Why does my website show Japanese text in Google results?

Someone got into the site and planted a script that makes thousands of Japanese shop pages for search engines only, the Japanese keyword hack. They are often hidden from visitors (cloaking), so you only see them in Google. Search site:yourdomain.com to list them.

Why can't I see the Japanese pages when I open them?

The planted script checks who is asking and shows the spam only to Google's crawler, so a visitor sees the normal site or a not-found page. Search Console's URL Inspection with Test live URL shows what Google is served.

Do I need to remove anyone from Google Search Console?

Often yes. The attacker usually verifies themselves as an owner and submits their own sitemap. Remove unknown owners under Settings > Users and permissions, delete the verification file, meta tag or DNS record they used, and remove sitemaps you did not add.

More fixes

Japanese text in your Google results

Q: How long until the Japanese pages disappear from Google?

After the cleanup and a review request in Security issues, the warning usually clears within days. The pages drop out as Google revisits each one and gets not found, which takes weeks to a few months. Do not block them in robots.txt or redirect them; let them return 404.

You search for your business and Google lists pages on your own domain with Japanese titles: cheap brand bags, watches, "free shipping". Click one and you may land on your normal home page, or on a page that is not there. Nobody on your side wrote them. This is a well-known attack Google itself calls the "Japanese keyword hack": someone got into the site, made thousands of pages for search engines only, and often added themselves as an owner of your site in Google Search Console so they could push those pages into Google. Below is a rebuilt example (not a real client), how to see the pages Google sees, and the cleanup in the order that keeps them from coming back.

Google, searching your own site

What the checks found

First: see what Google sees

Search Google for site:yourdomain.com (your own domain, no space after the colon). Scroll a few pages. Adding a word such as site:yourdomain.com japan or site:yourdomain.com 激安 brings the planted pages to the top. Note two or three of their addresses; you will need them.
Open one of those addresses yourself. If you see your normal site or a "not found" page, the hack is cloaking: it shows the Japanese page only to Google. That is why the owner is usually the last to notice.
In Google Search Console (search.google.com/search-console), open Security & Manual Actions > Security issues. A "Hacked: content injection" or "URL injection" notice confirms it and lists sample pages. Then use URL Inspection on one planted address and press Test live URL > View tested page: that is exactly what Googlebot is served right now.

No Search Console account yet? Make one now and verify the site; it is free, and you cannot finish the cleanup without it.

The cleanup, in order

Step	Why	How
1. Remove the stranger from Search Console	The attacker often verifies themselves as an owner and submits their own sitemap, so Google keeps fetching the spam even after you delete it	Settings > Users and permissions: remove any owner you do not know. Then delete what verified them, or they simply re-verify: a file named like `google1a2b3c.html` in the site's top folder, a `google-site-verification` meta tag in the theme header, or a TXT record at your domain's DNS. Under Sitemaps, remove any sitemap you did not add
2. Lock the doors	Cleaning first and changing passwords later lets them walk back in	Change the passwords for hosting, SFTP/FTP, the database, and every WordPress administrator. In Users, delete administrators you do not recognise. Replace the security keys in `wp-config.php` with a fresh set from `https://api.wordpress.org/secret-key/1.1/salt/`; that signs everyone out
3. Find the planted files	The pages are made on the fly by a small script; deleting pages in the dashboard does nothing	In the host's file manager, sort by date modified and look at what changed around when the Japanese pages first appeared. Usual places: odd files in the top folder (random names, or a renamed `index.php`), new rules in `.htaccess` that mention Googlebot or send requests to a PHP file, and any `.php` file inside `wp-content/uploads` (there should be none). A scanner such as Wordfence or the host's malware scan lists most of them
4. Replace, don't patch	A file that was edited once may hide more than you can see	Reinstall WordPress itself (Dashboard > Updates > Re-install version; your content stays). Delete and reinstall each plugin and the theme from their official source. Remove anything you no longer use, and any "free" copy of a paid plugin: those are the most common way in
5. Close the hole	If the way in stays open, it happens again within weeks	Update everything, then check the plugin list against known holes (Wordfence and Patchstack both publish them). Old PHP is a door too: see "PHP Update Recommended". Ask the host whether other sites in the same account were hit; one old site can infect its neighbours
6. Tell Google	The warning and the spam pages do not leave on their own quickly	Check that a planted address now returns "not found" (404) to Googlebot too (URL Inspection, Test live URL). Then in Security issues press Request review and say in two lines what you removed and how you closed the hole. For the worst pages, Removals > New request hides them from results while Google recrawls

How long until the Japanese results go away

A review usually comes back within days. The pages themselves drop out as Google revisits each one and gets "not found", which takes from a few weeks to a few months for a large batch. Watch Pages (Indexing) in Search Console: the count of indexed pages should fall back towards what you really have. If new Japanese pages keep appearing after the cleanup, something in step 3 was missed, usually a second script or a scheduled task the attacker added.

What not to do

Do not block the spam pages in robots.txt. Google then cannot see that they are gone, and they can stay in the results longer.
Do not redirect the spam addresses to your home page. Let them return "not found", which is the signal Google needs to drop them.
Do not restore last month's backup and stop there. It brings back the same hole, and the backup may already hold the planted files.
Do not skip step 1. As long as the stranger owns your site in Search Console, they can keep feeding Google their sitemap.

The searches and step 1 take a few minutes; steps 3 to 5 are where most people would rather have someone do it. If that is you, the box below is for that. Related: hidden casino or pharmacy spam, site sends visitors to a spam page and site not showing up on Google.