A WordPress site owner reported a strange redirect issue: visitors coming from Google Search were being sent to random, potentially harmful websites. But when the owner checked the site while logged in, everything looked normal.

This is a common sign of a cloaked malware redirect.

The malware does not always redirect every visitor. Instead, it may only trigger for guest users, mobile users, visitors from search engines, or requests that look like Googlebot. Logged-in administrators often see a clean version of the site, which makes the infection harder to notice during normal testing.

In this case, a regular scan did not immediately show the problem because the malicious behavior was conditional. The redirect only appeared under specific visitor conditions.

This guide explains how search-result redirects happen, how to investigate them, what to check inside WordPress, and how tools like the Securewp Remote Security Scanner and SiteFort Security Plugin can help detect and prevent this type of attack.

What Is Cloaked Redirect Malware?

Cloaked redirect malware is malicious code that shows different behavior depending on who visits the website.

For example:

  • Logged-in admins see the normal website.
  • Guest visitors from Google Search are redirected to spam or scam pages.
  • Mobile visitors are redirected, but desktop visitors are not.
  • Googlebot sees injected spam content.
  • Only first-time visitors are redirected.
  • The redirect happens only once per browser session.

This makes the infection harder to detect because the site may look clean when the owner checks it directly.

Google considers sneaky redirects to be a spam practice when users are sent somewhere unexpected or when users and search engines are shown different content.

Common Symptoms of Search-Result Redirect Malware

You may be dealing with this type of infection if you notice:

  • Visitors from Google are redirected to suspicious websites.
  • The redirect does not happen when you are logged in as admin.
  • The redirect happens only on mobile devices.
  • Search results show spam titles or descriptions.
  • Google Search Console shows security issues or suspicious indexed URLs.
  • Some pages redirect only when the referrer is Google, Bing, Yahoo, or another search engine.
  • The homepage works, but specific landing pages redirect.
  • Security scans disagree because the malware is conditional.

One important detail: do not assume the site is clean just because you cannot reproduce the redirect while logged in. Many malware scripts intentionally skip logged-in WordPress users to avoid detection.

Why Logged-In Admins Often Do Not See the Redirect

Attackers know that site owners usually test their websites while logged in.

So malware often checks for signs that the visitor is an administrator or a normal user. It may avoid redirecting when it detects:

  • A WordPress login cookie
  • An admin session
  • A known developer IP address
  • Direct visits with no search referrer
  • Repeated visits from the same browser
  • Security scanner user agents

The malware may only activate when the visitor looks like a real guest coming from a search result. This is why remote testing is useful.

How to Confirm the Redirect

Before editing files, confirm the behavior from multiple angles.

1. Test as a guest user

Open the site in an incognito/private browser window while logged out of WordPress.

Test:

  • Homepage
  • Top landing pages
  • Blog posts receiving search traffic
  • Product or service pages
  • Pages shown in Google Search results

2. Test from Google Search

Search for your domain or page title on Google, then click the result.

Example:


site:example.com

If the redirect happens only when clicking from Google, the malware may be checking the referrer.

3. Test with different devices

Try desktop and mobile. Some redirect malware targets mobile visitors because mobile redirects are easier for site owners to miss.

4. Use a remote scanner

The Securewp Remote Security Scanner can help detect public-facing issues from outside your WordPress admin session. This is useful for cloaked redirects because the scanner can review what unauthenticated visitors and crawlers may see.

A remote scanner is not a replacement for a full file-level malware scan, but it is helpful when the infection only appears to outsiders.

Where Redirect Malware Usually Hides

Search-result redirect malware can be hidden in several places.

Common locations include:

  • Theme files such as functions.php, header.php, footer.php, or index.php
  • Fake plugin folders
  • Modified plugin files
  • WordPress core files
  • .htaccess or Nginx rewrite rules
  • wp-config.php
  • Files inside wp-content/uploads
  • Database entries in wp_options, widgets, posts, or plugin settings
  • Malicious cron jobs
  • Injected JavaScript in page builder content

Redirect code is often obfuscated to make it harder to read. You may see suspicious patterns such as:


document.write
String.fromCharCode
eval
atob
base64_decode
gzinflate
unescape
setTimeout
location.href
window.location

These patterns are not always malicious by themselves, but they should be reviewed carefully when found in unexpected places.

Case Study: Redirect Triggered Through Injected Page Builder Content

In the reported case, the redirect appeared before the body content and used heavily obfuscated JavaScript. It was not obvious to the site owner because logged-in users were not redirected.

The investigation pointed to malicious script injection related to WPBakery Page Builder content.

WPBakery has had multiple stored cross-site scripting vulnerability disclosures over the years. One older issue, CVE-2020-28650, affected WPBakery versions before 6.4.1 and allowed authenticated users with lower roles to inject malicious scripts because standard WordPress XSS protections were disabled in certain contexts.

More recent WPBakery stored-XSS vulnerabilities have also been disclosed in later versions, including issues affecting versions up to 8.4.1 and 8.6.1 in specific builder elements or shortcodes.

