Website Hacked? Google Showing Spam, Casino or Japanese Pages — How to Clean It and Recover

Quick answer: Search site:yourdomain.com and look for pages you never created — Japanese text, casino, loans, pharma or adult keywords. If you find them, your site is hacked. Change all passwords (hosting, WordPress, FTP, database, domain), take a full backup for evidence, restore a clean backup or have a professional remove malicious files, update the CMS, themes and plugins and remove unused ones, then check Search Console's Security Issues report and request a review. Remove the spam URLs from the index by letting them return 404/410 and, if needed, using the temporary Removals tool. Your Google Business Profile itself isn't affected, but customers clicking your website button will be.

Small business websites, especially WordPress sites with outdated plugins, are common targets. Attackers rarely care about your business; they want your domain's reputation to promote their spam.

Signs your site is hacked

• Google results for site:yourdomain.com show pages you didn't create.
• Search results show your site with Japanese or unrelated titles.
• Chrome or Google shows "This site may be hacked" or "Deceptive site ahead".
• Visitors from Google are redirected to other sites, while direct visits look normal.
• Search Console shows a Security Issues or Manual Actions warning.
• Your hosting company suspends the account for malware or spam.
• Unknown admin users appear in WordPress.

Common hack types

Japanese keyword hack

Thousands of auto-generated pages in Japanese selling counterfeit goods appear under your domain. They are often hidden from logged-in admins.

Redirect hack

Visitors coming from Google or mobile devices are sent to scam sites. The owner, visiting directly, sees nothing wrong.

Injected links and content

Spam links are hidden in your pages' code or footer to boost other sites.

Malware

Scripts that infect visitors or steal data. Browsers may block the site entirely.

Step-by-step cleanup

1. Don't panic or delete everything

Take a full backup of files and database first. It's evidence and helps a professional find the entry point.

2. Change every password

Hosting control panel, WordPress admins, FTP/SFTP, database, email and domain registrar. Use long unique passwords and turn on two-factor authentication.

3. Find how they got in

Common causes: outdated plugins or themes, nulled (pirated) themes, weak admin passwords, old unused installations on the same hosting, and shared hosting with poor isolation.

4. Clean or restore

• Restore a clean backup from before the hack, then update everything immediately.
• Or clean manually: replace WordPress core files with fresh copies, reinstall plugins and themes from official sources, remove unknown files (especially PHP files in uploads), check .htaccess for redirects and remove unknown admin users.
• If you're not technical, hire a reputable security professional or your hosting provider's cleanup service.

5. Remove unused software

Delete unused plugins, themes and old test installations — they're common entry points (website maintenance).

6. Check Search Console

Open Security & Manual Actions. If an issue is listed, fix it and click "Request review", explaining what you did. Reviews usually take days to a couple of weeks (website not showing on Google).

7. Clear spam URLs from search

Make sure spam URLs now return 404 or 410. Google will drop them as it recrawls. For urgent cases use Search Console's Removals tool to hide them temporarily. Submit a fresh sitemap containing only your genuine pages.

Does a hacked website affect my Google Business Profile?

Your profile's ranking isn't directly penalised, but customers clicking "Website" may land on spam or see a warning, which damages trust and conversions. Until the site is clean, consider temporarily linking your profile to a social page or a simple page you control (website link options).

If your Google Business Profile account itself was compromised, that's a different problem (profile hacked or lost access).

Prevention

• Keep CMS, themes and plugins updated; enable automatic minor updates.
• Use only reputable, actively maintained plugins; never use nulled themes.
• Strong passwords and two-factor login for all admin accounts.
• Limit admin users; remove ex-staff and old developers.
• Daily off-site backups, tested occasionally.
• A web application firewall or security plugin.
• HTTPS everywhere (SSL).
• Reliable hosting with isolation and malware scanning (hosting in India).

When to rebuild instead

If the site is old, unmaintained and hacked repeatedly, a fresh rebuild on a simpler platform may be cheaper than repeated cleanups. Keep URLs the same or redirect properly to protect rankings (redesign without losing SEO).

Example: a coaching institute

A coaching institute's WordPress site showed 20,000 Japanese pages in Google. The entry point was an outdated slider plugin. After restoring a backup, updating everything, removing the plugin and requesting review, the warning was lifted in nine days and spam pages disappeared from search over six weeks.

Example: a hotel website redirect

A hotel noticed bookings falling. Mobile visitors from Google were redirected to a betting site. The .htaccess file contained a hidden redirect. After cleanup and password resets, traffic recovered.

Checklist

• Check site: search for unknown pages
• Back up for evidence
• Change all passwords, add 2FA
• Restore clean backup or clean files
• Update and remove unused plugins
• Request review in Search Console
• Let spam URLs 404/410
• Set up backups and security

Key takeaways

• Most small-business hacks come from outdated plugins and weak passwords.
• Search Console tells you about security issues and lets you request review.
• Prevention is far cheaper than cleanup.

Sources and further reading

• Google Search Central — help for hacked sites: developers.google.com/search
• Website maintenance checklist

Frequently asked questions

Why can't I see the spam pages when I visit my site?

Hacks often hide content from logged-in or direct visitors.

Will Google penalise my site permanently?

No — once cleaned and reviewed, warnings are lifted.

How long until spam pages leave Google?

Weeks to a few months as Google recrawls; Removals can hide them faster.

Does it affect my Google Maps ranking?

Not directly, but it hurts trust and clicks.

Can my hosting company help?

Many offer malware scanning and cleanup.

Should I use free nulled themes?

Never — they often contain backdoors.