WordPress SEO Spam: Clean It Up and Stop It
How to spot WordPress SEO spam like the Japanese keyword hack, clean an infected site safely, and stop it from coming back.
Clean WordPress SEO spam by identifying every injected file and database entry, removing all of it, updating everything to close the vulnerability that let it in, and requesting a Google review if a manual action was applied. Partial cleanups that miss a backdoor lead to reinfection within days.
This is the security half of WordPress SEO — a fast, well-structured site with spam pages indexed under it is still a site actively losing rankings and reputation.
On this page
What does WordPress SEO spam actually look like?
Search site:yourdomain.com in Google and look at what comes back. Spam pages typically show up as dozens or hundreds of URLs you never created, often with titles in a foreign language, advertising pharmaceuticals, counterfeit goods, gambling or payday loans — content designed purely to rank and redirect traffic elsewhere.
| Pattern | What it looks like | Typical entry point |
|---|---|---|
| Japanese keyword hack | Hundreds of autogenerated Japanese-language pages | Outdated plugin or theme, or a compromised admin account |
| Pharma hack | Spam pages or injected links for prescription drugs | Outdated core, plugin or theme vulnerability |
| Malicious redirects | Visitors sent to an unrelated site, search engines see normal content | Compromised .htaccess or theme file |
| Injected footer links | Hidden links to unrelated sites in the footer or sidebar | Compromised database or a nulled/pirated plugin |
The common thread across all of these is that they're built to be invisible to a normal visitor and visible to search engines, which is what lets them run for weeks or months before anyone notices — often the first sign is a client asking why the site is ranking for something completely unrelated to the business.
How did the site get hacked in the first place?
Almost always one of three things: an outdated plugin or theme with a known, published vulnerability, a weak or reused admin password, or a nulled — pirated — plugin or theme that shipped with a backdoor built in from the start [2].
Knowing the entry point matters because a cleanup that removes the spam without closing whatever let it in guarantees a repeat. This is the step people skip when they're in a hurry to just make the spam pages disappear.
It's worth checking the site's plugin and theme list against their changelogs before assuming which one was the entry point. A plugin that hasn't shipped an update in over a year, even if it still technically works, is the kind of thing worth flagging on sight — an abandoned plugin means any vulnerability discovered in it after that point never gets patched, and it sits there indefinitely until someone finds and exploits it.
How do you clean a hacked WordPress site step by step?
Methodically, and in an order that doesn't let the infection hide from you. Rushing this, or cleaning only the files you can see, is the single most common reason a site gets reinfected within a week of a first cleanup attempt.
Take the site offline or put it in maintenance mode
Stops the spam from actively serving to visitors and search engines while you work, and stops an active attacker from covering their tracks.
Back up the current, infected state first
Sounds counterintuitive, but you need a reference copy in case a cleanup step goes wrong or you need to compare what changed.
Replace core, theme and plugin files with fresh copies
Don't try to manually edit infected files — download clean copies of WordPress core and every plugin and theme from their official source and replace everything.
Check the database for injected content
Spam is often injected directly into posts, options or widget tables, not just in files — a database scan is not optional.
Rotate every password and every secret key
Admin passwords, database credentials, FTP/SFTP credentials, and the WordPress security keys in wp-config.php — assume all of them are compromised.
Update everything before bringing the site back online
The vulnerability that let the hack happen is still there until this step — reinstalling clean files onto an outdated, vulnerable version just resets the clock.
What's specific about the Japanese keyword hack?
It cloaks — showing search engine crawlers different content than human visitors see. That's why a site owner checking the site in a normal browser often sees nothing wrong at all, while site:yourdomain.com in Google shows hundreds of spam pages in Japanese. The infection detects the visitor's user agent or referrer and serves accordingly.
This makes it harder to spot without deliberately checking, which is exactly the point. Checking your own indexed page count and titles in Search Console periodically — not just when something feels wrong — is the only reliable way to catch it early, before it's had months to spread.
The safest way to check without tipping off the infection is to fetch a suspected page with a plain HTTP request that carries no browser identifiers, rather than opening it in a normal browser — cloaking logic often specifically excludes the site owner's own known IP address or logged-in session, so a normal check from your own computer can come back looking completely clean on a site that isn't.
How do you tell Google the site is clean now?
Through Search Console's Security Issues report and, if a manual action was applied for hacked content, a reconsideration request once you've confirmed every trace of the infection is gone. Submitting the request before the cleanup is actually complete just wastes a review cycle and delays recovery further.
Confirm the Security Issues report is clear of new problems
Check the report itself, not just your own visual inspection of the site — Google's crawler may see something you missed.
Re-scan with an external malware checker
A second, independent scan catches anything a manual review missed, particularly injected content that only appears under specific conditions.
Submit the reconsideration request with specifics
Describe exactly what was wrong and exactly what you did to fix it — a vague request reads as an incomplete cleanup and is more likely to be rejected.
