If visitors report being sent to scam, ad or fake-update pages but your site loads normally for you, the redirect is conditional. It checks who is visiting before it acts, and that is why it's hard to catch. This guide covers how to reproduce it and where the code usually sits.
Why you can't see it
Redirect malware commonly checks one or more of these before triggering: the device type, the referrer (whether the visitor came from a search engine), whether the visitor has been to the site before, and whether they're logged in to WordPress. Administrators are usually excluded, so the person most likely to spot the problem is the one who never sees it.
Reproduce it safely
- Open the site on a phone using mobile data, not your office Wi-Fi.
- Search for your site on Google and click the result in a private window, so you arrive with a search referrer and no cookies.
- Try a device or browser profile that has never visited the site.
- Note which pages trigger it: only the home page, only posts, only certain URLs?
Writing down the exact conditions is useful whoever does the cleanup, because the same conditions are used to verify it afterwards.
Where the redirect code usually lives
| Location | What to look for |
|---|---|
| Theme files | Unfamiliar script tags or obfuscated blocks in header.php, footer.php and functions.php |
| Plugin files | Recently changed files in plugins, including inactive ones |
mu-plugins | Any file you didn't put there. Must-use plugins load automatically. |
.htaccess | Rewrite rules that reference user agents or referrers and point to external sites |
| Database | Script tags in posts, widgets and options; unfamiliar domains in wp_options |
| Third-party scripts | Tag managers, ad scripts or embeds that load code from a domain you don't recognise |
Checks you can do from the page itself
In the browser's developer tools, open the Network tab and reload the page. List the domains it loads scripts from and look for any you don't recognise. In the page source, search for <script and check where each one comes from. Neither check proves a site is clean, but an unfamiliar script domain is a good lead.
Fixing it properly
- Preserve a copy of the files and database before changing anything.
- Verify core and plugin files against the official copies and replace anything that differs.
- Check the database for injected scripts and unexpected options.
- Review users and scheduled tasks for anything that could restore the redirect. See WordPress Backdoors: How Reinfection Happens.
- Rotate credentials and replace the salts in
wp-config.php. - Find the way in, usually an outdated plugin or a stolen password, and fix it.
- Re-test under the same conditions that triggered the redirect.
If the redirect returns after you delete it, something else restored it. See WordPress Malware Keeps Coming Back: Why Reinfections Happen.
When to get help
If you can't locate the source, or it keeps returning, redirect hack removal is part of our malware cleanup, from $199. Related background: The Complete WordPress Hacked Site Recovery Guide.
Further reading
Dealing with this on a live site?
Send us the details and we'll tell you what we'd do and what it would cost.