Japanese/Chinese SEO spam attacks are among the most common Joomla compromises. These attacks inject hidden pages, malicious links, redirects, fake products, pharmaceutical spam, gambling pages, or phishing content into a Joomla website.
Typical symptoms:
- Google Search results show thousands of unwanted pages.
- Visitors are redirected to spam websites.
- Google displays "This site may be hacked".
- Website traffic suddenly decreases.
- Strange administrator accounts appear.
- Unknown PHP files appear in Joomla folders.
- .htaccess contains redirect rules.
- Search engines see different content than normal users (SEO cloaking).
The objective of this emergency procedure is:
- Stop the attack.
- Preserve evidence.
- Remove malware.
- Restore Joomla integrity.
- Secure the server.
- Recover Google reputation.
Joomla Japanese/Chinese SEO Spam Hack Emergency Remediation Tutorial
Rapid Incident Response, Malware Removal, Recovery, and Security Hardening Guide
1. Introduction
Japanese/Chinese SEO spam attacks are among the most common Joomla compromises. These attacks inject hidden pages, malicious links, redirects, fake products, pharmaceutical spam, gambling pages, or phishing content into a Joomla website.
Typical symptoms:
- Google Search results show thousands of unwanted pages.
- Visitors are redirected to spam websites.
- Google displays "This site may be hacked".
- Website traffic suddenly decreases.
- Strange administrator accounts appear.
- Unknown PHP files appear in Joomla folders.
- .htaccess contains redirect rules.
- Search engines see different content than normal users (SEO cloaking).
The objective of this emergency procedure is:
- Stop the attack.
- Preserve evidence.
- Remove malware.
- Restore Joomla integrity.
- Secure the server.
- Recover Google reputation.
Phase 1 — Immediate Emergency Containment
Step 1: Put Joomla Website Offline
Login:
https://yourdomain.com/administrator
Navigate:
System → Global Configuration → Site Offline → Yes
Save.
Add an offline message:
Website maintenance in progress. Security remediation underway.
Step 2: Block Public Access at Server Level
Joomla offline mode is not enough.
Apache temporary block
Create:
.htaccess
Add:
<IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{REMOTE_ADDR} !^YOUR_IP_ADDRESS$ RewriteRule ^.*$ /maintenance.html [R=503,L] </IfModule>
Replace:
YOUR_IP_ADDRESS
with your administrator IP.
Nginx temporary block
Example:
location / { allow YOUR_IP_ADDRESS; deny all; }
Reload:
sudo nginx -t sudo systemctl reload nginx
Phase 2 — Create Forensic Backup
Before deleting anything:
Backup Joomla Files
tar -czvf joomla_compromised_backup.tar.gz /var/www/html
Backup Database
Example:
mysqldump -u root -p joomla_database \ > joomla_compromised_database.sql
Store backups outside the web directory.
Example:
/backup/security_incident/
Phase 3 — Identify the Infection
Step 1: Check Recently Modified Files
Attackers usually modify files recently.
Run:
find /var/www/html \ -type f \ -mtime -30 \ -ls
Look for:
- unknown PHP files
- random filenames
- files in images folders
- files in cache folders
Example suspicious files:
images/update.php images/logo_old.php cache/tmp.php media/system/x.php
Step 2: Search for Malware Patterns
Run:
grep -RInE \ "eval\(|base64_decode|gzinflate|gzuncompress|str_rot13|shell_exec|passthru|system\(" \ /var/www/html \ --include="*.php"
Common malware techniques:
- encoded PHP
- hidden backdoors
- remote command execution
- spam generators
Step 3: Find Hidden PHP Files
Joomla folders should normally not contain PHP files:
Check:
find images -name "*.php" find media -name "*.php" find cache -name "*.php" find tmp -name "*.php"
Any unexpected PHP file requires investigation.
Phase 4 — Inspect Critical Joomla Files
Check index.php
Location:
/public_html/index.php
Look for:
- huge encoded blocks
- random variable names
- strange includes
Example malware:
eval(base64_decode("xxxxxxxx"));
Check configuration.php
Review:
public $user = public $password = public $db =
Confirm database credentials are correct.
Check .htaccess
Look for:
RewriteCond %{HTTP_USER_AGENT} RewriteCond %{HTTP_REFERER}
Attackers often create cloaking rules:
Google visitors see spam.
