How to Clean a Japanese/Pharma SEO Spam Hack from Your Website

The "Japanese keyword hack" and "pharma hack" are SEO spam infections: attackers inject hundreds of hidden spam pages into your site to hijack your search rankings for their own products — often gambling, counterfeit goods or pharmaceuticals. You may not see anything on your homepage, but Google does, and your listings fill with spam. Here is how to clean it.

How to spot it

Google search results for your site show pages and titles you never created, often in another language.
Search Console reports a surge of unknown indexed pages, or flags a security issue.
The spam is cloaked — shown to search engines but hidden from normal visitors, so it evades casual checks.

Step 1: Secure access and back up

Change your cPanel, admin, database and FTP passwords, and take a full backup.

Step 2: Find the injection

These hacks hide in several places at once:

Injected files and unfamiliar scripts — run a malware scan.
A tampered .htaccess doing the cloaking and redirects — see fixing a malicious .htaccess.
Injected database content holding the spam — see removing malware from the database.
A backdoor that regenerates the spam.

Step 3: Remove it all and reinstall clean

Remove the malicious files and injected content, replace core files with clean official copies, and remove every backdoor — leaving one behind lets the spam return. Restoring a clean pre-infection backup is often the surest route.

Step 4: Recover in search

Once clean, use Search Console to request removal of the spam URLs and a security review, then resubmit your real sitemap. It can take time for Google to drop the spam pages and restore trust.

Frequently asked questions

Why can't I see the spam on my own site?

These hacks use cloaking — they show spam to search engine crawlers but the normal page to regular visitors. That is why it hides in plain sight and why you spot it in Google results, not on your screen.

Will my rankings recover after cleanup?

Usually, but not instantly. After a thorough clean and a Search Console security review, Google gradually removes the spam and restores your standing. Prompt, complete cleanup gives the best recovery.

It came back after I deleted the pages.

A backdoor or injected code is regenerating them. You must remove the underlying files, database injections and backdoors — deleting the visible pages alone never fixes it.