Short answer: an attacker is generating spam pages on your domain and showing them to search engines while your own visits look normal. That cloaking is the defining trait, and it is why owners usually find it through Search Console rather than by browsing.
Confirm it the way a crawler sees it
Search site:yourdomain.com for Japanese or unexpected-language results, and open Search Console › Pages and Security & Manual Actions. Use the URL Inspection tool with “Test live URL” on a flagged page — it fetches as Googlebot and reveals the spam your browser is not shown. Checking the page in your own browser proves nothing, because the code inspects the request and only serves spam to crawlers.
Find and remove the generator
- Search files for obfuscation:
grep -RIlE 'eval\s*\(|base64_decode\s*\(|gzinflate\s*\(|str_rot13\s*\(|assert\s*\(|create_function\s*\(' wp-content/across the install, includinguploadsandmu-plugins. - Reinstall WordPress core over itself and reinstall plugins from clean sources so injected core/plugin files are overwritten.
- Audit the database: injected
wp_postsspam, alteredwp_options, and rogue sitemap entries the attacker created. - Check
wp_usersfor unauthorised administrators and the cron array for a regeneration task.
Close the entry point
The infection almost always came through a vulnerable plugin/theme or stolen credentials. Update or replace the vulnerable component and rotate all credentials, or the spam simply regenerates.
Recover search visibility properly
Cleaning files is half the job. The spam URLs are indexed, so they must return the correct status (404/410), your legitimate sitemap must be accurate, and any manual action needs a reconsideration request that honestly describes what happened and what was fixed — submitted only once the site is genuinely clean. Then monitor indexed pages for weeks; a missed backdoor shows up as a slow return of spam URLs.
WP REPAIR INCIDENT STANDARD
Safe intervention sequence
Japanese keyword spam commonly combines cloaking, generated URLs and persistence. Cleaning visible pages without removing the generator and controlling indexed URLs leaves the incident unfinished.
- Confirm affected URLs through Search Console and live inspection, not only your browser.
- Map whether spam is stored in posts/options or generated dynamically from files and rewrite rules.
- Audit sitemaps, users and cron for mechanisms that create or advertise new URLs.
- Return correct 404 or 410 responses for removed spam instead of redirecting everything to the home page.
What must be verified
- Live inspection shows legitimate content to crawlers.
- Spam URLs return the intended status and disappear from sitemaps.
- No new unexpected-language URLs appear over the following weeks.
Official technical sources
This guide explains the diagnosis. If the site is affected now, the intervention should preserve a rollback path and verify the real business journey.
See the emergency repair service →