Hacked website recovery in Japan – from first response to restored trust

Signs your website has been hacked

Customers and search engines often notice a hack before the site owner does. Hacked website recovery should start right away if you see any of these:

• A "site:yourdomain" search shows hundreds of pages selling products or written in other languages – the so-called Japanese keyword hack is a common example
• Visitors arriving from a phone or from Google get redirected to a different site
• Browsers or search results show a "This site may be hacked" or "Deceptive site ahead" warning
• You cannot log in to the admin panel, or unknown administrator accounts have appeared
• Your hosting company reports malicious files or says the server is sending spam
• Search Console lists hacking or malware under "Security issues"

The home page can look perfectly normal while hidden pages and files sit behind it. If even one item fits, move straight to the first steps below.

What to do first when your site is hacked

Deleting files in a hurry or reinstalling over the top destroys the clues you need to find the cause. Stop the damage and record the situation first.

• Save the current state: back up all files and the database as they are now, hacked content included
• Change every password: WordPress admins, hosting control panel, FTP/SFTP and database – from a computer you trust
• Protect visitors: if people are being redirected or served malware, take the site offline temporarily with a maintenance page
• Contact your host: access logs are kept only for a limited time, so ask them to preserve logs and help with the investigation
• Check for personal data: find out whether contact forms, member data or orders were stored on the site

If personal data may have leaked, Japan's Act on the Protection of Personal Information can require a report to the Personal Information Protection Commission and notice to the people affected. Check the Commission's latest guidance for the exact conditions, and ask for advice early if you are unsure.

Malware cleanup and recovery, step by step

Recovery comes down to three things: find what was changed, return the site to a trusted state, and close the way in. On WordPress the usual order looks like this; other CMSs follow the same logic.

• Scope the damage: recently modified files, PHP files inside wp-content/uploads, .htaccess, wp-config.php, and suspicious scripts or posts in the database
• Return to a clean base: restore a backup you can confirm predates the hack, or reinstall WordPress core, themes and plugins from their official sources
• Remove what was planted: backdoor files, unknown admin users, injected code and spam pages in the database
• Replace the keys: generate new authentication keys and salts in wp-config.php so hijacked sessions stop working
• Close the entry point: an outdated plugin, a reused password or a forgotten second site on the same server – find it and fix it
• Keep watching: monitor file changes and unusual traffic for the following days and weeks

Removing malware while the entry point stays open usually means the site is hacked again within weeks. If layout problems or admin errors remain after cleanup, see fixing WordPress errors.

Clearing Google warnings and cleaning up search results

A clean site does not instantly remove Google's warning or the spam URLs already indexed. After recovery, rebuild trust with search engines like this:

• Read the report: open "Security issues" in Search Console and note the issue types and sample URLs
• Request a review: once every issue is fixed, request a review and describe exactly what you did
• Retire spam URLs: delete pages the hack added and make them return 404 or 410
• Resubmit your sitemap: send a sitemap that lists only your real pages so Google recrawls them
• Track progress: watch "site:" searches and the Search Console page reports as spam URLs drop out

How long reviews take and how fast spam pages disappear varies; it can take several weeks. For a few highly visible URLs, the Search Console removals tool can hide them temporarily while the index catches up.

Restore or rebuild – and how to prevent the next hack

A site built on an old theme and abandoned plugins keeps the same weak points after cleanup. A rebuild is worth considering when:

• There is no backup from before the hack, so you cannot tell which files are original
• WordPress or PHP is several versions behind and updating breaks the site
• The site depends on themes or plugins their developers no longer update
• The same kind of hack has come back more than once in a few months

Either way, prevention rests on the same basics: regular updates of core, themes and plugins, removing unused plugins, two-factor login for admins and backups you have actually tested. Our guide to WordPress security covers the settings, and WordPress maintenance explains how to hand updates off.

How UNANOBO handles a hacked site

Send us your site address and what you have noticed, by message. You get a reply within two business days, and we work out the recovery steps together based on your situation. Besides WordPress, we can also look at moving to Shopify or BASE if that suits your business better.

When a rebuild makes more sense, we build a free demo: a clean new version of your site based on your current content and brand, set up in a fresh environment. You see it on your computer and phone, then decide whether to restore or rebuild. The process is free demo, feedback, launch, growth. The founder handles every project personally, from the first message to maintenance after launch, in Japanese or English.