How to fix a WordPress spam sitemap injection sitemap666.xml

01Explanation of the hack

The Japanese keyword hack relies on a backdoor planted somewhere in your WordPress installation. Attackers use it to auto-generate malicious sitemaps and spam pages on a schedule — one real-world case resulted in over 10,800 spam pages indexed by Google before it was caught. The first sign is usually a sudden spike in indexed pages, discovered when you check your sitemap and find thousands of URLs you never created. The fix has to target the root cause on your server, not just the symptoms showing up in search results.

02Benefits of a complete cleanup

Rankings

Search rankings recover once Google drops the 404/410 spam pages from its index.

Visitors

Your audience is protected from malware, redirects, and phishing pages served in your name.

Ownership

You regain total administrative control over your own site and hosting environment.

03Features of the attack

• Rapid generation — scripts create spam pages faster than they can be manually deleted.
• Database injections — attackers plant fake entries directly in your wp_posts table.
• Encoded payloads — malicious code is often hidden as base64-encoded strings in wp_options.

04Who this guide is for

This guide is for you if you’ve noticed unfamiliar search results pointing to your own domain. It’s built specifically for WordPress administrators dealing with unauthorized .xml files sitting in their root directory, and it applies just as much if you’ve discovered rogue admin accounts you never created.

05Examples of malicious files

• Files named sitemap666.xml or similar variants.
• Any unrecognized .php or .xml file in your root or content directories.
• Executable .php files sitting inside wp-content/uploads/ — that folder should never contain code.

⚠

Zero tolerance rule: the uploads directory should hold zero executable PHP files. Anything found there is malware, full stop.

06Best practices for recovery

Recovery happens across four phases, in order, so the backdoor is closed permanently rather than just hidden.

Isolate & control access

Lock every door before you start cleaning

• Take a full site and database backup, using cPanel or phpMyAdmin as a fallback.
• Audit Google Search Console and remove any unrecognized users.
• Reset every password: WordPress admins, cPanel, FTP/SFTP, and the database user.
• Generate new SALT keys to force-expire all active sessions immediately.
• Delete any unauthorized admin accounts from the WordPress dashboard.

Clean the server

Remove the code, not just the symptoms

• Delete the rogue sitemap and any strange scripts via File Manager or FTP.
• Purge every .php file from the uploads folder.
• Reset .htaccess to the clean WordPress default.
• Reinstall core, themes, and plugins directly from WordPress.org.
• Delete inactive themes and unused plugins — dormant files are still exploitable.
• Scan the database for Japanese character strings and base64 injections.
• Run a high-sensitivity scan with Wordfence or Sucuri.

Remove spam from Google

Clean up what’s already indexed

• Remove the malicious sitemap inside Google Search Console.
• Test spam URLs to confirm they return a proper 404 or 410 status.
• Submit prefix removal requests to hide spam URLs from results for roughly six months.
• Use a bulk-removal extension from the Chrome Web Store to speed this up.
• Resubmit your legitimate sitemap to prompt a fresh recrawl.

07Tips for securing your site

• Disable in-dashboard file editing by setting DISALLOW_FILE_EDIT to true in wp-config.php.
• Enable two-factor authentication on every admin login, via Wordfence or Google Authenticator.
• Limit login attempts to block brute-force attacks.
• Keep core, plugins, and themes updated to patch known vulnerabilities.
• Consider WPS Hide Login to move your admin path off the default.

08Common mistakes to avoid

✕

Never block spam URLs in robots.txt — if Google can’t crawl the page, it can’t confirm the 404 and the page stays indexed indefinitely.

✕

Never assume simply removing the sitemap fixes the problem — the backdoor will just regenerate it.

✕

Never leave .php files sitting inside your uploads directory.

09FAQs

10Conclusion

Recovering from a spam sitemap injection takes a methodical approach. By working through the four phases — isolating access, cleaning the server, clearing Google’s index, and hardening security — you can permanently close the door on the Japanese keyword hack. Security isn’t a one-time fix; keep your software updated and keep an eye on your search presence.