07-11-2026

How to Find & Fix Japanese SEO Spam

You type your company name into Google. Your domain shows up, but the page titles underneath are in Japanese. One of them is advertising discount designer watches.

Nobody on your team wrote that.

This is Japanese SEO spam, and it’s common enough that Google keeps a dedicated cleanup guide for it. The worst part? Your website probably looks perfectly normal when you open it. At Bragyst, a digital marketing agency in Qatar that builds and manages websites for businesses across the GCC, we treat this as an emergency, not a glitch. Here’s how to check your site, clean it properly and keep it clean.

Japanese SEO spam, also called the Japanese keyword hack, is an attack that creates auto-generated Japanese pages on your website to sell counterfeit goods through Google. How do you find it? Three free Google tools do most of the work: a site: search, the Security Issues report and the URL Inspection tool. Fixing it means locking the hacker out, cleaning every infected file and then asking Google to take another look.

What is Japanese SEO spam?

Japanese SEO spam is a hack where attackers create pages full of Japanese text and keywords on your domain. Google’s own guide says these pages usually sit in random folder names, something like example.com/ltjmnjp/341.html. They make money through affiliate links to shops selling fake branded goods.

Why your site?

Because your domain already has trust. A new spam site starts at zero. Yours has years of history with Google, so the hackers borrow it.

The pages get indexed. Your site starts ranking for thousands of Japanese searches you’ve never heard of. Anyone who clicks gets sent off to the counterfeit store.

This isn’t a WordPress-only problem either. Joomla, Drupal, Magento and custom-built sites get hit too. What they share is an open door somewhere.

Why can’t you see the spam on your own website?

You usually can’t see it because the hack uses cloaking. The infected code checks who is visiting. If it’s Google’s crawler, it serves the spam. If it’s you on Chrome, it serves your normal page. Some versions even show a fake 404 error, so you assume the page is already gone.

This is what makes the hack so stubborn.

Your homepage loads. Your contact form works. Your team notices nothing for weeks, while Google reads a completely different website under your name.

Sucuri’s analysts described one case where a site looked clean in Firefox, Chrome and Safari. The spam appeared only after they switched the browser’s user agent to Google’s. The code behind it was tucked into the WordPress must-use plugins folder, inside a file dressed up as a log.

So don’t trust your own eyes here. Trust the tools that see what Google sees.

How do you find Japanese SEO spam on your site?

Start with Google’s own data. Search site:yourdomain.com and scan a few pages of results for Japanese titles or strange URLs. Then open the Security Issues report in Google Search Console. Finally, run any suspect URL through the URL Inspection tool. It shows the hidden content Google actually received.

Here’s the full check, in order:

1. Run a site: search. Type site:yourdomain.com into Google. Scroll past the first page, because spam often hides on page three or four. Spot a Japanese title or a folder name like /ltjmnjp/? That’s your answer. Try the same search on Bing too.
2. Open the Security Issues report. If Google has already spotted hacked pages, it will say so here.
3. Inspect suspicious URLs. Paste them into the URL Inspection tool to see the page the way Google does, cloaking included.
4. Check who owns your Search Console property. Go to Settings, then Users and permissions. A stranger listed there is bad news. Google says hackers add themselves as owners so they can mess with your geotargeting and sitemaps.
5. Open your sitemap. Has someone added a new one? Hackers do this so Google finds their pages faster.
6. Scan the site. A free scanner like Sucuri SiteCheck can flag spam that’s served only to search engine bots.

Got an email from Google about a new verified owner you never added? Skip straight to the fix. Google treats that alert as a strong sign the site has been hacked.

How do you fix Japanese SEO spam?

Back up the site first. Then kick the hacker out of Search Console and delete the token they used to get in. Reinstall your core files and plugins from clean copies. Replace .htaccess. Clean the sitemap and the database. Change every password, patch everything and finish by asking Google to review the site.

Step by step:

1. Take a full backup. Yes, of the infected site. It sounds backwards, but Google recommends it. Delete the wrong file and you’ll want it back.
2. Remove unknown Search Console owners. Revoke their access straight away. Then delete their verification token. Most of the time it’s a small HTML file sitting in your root folder. Can’t find one? Look in .htaccess for a rewrite rule that fakes it.
3. Replace your .htaccess files. Hackers use them for redirects as well as fake tokens. If you never added custom rules, swap each one for your CMS’s default version.
4. Reinstall core files, themes and plugins. Download fresh copies from official sources. This overwrites anything hiding inside them.
5. Hunt down leftover files. Your uploads folder shouldn’t hold PHP files. Look for code calling functions like base64_decode or eval, which attackers use to disguise what a file does. Check the must-use plugins folder as well.
6. Clean the database. Remove spam posts, pages and injected content. Delete any admin user you don’t recognise.
7. Fix the sitemap. Take out the spam URLs. If a sitemap holds nothing but spam, delete the whole file.
8. Change every password. That means your CMS admin, hosting account, FTP and database user. Make each one long and unique.
9. Update or remove everything else. Every outdated plugin is a door left open. Delete the ones nobody uses.
10. Ask Google to review the site. Once it’s clean, request a review from the Security Issues report.

A quick warning. Half-done cleanups are how this hack survives. Delete the visible pages but miss one backdoor file, and the spam pages can simply regenerate.

What does Japanese SEO spam do to a business in Qatar?

It quietly damages the visibility you worked to build. Google may label your results as possibly hacked. Browsers can show warnings. Your real pages also end up competing with thousands of spam URLs. For a Qatar business that wins customers through search, that means fewer enquiries until the site is clean.

Think about who’s searching. A facilities manager in Lusail looking for a supplier. A family in Al Wakrah comparing clinics.

They see your name next to Japanese text, or a “This site may be hacked” label.

Do they click? Almost never.

As a digital marketing agency in Qatar, we look at this from the visibility side first. Months of work from SEO services in Qatar can stall while Google sorts your real pages from the fake ones. Paid campaigns suffer too, because ad platforms are wary of sending traffic to a compromised site.

So yes, it’s a security problem. It’s also a marketing one.

How do you stop Japanese SEO spam from coming back?

Lock the doors the hacker used. That means updates, two-factor login, fewer admins, a firewall and automatic backups. Boring stuff? Yes. It’s also what stops the second infection. Add a monthly Search Console check and you’ll catch anything new early.

The checklist:

• Updates switched on, or checked weekly
• Unused plugins and themes deleted
• Two-factor login on every admin account
• Limited login attempts
• A web application firewall
• Automatic off-site backups
• A monthly look at Search Console users and the Security Issues report

Here’s what nobody mentions in a website pitch. Almost all of this is decided on the day your site is built. So when you compare one web design company in Qatar with another, ask about security before you ask about the homepage. A good build arrives with backups and monitoring switched on. A rushed one leaves the doors open.

The sites at most risk are usually the ones nobody has logged into for a year.

Need help from a digital marketing agency in Qatar?

This hack survives on one thing: you not looking. While your team sees a normal site, Google is reading somebody else’s story under your brand name.

So check what Google sees. Run a site: search today. Then check the owners list in Search Console. Anything strange? Clean all of it. Halfway doesn’t count.

Bragyst is a digital marketing agency in Qatar with in-house web developers and SEO specialists. Reach out to the team at bragyst.com and we’ll check what Google is seeing on your site, then help you fix it.