WordPress Pharma Hack & Japanese Keyword Hack: Signs

By Hridoy Ahmed | Last updated: October 2026 | 8 min read

Short answer: The pharma hack, the Japanese keyword hack and redirect malware are three common ways a WordPress site is hacked for spam. Each one often hides from the site owner and shows only to Google or to visitors from search. Signs include strange pages in Google results, new URLs you never made, and visitors sent to other sites. If you see them, take a backup, scan the site, remove the malicious files and fix how the hacker got in.

This guide covers how to detect, clean and prevent these hacks. It does not explain how to attack a site.

The pharma hack

In a pharma hack, hackers add spam about drugs or other products to your site. The key trick is hiding: your normal visitors see your real pages, while search engines are shown spam. You may only notice when Google results for your site show strange titles or product text.

The Japanese keyword hack

In this hack, hackers create many new pages with Japanese text, often selling products, under your domain. The pages may appear in Google results and in your sitemap while your normal pages look fine.

Redirect malware

Here visitors are sent to another website. Often the redirect only happens on mobile, only for visitors who arrive from Google, or only once, so the owner never sees it. Admins who are logged in are often skipped.

How to check your site

Search Google for your site. Type site:yourdomain.com and look for titles or pages you do not recognise.
Open Search Console. Check the Security issues and Manual actions reports for warnings.
Inspect a URL live. Use the URL Inspection tool and view the tested page to see what Google sees.
Check your sitemap. Look for URLs you did not create.
Review your admin users. Remove any account you do not recognise.
Run a malware scan. Use a scanner such as Wordfence or Sucuri, and compare core files with the official WordPress versions.
Test on a phone using a Google search. Open your site from a search result, not by typing the address.

For more warning signs, read how to know if your WordPress site is hacked.

What to do next

Back up the site first. Keep a copy so you do not lose anything. Do not restore an old backup that may already contain the malware.
Put the site in a safe state. If visitors are at risk, consider maintenance mode while you clean.
Remove the malicious files and database entries. Replace WordPress core, plugins and themes with clean copies from official sources.
Look for backdoors. Hackers often leave a way back in. See how to find a WordPress backdoor.
Change every password and keys. Reset WordPress, hosting, FTP and database passwords, and update the security keys in your configuration.
Update everything. Outdated plugins and themes are a common way in.
Ask Google to review the site. If Search Console showed a security issue, request a review after cleanup.

Cleaning a hack by hand takes care. If you need help, see my WordPress security and malware removal service. My full steps are in how to fix a hacked WordPress site.

How to prevent it

Keep WordPress, plugins and themes updated, and delete the ones you do not use
Use strong, unique passwords and two-factor authentication
Install a firewall. See WordPress firewall (WAF): do you need one?
Use only plugins and themes from trusted sources, not nulled or pirated copies
Keep regular backups and test them
Limit admin users and remove old ones

FAQ

What is the Japanese keyword hack?

It is spam malware that creates many pages with Japanese text on a hacked site, so they appear in search results.

How do I know if I have the pharma hack?

Search site:yourdomain.com on Google. If you see drug or product titles you did not write, your site may be infected.

Why do I not see the redirect myself?

Many redirects are hidden from admins and only trigger for visitors from search, from mobile devices or on the first visit.

Can I fix it by just deleting the spam pages?

No. If you leave the malware or the backdoor, the pages come back. You must remove the cause.

Will Google remove the warning after I clean the site?

If Google showed a security warning, request a review in Search Console after cleanup. Google decides when it is removed.

Think your site is hacked? Message me and I will check it. See my WordPress security and malware removal service.

About the author: Hridoy Ahmed is an SEO specialist and WordPress security expert based in Dhaka, Bangladesh. He has 8+ years of experience and works with clients worldwide.

Related guides

How to clean up the Japanese keyword hack

The Japanese keyword hack fills your site with spam pages, often in Japanese, that show up in Google under your domain. Cleaning it takes more than deleting the pages you can see. Follow this safe order:

Back up the infected site first so you keep a copy for checking, then work on a staging copy where you can.
Check what Google sees. Search site:yourdomain.com and look for pages in another language or with product-style titles you did not write. Check the Security issues and Pages reports in Search Console.
Look for files you did not create: unknown sitemap files, odd PHP files in the root or uploads folder, and recently changed core files. Compare core files with a fresh copy of WordPress.
Check the database and users: look for unknown admin users, strange posts, and injected code in options and posts.
Remove the malware and any backdoor, or restore from a clean backup made before the infection. See WordPress backdoors: how to find them.
Update everything and reset all passwords: WordPress, hosting, database and FTP. Replace the secret keys in wp-config.php.
Make the spam URLs return 404 or 410, remove spam sitemaps, and submit a clean sitemap in Search Console.
Request a review if Google flagged the site, and monitor for several weeks.

If spam pages keep returning after cleanup, a backdoor or a compromised account is probably still there. Read how to fix a hacked WordPress site for the full recovery plan, or see my WordPress security and malware removal service if you want help.

WordPress Pharma Hack, Japanese Keyword Hack and Redirect Malware: How to Spot Them