Not every hack defaces your homepage. Some of the most common ones are designed to stay invisible to you while using your site's reputation to sell something else. Two classic examples are the Japanese keyword hack and the pharma hack.

What they have in common

Both are forms of SEO spam. An attacker gets into your site and adds hundreds or thousands of pages, or injects links and text, to advertise things such as counterfeit goods or medication. The pages are shown to search engines, and the goal is to rank them using your domain's trust.

The attack depends on cloaking: the site shows different content to different visitors.

  • If you open the site yourself, everything looks normal.
  • If a search engine's crawler visits, it receives the spam.
  • Sometimes visitors who arrive from a Google search result are redirected to a shop or scam page, while visitors who type the address directly see the normal site.

This is why owners often learn about it from a customer or a strange search result, not from their own site.

The Japanese keyword hack

In this attack, the hacker creates a large number of pages with Japanese text, usually advertising brand-name products. The site's own address appears in Google results with Japanese titles and descriptions.

Typical signs:

  • Searching site:yourdomain.com in Google shows pages with Japanese text you never wrote.
  • Your sitemap, or a new sitemap file, lists thousands of unfamiliar addresses.
  • New files or folders with random names, and changes to files such as .htaccess or index.php.
  • A sudden spike in indexed pages in Google Search Console, and a drop in clicks for your real pages.

The pharma hack

The pharma hack inserts hidden links and text about pharmaceutical products into your pages or into the head of your site. Search engines see the keywords, and visitors do not.

Typical signs:

  • Google results for your site mention pills or medication.
  • Searching your site's pages with a crawler-like user agent shows text you cannot see in the browser.
  • Spam links, hidden with CSS, in your theme's footer or header.
  • Unexpected code in theme files, especially functions.php, header.php and footer.php, often hidden in long, unreadable strings.

How to check your own site

Because the content is cloaked, you have to look the way a search engine does:

  1. Search Google for site:yourdomain.com and scroll through the results, looking for titles you do not recognise.
  2. Use Google Search Console. The Pages report shows how many pages are indexed, and the Security issues report may list the hack.
  3. View the page source and search for the unfamiliar words, or for hidden elements.
  4. Run a check that looks from the outside. The free website hack check looks for spam keywords, hidden links, injected scripts and cloaking, and it compares what a normal visitor and a search-engine crawler receive.

How to clean it up

The cleanup steps are the same as for any hacked WordPress site, see my website was hacked: what to do first. With SEO spam, pay attention to these extra points:

  • Delete the spam files and any backdoors, not just the visible pages. The attacker usually left a way back in.
  • Check the database for injected posts and options, and the .htaccess file for redirect rules.
  • Reset all passwords and security keys, and remove unknown admin users.
  • Clean up in Google Search Console. Submit a clean sitemap, and use the removals tool for the spam addresses. If Google flagged the site, request a review. See how to remove the "Deceptive site ahead" warning.
  • Return the right status for dead pages. Spam addresses that no longer exist should return 404 or 410, so search engines drop them.

Prevent a repeat

These attacks usually come through an outdated plugin or theme, or a stolen password. Keep everything updated, remove unused plugins, use unique passwords with two-factor authentication, and keep recent off-server backups. Because the attack hides from you, automatic checks matter: ServerMonitor regularly compares what visitors and crawlers receive and looks for spam keywords, hidden links and injected scripts, so you hear about it early.