Normal visitors see the real website.
Phase 5 — Database Cleanup
SEO spam often lives inside the database.
Backup database first.
Login:
phpMyAdmin
or:
mysql -u root -p
Search Joomla Content
Look for:
<script iframe casino viagra pharmacy .ru .cn .jp
Example:
SELECT * FROM jos_content WHERE introtext LIKE '%script%';
Check:
Articles
#__content
Modules
#__modules
Users
#__users
Menus
#__menu
Phase 6 — Check Joomla Users
Go to:
Administrator → Users → Manage
Remove:
- unknown Super Users
- unknown administrators
- suspicious usernames
Examples:
admin123 support backup test wordpress manager
Phase 7 — Check Extensions
Most Joomla hacks happen through vulnerable extensions.
Create inventory:
Components Modules Plugins Templates Libraries
Remove:
- unused extensions
- abandoned extensions
- pirated extensions
- unknown plugins
Update:
- Joomla core
- templates
- components
- modules
- plugins
Phase 8 — Clean Joomla Core
The safest method:
Download Clean Joomla Package
Example:
Joomla Latest Release
Extract.
Replace:
administrator/ components/ includes/ libraries/ modules/ plugins/ templates/
Do NOT overwrite:
configuration.php images/ media/ custom extensions
Phase 9 — Clear Cache
Delete:
cache/* administrator/cache/* tmp/*
Commands:
rm -rf cache/* rm -rf administrator/cache/* rm -rf tmp/*
Phase 10 — Password Reset
Change all credentials.
Joomla
- Super User accounts
- Administrators
Hosting
- cPanel
- Plesk
- VPS
Server
- SSH
- SFTP
Database
- MySQL password
External Services
- SMTP
- Google Search Console
- CDN
- DNS provider
Phase 11 — Server Security Hardening
File Permissions
Recommended:
Directories:
755
Files:
644
Example:
find /var/www/html -type d -exec chmod 755 {} \; find /var/www/html -type f -exec chmod 644 {} \;
Disable Dangerous PHP Functions
Edit:
php.ini
Example:
disable_functions = shell_exec, exec, system, passthru, popen, proc_open
Restart:
systemctl restart php-fpm
Install Security Monitoring
Recommended:
- Patchstack
- Admin Tools Professional
- Akeeba Backup
- Fail2ban
- ModSecurity
- Cloudflare WAF
Phase 12 — Google Recovery
Login:
Google Search Console
Navigate:
Security & Manual Actions → Security Issues
Review:
- hacked pages
- malware
- spam URLs
After cleanup:
Request Review
Phase 13 — Post Recovery Testing
Malware Tests
Run:
- Sucuri SiteCheck
- VirusTotal URL scanner
- Google Safe Browsing check
Joomla Tests
Verify:
- Login works
- Extensions work
- Forms work
- Checkout works
- Search works
- SSL works
Phase 14 — Recommended Production Architecture
For a professional Joomla deployment:
Internet | Cloudflare CDN/WAF | Nginx | Varnish Cache | PHP-FPM | Joomla | MariaDB | Redis
Security layer:
Fail2ban + ModSecurity + Daily Backup + File Integrity Monitoring
Phase 15 — Long-Term Prevention Checklist
- Enable Joomla two-factor authentication
- Remove unused extensions
- Monthly Joomla updates
- Weekly security scans
- Daily backups
- Separate development and production environments
- Use SSH keys instead of passwords
- Enable firewall protection
- Monitor Google Search Console
- Use staging before production updates
Recommended Incident Response Timeline
First 30 Minutes
- Offline website
- Backup files/database
- Change admin password
- Block attacker
First 4 Hours
- Scan files
- Remove malware
- Clean database
- Update Joomla
First 24 Hours
- Rebuild clean installation if needed
- Harden server
- Submit Google review
First Week
- Monitor logs
- Review vulnerabilities
- Improve backup strategy
Final Recommendation
For business-critical Joomla websites, the fastest and safest recovery approach is:
- Preserve the compromised site.
- Build a clean Joomla installation.
- Install only trusted extensions.
- Restore verified content.
- Harden the server.
- Monitor continuously.
A hacked Joomla website should be treated as a security incident, not only a website repair task.