code and files, including the backdoor; check .htaccess, theme files and the database.
• Update everything and change every password.
• Make the spam addresses return a 404 or 410, so Google drops them.
• Request a review in Search Console if there’s a security warning.