Google displays a Japanese product title or pharmaceutical offer for the homepage, while a direct visit still shows the legitimate business. This can result from cloaked malware, injected metadata, generated spam URLs or an old infected response still in the index.
Do not overwrite the homepage title repeatedly. Find what search crawlers and clean visitors actually receive.
Capture the search evidence
Record the exact query, result title, snippet, displayed URL and date. Export affected examples from Search Console where possible.
Check whether the result points to the homepage, an unfamiliar path or a parameterised URL. A changed homepage title and thousands of generated product pages can be related but are not the same symptom.
Avoid clicking suspicious results in a normal browser session.
Compare current responses
Request the canonical homepage as a clean logged-out visitor and inspect page source for title, canonical tag, structured data and unfamiliar scripts.
Then perform an authorised comparison using a search-engine-like user agent and search referrer. Selective output can depend on user agent, cookies, IP or referrer.
If all current responses are clean, keep investigating before concluding that the alert is stale. CDN nodes and server-side conditions may vary.
Review rewrite and template injection
Inspect .htaccess, server rules, root PHP files, active/must-use plugins and the current theme. Look for code that changes output based on crawler, path or request parameter.
Search the database for the spam title, external domain and distinctive product terms. Review posts, options, widgets and plugin tables.
Do not bulk-delete every row matching a common Japanese character or medicine name. Legitimate multilingual content, orders or comments may contain them.
Check generated spam URL patterns
Group examples by path structure, such as random directories, product-like slugs or .html endings. Request a sample from each group and record status and response.
Malware can generate content for any matching URL without storing individual pages. Removing visible posts will not stop a rewrite-based generator.
After cleanup, nonexistent spam URLs should return honest 404 or 410 responses rather than a homepage 200.
Inspect metadata and structured data
The visible page can look normal while <title>, Open Graph tags, JSON-LD or hidden links contain spam. Compare raw HTML, not only the rendered viewport.
Check the SEO plugin’s title templates and database settings. An unknown administrator may have changed global metadata without installing a file payload.
Preserve the original injected value and owner evidence before restoring legitimate settings.
Clean the site before requesting reindexing
Preserve files, database and logs. Remove confirmed malicious code/content, replace modified trusted files, patch vulnerable components and rotate affected credentials.
Review scheduled tasks, hidden users, application passwords, hosting redirects and neighbouring installations for persistence.
Only after the public site is clean should you submit corrected sitemaps, validate Search Console security issues and use temporary removal tools for particularly harmful results where appropriate.
Verify search recovery
Retest crawler-like and ordinary responses for the homepage and representative spam paths. Monitor server logs and Search Console for new generated URLs.
Search snippets update after recrawl, not immediately after cleanup. Keep titles, canonicals and status codes stable so search engines receive consistent evidence.
Do not create redirects from every spam URL to the homepage; that can produce soft-404 signals and keep low-quality paths alive.
When specialist help is useful
Request an assessment when search engines see content administrators cannot reproduce, spam paths continue growing or database and file scanners disagree. Send sample public URLs and screenshots without passwords.
A complete repair addresses the generator, entry route, persistence and search-facing cleanup—not only the homepage title shown in WordPress.