How do you stop it from happening again?
Treat updates and passwords as ongoing maintenance, not a one-time fix after an incident. Set plugins, themes and core to update automatically where that's safe, use a password manager to generate a unique admin password, and add two-factor authentication to the login page.
A basic file-integrity monitor that alerts on unexpected changes catches a reinfection attempt within hours instead of months, which is the difference between a five-minute fix and another full cleanup. Pair this with the crawl and indexing checks in WordPress technical SEO and the caching and speed work in WordPress speed optimization — a site that's fast, clean and correctly indexed is also one where a new spam page stands out immediately instead of hiding in the noise. If the ongoing maintenance burden is the real issue, some teams solve it by moving off self-hosted WordPress entirely — see HubSpot CMS SEO for what a managed platform changes about this specific risk.
Limiting login attempts and restricting the WordPress admin area to known IP addresses, where that's practical for your team, removes the brute-force path entirely rather than just making it slower. And keep at least one clean, tested backup stored somewhere the site itself can't reach — a backup sitting in the same compromised hosting account is not a real backup, since whatever compromised the site once can compromise the backup copy too.
None of this needs to be expensive or complex. A password manager, automatic updates where they're safe, a login attempt limiter and an offsite backup cover the large majority of how WordPress sites actually get hacked in the first place, and all four are a few hours of setup rather than an ongoing burden once they're in place.
How long until rankings recover?
It varies, but the timeline is roughly: days for Google to recrawl once the technical cleanup is done, up to a few weeks for a reconsideration request to be reviewed if one was needed, and then a gradual recovery as spam pages drop out of the index and normal pages regain the trust signals the infection disrupted.
Full recovery to pre-hack rankings isn't guaranteed on a fixed timeline, because some of what was lost — crawl trust, user trust, any links that pointed at now-removed spam pages — rebuilds gradually rather than resetting instantly the moment the site is clean. That's one more reason prevention is cheaper than recovery: the cleanup itself is a few days of focused work, but the ranking impact can take longer to fully settle.
Pages that were never indexed as spam but simply stopped ranking during the incident tend to recover faster than pages the infection actively replaced or redirected, since the underlying content and its history were never disturbed. If a specific page still hasn't recovered weeks after a confirmed clean bill of health, check whether it lost internal links during the cleanup — a theme file replaced wholesale sometimes drops a navigation link or a related-posts block that mattered more than anyone realized until it was gone.
Questions people also ask
How do I know if my WordPress site has SEO spam on it?
Search Google for 'site:yourdomain.com' and look for page titles you didn't write, often in a foreign language or advertising pharmaceuticals, replica goods or gambling. That search shows what Google has indexed, spam included.
What is the Japanese keyword hack specifically?
A spam injection that creates hundreds of new pages on a hacked site, autogenerated in Japanese, that redirect visitors to spam or affiliate sites while showing search engines different content than a human sees.
Can I clean the site myself, or do I need a service?
A technically comfortable site owner can clean a straightforward infection following a documented process. A site with database-level injection, admin-level compromise, or repeated reinfection is usually worth a professional cleanup service.
Will my rankings come back after cleaning the site?
Usually, once Google recrawls and confirms the site is clean, though the timeline varies and a site that lost rankings due to a manual action needs a reconsideration request before recovery starts.
How was the site hacked if I didn't do anything wrong?
Almost always through an outdated plugin, theme or WordPress core version with a known vulnerability, or a weak or reused admin password — rarely because of something the site owner directly did.
Sources
- How to Clean a Hacked WordPress Site — Sucuri (checked 23 September 2026)
- Malware and hacked sites — Google Search Central (checked 23 September 2026)
- Back up your site — WordPress.org (checked 23 September 2026)
Get your hacked WordPress site cleaned and secured
Book a free 30-minute consultation with Ibrahem and Jeremy. We look at your site while we talk, and you leave with a prioritised plan.
Who wrote this
Jeremy ZavaCo-founder
Leads growth and client partnerships.
Works on: CRO, SEO
Reviewed before publishing by Ibrahem Helal, Co-founder.
- WordPress SEO: the complete guide for 2026How to do WordPress SEO properly: settings, plugins, speed, security, structure and when to leave WordPress for HubSpot or a headless stack.
- WordPress Technical SEO: The Full Fix ListWhy WordPress sites get crawl and indexing problems by default, and the specific settings, sitemap and canonical fixes that resolve them.
- WordPress Speed Optimization That WorksThe concrete steps that move WordPress Core Web Vitals scores: caching, image handling, hosting and the plugin conflicts that undo all three.
- HubSpot CMS SEO: What's Automatic, What Isn'tWhat HubSpot's CMS Hub handles for SEO out of the box, what its built-in recommendations actually check, and where you still need to do the work yourself.