Short answer: an attacker is generating spam pages on your domain and showing them to search engines while your own visits look normal. That cloaking is the defining trait, and it is why owners usually find it through Search Console rather than by browsing.
Confirm it the way a crawler sees it
Search site:yourdomain.com for Japanese or unexpected-language results, and open Search Console › Pages and Security & Manual Actions. Use the URL Inspection tool with “Test live URL” on a flagged page — it fetches as Googlebot and reveals the spam your browser is not shown. Checking the page in your own browser proves nothing, because the code inspects the request and only serves spam to crawlers.
Find and remove the generator
- Search files for obfuscation:
grep -RIlE 'eval\s*\(|base64_decode\s*\(|gzinflate\s*\(|str_rot13\s*\(|assert\s*\(|create_function\s*\(' wp-content/across the install, includinguploadsandmu-plugins. - Reinstall WordPress core over itself and reinstall plugins from clean sources so injected core/plugin files are overwritten.
- Audit the database: injected
wp_postsspam, alteredwp_options, and rogue sitemap entries the attacker created. - Check
wp_usersfor unauthorised administrators and the cron array for a regeneration task.
Close the entry point
The infection almost always came through a vulnerable plugin/theme or stolen credentials. Update or replace the vulnerable component and rotate all credentials, or the spam simply regenerates.
Recover search visibility properly
Cleaning files is half the job. The spam URLs are indexed, so they must return the correct status (404/410), your legitimate sitemap must be accurate, and any manual action needs a reconsideration request that honestly describes what happened and what was fixed — submitted only once the site is genuinely clean. Then monitor indexed pages for weeks; a missed backdoor shows up as a slow return of spam URLs.
WP REPAIR INCIDENT STANDARD
Safe intervention sequence
Japanese keyword spam commonly combines cloaking, generated URLs and persistence. Cleaning visible pages without removing the generator and controlling indexed URLs leaves the incident unfinished.
- Confirm affected URLs through Search Console and live inspection, not only your browser.
- Map whether spam is stored in posts/options or generated dynamically from files and rewrite rules.
- Audit sitemaps, users and cron for mechanisms that create or advertise new URLs.
- Return correct 404 or 410 responses for removed spam instead of redirecting everything to the home page.
What must be verified
- Live inspection shows legitimate content to crawlers.
- Spam URLs return the intended status and disappear from sitemaps.
- No new unexpected-language URLs appear over the following weeks.
Official technical sources
This guide explains the diagnosis. If the site is affected now, the intervention should preserve a rollback path and verify the real business journey.
See the emergency repair service →ABOUT THIS SYMPTOM
Frequently asked questions about this guide.
Why can't I see the Japanese spam pages when I open my own site in a browser?+
Because the injected code is cloaked — it inspects the incoming request and only serves the spam content to crawlers like Googlebot, showing your normal site to everyone else. Checking the page as a regular visitor proves nothing; you need to use Search Console's URL Inspection tool with 'Test live URL' to see what a crawler actually receives.
I removed the spam pages and files, why do they keep reappearing?+
Almost always because the entry point — a vulnerable plugin, theme, or stolen credentials — was never closed, or a cron task is regenerating the pages on schedule. Removing the visible spam without closing the vector or checking the cron array just resets the clock until it comes back.
Does deleting the spam pages fix my search rankings automatically?+
No. The spam URLs are already indexed by Google, so they need to actually return the correct 404 or 410 status, and your legitimate sitemap needs to be accurate. If a manual action was applied, it also requires a reconsideration request submitted only once the site is genuinely clean.
How is this different from a generic malware infection?+
The defining trait here is cloaking specifically aimed at generating and indexing foreign-language spam pages under your domain, discovered through Search Console rather than by browsing. The underlying causes and cleanup steps overlap with general malware, but detection relies on seeing the site the way a crawler does.