WordPress redirect hack: why visitors are sent elsewhere, and how it's removed
Your WordPress site works fine for you, but visitors report being sent to spam, scam or ad sites. That is the signature of a redirect infection, and it is built to be invisible to the site owner.
Redirect hack removal is part of our malware cleanup, from $199.
What a redirect hack looks like
Visitors land on other sites
Typically scam, fake-update, adult or advertising pages, reported by customers rather than seen by you.
Only on mobile
The redirect fires only for phones and tablets, so desktop checks look normal.
Only from Google
It triggers when the visitor arrives from a search result, and not when typing the address directly.
Only logged-out or first-time visitors
Logged-in administrators and repeat visitors are often skipped on purpose.
Popups and injected ads
New windows, fake alerts or overlays that your theme doesn't produce.
Traffic drops, or Google warns
Search traffic falls, or a browser or Google warning appears.
Why redirects affect only some visitors
Attackers want the infection to last. If the site owner sees the redirect, it gets cleaned quickly, so the malicious code usually checks who is visiting before it acts. It may look at the device type, whether the visitor came from a search engine, whether they have visited before and whether they are logged in to WordPress.
That is why "it works for me" proves little, and why mobile-only redirects and search-engine-only redirects are so common. To check your own site, test from a phone on mobile data, from a private window opened via a Google search result, and from a device that has never visited the site. The redirect diagnosis guide covers this step by step.
Where the redirect code usually lives
The visible symptom is one thing; the code responsible can sit in several layers. A real cleanup checks all of them.
Compromised JavaScript
A script tag or obfuscated snippet added to theme files, plugin files, or stored in the database, loading code from an unfamiliar domain.
PHP malware
Injected code in functions.php, header.php, plugin files or loose PHP files that decides who gets redirected.
Malicious plugins and themes
A plugin or theme that was modified after a vulnerability, or installed from an untrusted source, carrying redirect logic.
Database injections
Scripts or redirect settings stored in posts, widgets or wp_options, which survive a file-only cleanup.
Server rules
Redirect rules in .htaccess or server configuration that apply before WordPress even loads.
Persistence
A hidden administrator, planted file or scheduled task that restores the redirect after it's removed. See backdoor removal.
How we remove a redirect infection
Reproduce and preserve
We confirm the redirect conditions and take a copy of files and database before touching anything.
Trace the source
Core files are compared with the official release, then plugins, themes,
mu-plugins,.htaccess, the database and scheduled tasks are checked for the redirect logic.Remove every layer
The visible redirect, the code that restores it, and any related backdoors and rogue users.
Close the entry point and rotate credentials
Find the vulnerable plugin or stolen password, fix it, and rotate keys and salts so old sessions die.
Re-test under the same conditions
Mobile, search-referred and first-time visits are re-tested, then the site is verified clean and reported on in writing.
Redirect hack FAQ
Why does the redirect come back after I delete it?
Because a second piece of code restored it: a backdoor, a scheduled task or an infected file you didn't find. See why malware keeps coming back.
Can a plugin fix it?
A security plugin may find the obvious file. It rarely finds logic stored in the database or in server rules, and it can't tell you how the site was entered.
Will Google penalise my site?
Redirects to harmful sites can lead to warnings and ranking loss. Cleaning the site and requesting a review is the way back. See flagged and blacklisted sites.
Tell us about your site
Send a short message: your website, what you're seeing, and who hosts it. We'll get back to you with next steps.