How to Clean Japanese Keyword Hack in WordPress (Diagnostic Runbook)

Immediate Diagnostic: Scan and Identify Injected Japanese Spam Files

# 1. Search for rogue Japanese character injections in posts
wp db query "SELECT ID, post_title, post_name FROM wp_posts WHERE post_title REGEXP '[\x{3040}-\x{30ff}\x{3400}-\x{4dbf}\x{4e00}-\x{9fff}]' LIMIT 10;" --path=/var/www/html

# 2. Check for unauthorized administrative users
wp user list --role=administrator --path=/var/www/html

# 3. Scan for rogue sitemaps created in root or wp-content
find /var/www/html -maxdepth 3 -name "*sitemap*.xml" -newermt "30 days ago"

# 4. Search for backdoor file generators and base64 payloads
grep -rnEi "(eval\(base64_decode|gzinflate\(base64_decode|assert\(|passthru\()" /var/www/html/wp-content/

The Japanese Keyword Hack (Japanese SEO Spam) dynamically injects thousands of counterfeit spam URLs into your WordPress site to monetize cloaked search traffic. The commands above locate the rogue database rows, sitemaps, and PHP backdoors on your server.

1. Force Reinstall Clean WordPress Core and Verified Plugins

# Verify integrity of WordPress core files against official checksums
wp core verify-checksums --path=/var/www/html

# Force download and overwrite core files without touching wp-content
wp core download --skip-content --force --path=/var/www/html

# Force reinstall all active plugins from WordPress.org repository
wp plugin install $(wp plugin list --field=name --path=/var/www/html) --force --path=/var/www/html

# Lock down file and directory permissions
find /var/www/html -type d -exec chmod 755 {} \;
find /var/www/html -type f -exec chmod 644 {} \;
chmod 444 /var/www/html/wp-config.php

Do not attempt to manually edit infected core files. Reinstalling core files and clean plugin releases replaces tampered files while preserving your database and valid uploads.

2. Purge Injected Spam Database Rows and Rogue Users

# Backup the database prior to purge
wp db export /var/www/html/pre_cleanup_backup.sql --path=/var/www/html

# Delete all spam posts containing Japanese characters
wp db query "DELETE FROM wp_posts WHERE post_title REGEXP '[\x{3040}-\x{30ff}\x{3400}-\x{4dbf}\x{4e00}-\x{9fff}]';" --path=/var/www/html
wp db query "DELETE FROM wp_postmeta WHERE post_id NOT IN (SELECT ID FROM wp_posts);" --path=/var/www/html

# Securely remove temporary SQL backup
rm -f /var/www/html/pre_cleanup_backup.sql

Attackers inject backdoor admins into wp_users and insert orphaned spam metadata into wp_postmeta. Purging both eliminates re-infection triggers.

3. Inspect and Reset .htaccess and Nginx Rewrite Rules

# Inspect hidden cloaking rules in .htaccess
cat /var/www/html/.htaccess

# Restore standard clean WordPress .htaccess
cat << 'EOF' > /var/www/html/.htaccess
# BEGIN WordPress
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress
EOF

chmod 644 /var/www/html/.htaccess

Japanese Keyword Hacks often append conditional rewrite rules checking for Googlebot user agents (e.g., RewriteCond %{HTTP_USER_AGENT} (googlebot|bingbot)). Restoring the default WordPress rewrite configuration disables cloaking immediately.

4. Return 410 Gone for Injected URLs & Invalidate Google Index

# Add 410 Gone rule to .htaccess for typical spam URL patterns
cat << 'EOF' >> /var/www/html/.htaccess

# Return 410 Gone for Japanese Hack spam parameter URLs

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (id|shop|item|buy)=[0-9]+ [NC]
  RewriteRule ^ - [G,L]

EOF

# Invalidate and regenerate XML sitemap
wp cache flush --path=/var/www/html

Returning HTTP 410 Gone signals Google Search Console to drop the indexed spam URLs permanently, accelerating recovery of your domain’s organic ranking.

---

Escalate to SiteSuraksha Malware Removal

If rogue sitemaps regenerate, cloaked redirects persist on mobile devices, or your domain has received a Google Search Console manual action, escalate to SiteSuraksha.

SiteSuraksha provides emergency malware cleanup, WAF threat blocking, Google blacklist removal, and continuous security monitoring for Indian businesses.