Your Site Is Fine. Your Google Results Are in Chinese.
You search your own domain and something is badly wrong. Among your real pages there are dozens — sometimes thousands — of results in Chinese characters, pointing at URLs you have never seen. Replica watches. Pharmaceuticals. Betting sites.
Then you log into WordPress and everything is normal. Four pages. The ones you made. Nothing to delete, nothing out of place.
That gap between what you see and what Google sees is not a glitch. It is the whole design of the attack.
What Chinese Text Spam Actually Is
This is injected SEO spam. Someone got into your site and planted code that generates spam pages on your domain, in Chinese, aimed at Chinese-language search results.
They are not selling to your customers. They are using the reputation your domain has built up with Google to get their pages ranked — something a brand new spam domain could never do on its own. Your business becomes free infrastructure for somebody else's operation.
If you have read about the Japanese keyword hack, this is the same attack pointed at a different market. Same entry points, same mechanics, same cleanup. Only the language changes.
Why They Never Appear in Your Dashboard
This is the part that makes people doubt themselves, so it is worth being precise about it.
In most cases the spam pages do not exist as WordPress pages. There is nothing in your Pages list because nothing was added there. Injected code intercepts the request: when Googlebot asks for yourdomain.com/1kqz9/, the code builds a spam page on the spot and serves it. When you ask for the same URL from your browser, logged in as administrator, the code serves a 404 or sends you to the homepage.
The malware checks who is asking. It serves spam to search engines and normal behaviour to you. That is called cloaking, and it is why "I looked and there was nothing there" is not evidence that the site is clean.
How to Confirm It
Three checks, in this order:
Search site:yourdomain.com in Google. This lists what Google has actually indexed for your domain. Spam pages show up here even when they are invisible everywhere else. Page through the results — the injected URLs often start after your legitimate pages.
Open Search Console and look at the page count. Coverage or Pages will show how many URLs Google knows about. A site with twelve real pages reporting several thousand indexed URLs has been injected, with no further diagnosis needed.
Fetch one of the spam URLs as Googlebot. The URL Inspection tool in Search Console renders the page the way Google sees it. If it comes back full of Chinese spam while your browser shows a 404, you have confirmed cloaking.
How It Got In
The same handful of doors as every other mass infection:
- An outdated plugin or theme with a published vulnerability that was never patched
- A nulled plugin or theme, which frequently ships with the backdoor already installed
- A weak or reused administrator password found through brute force or a credential dump
- Another compromised site on the same shared hosting account
None of this is personal. Bots scan continuously for any site with an opening, inject, and move to the next target.
What a Real Cleanup Requires
Deleting what you can see does not work here, because what you can see is almost nothing. The work is at the level the injection actually lives:
Find the generator. The code producing the pages has to be located, usually inside theme files, a plugin, or a PHP file dropped somewhere in wp-content/uploads with an unremarkable name.
Clean the database. Injected entries in wp_options and wp_posts hold configuration and sometimes the spam content itself.
Remove every backdoor. The attacker left at least one way back in. Miss it and the whole thing regenerates within hours, which is the reinfection loop described in why scan-and-delete does not remove modern malware.
Close the entry point. Patch the vulnerability, rotate every credential, review file permissions.
Clean up the search index. Submit a refreshed sitemap, and request removal for the worst URLs so Google drops them faster.
If Google Already Flagged You
Injected spam at this scale frequently escalates into a Safe Browsing warning — the full red screen that blocks every visitor. If that has already happened, the cleanup has to come first and the review request second: see how to get the Google warning removed.
How WPSecureGuard Handles It
With 25+ years of experience securing WordPress and PHP-based websites, we have cleaned dozens of injected SEO spam infections. This variant hides across files, database and server configuration at once, and the cleanup is built to inspect all three rather than trusting a single automated scan.
Our Recovery service is $249 one-time — full cleanup, backdoor removal, .htaccess repair and the blacklist review request, starting within 48 hours. It does not cover reinfection. Recovery Now ($449) starts within 2 hours, 24/7, and adds full hardening against re-entry plus a 30-day reinfection guarantee.