The lesson is simple: do not only check whether a plugin was vulnerable years ago. Check whether the installed version is currently safe, actively maintained, and fully updated.

How to Clean Search-Result Redirect Malware

Cleaning this type of malware requires more than deleting one suspicious script. Redirect malware often comes with a backdoor or reinfection mechanism.

1. Put the site in a controlled state

If the redirect is active and sending users to harmful pages, consider enabling maintenance mode or temporarily limiting traffic while you investigate.

2. Take a full backup before cleanup

Save a copy of the current files and database. Even though the site is infected, the backup can help with investigation and recovery if something is removed by mistake.

3. Scan files and database

Check for malicious JavaScript, suspicious PHP, modified core files, fake plugins, injected database content, and suspicious recently changed files.

SiteFort Security Plugin can help here by scanning for malware, backdoors, web shells, malicious PHP, injected scripts, suspicious redirects, modified core files, vulnerable plugins and themes, and exposed sensitive files.

4. Inspect page builder content

If the redirect appears inside page content, inspect pages built with visual builders such as WPBakery, Elementor, Divi, or similar tools.

Check for suspicious custom HTML blocks, raw JavaScript, shortcodes, hidden elements, injected scripts, and unexpected encoded content.

5. Replace compromised files with clean copies

Restore WordPress core, plugin, and theme files from trusted sources. Do not rely only on manually deleting visible malicious lines if the file was heavily modified.

6. Remove unauthorized users

Check WordPress users for unknown administrator, editor, author, or contributor accounts. Stored-XSS issues can sometimes involve lower-level users injecting scripts, so review non-admin accounts too.

7. Reset credentials

Reset passwords for:

  • WordPress administrators
  • Hosting control panel
  • SFTP/FTP accounts
  • Database users
  • Cloudflare or DNS accounts
  • Email accounts used for password resets

8. Update vulnerable plugins and themes

Update WPBakery and any other vulnerable plugins or themes. If a plugin is abandoned or cannot be updated safely, replace it.

9. Check for reinfection

After cleanup, revisit the site as a guest user, from search results, from mobile, and with a remote scanner.

If the redirect returns, a backdoor or scheduled reinfection task is still present.

What to Check in Google Search Console

Search-result redirects can damage trust with users and search engines, so check Google Search Console after cleanup.

Review:

  • Security issues: Check whether Google detected hacked content, malware, or deceptive pages.
  • Manual actions: Check for hacked spam or other manual penalties.
  • Pages report: Look for strange indexed URLs.
  • Sitemaps: Remove unknown or spam sitemaps.
  • Users and permissions: Remove unauthorized Search Console users.
  • URL Inspection: Request recrawling for cleaned important pages.

If Google still shows hacked snippets or redirects after cleanup, make sure the infected URLs now return clean content, 404, or 410 where appropriate. Then request recrawling for key pages.

Why Some Scanners Miss Cloaked Redirects

No scanner catches every infection in every context.

Cloaked malware may avoid detection by checking:

  • User agent
  • Referrer
  • Login cookies
  • Country
  • Device type
  • Visit count
  • IP address
  • Request path

A scanner that only checks files may miss a redirect hidden in the database. A scanner that only checks the public page may miss a backdoor hidden in files. A scanner that runs while authenticated may miss malware that avoids logged-in users.

That is why layered detection works better:

  • Remote scanner: Checks what public visitors and crawlers may see.
  • File scanner: Checks WordPress files for malicious code.
  • Database review: Checks content, options, widgets, and builder data.
  • Vulnerability monitoring: Identifies outdated or risky components.
  • Audit logs: Shows suspicious changes, logins, and plugin activity.

Used together, the Securewp Remote Security Scanner and SiteFort provide both outside-in and inside-WordPress visibility.

How to Prevent Redirect Malware from Returning

After cleanup, focus on reducing the chance of reinfection.

Keep plugins and themes updated

Update WPBakery, WordPress core, themes, and all plugins. Remove anything abandoned or unused.

Use trusted plugins only

Avoid nulled or pirated plugins and themes. They often contain hidden malware or backdoors.

Limit user access

Give users only the role they need. Do not give contributor, author, editor, or admin access unless required.

Enable two-factor authentication

Use 2FA for administrators and other privileged users.

Use a firewall

A firewall can block bad bots, suspicious requests, vulnerability probes, malicious IPs, and repeated login attempts.

Monitor vulnerabilities

Vulnerability monitoring helps you know when an installed plugin or theme becomes risky.

Scan regularly

Regular malware scanning helps detect injected scripts, backdoors, suspicious redirects, and modified files before the problem spreads.

SiteFort can help with all of these layers: malware scanning, vulnerability alerts, firewall rules, bot blocking, login security, 2FA, hardening, audit logs, and Cloudflare Sync.

Final Thoughts

If visitors from Google Search are being redirected to random or harmful websites, treat it as a serious WordPress compromise.

The site may look normal when you are logged in, but that does not mean it is clean. Cloaked redirect malware often hides from administrators and only targets guest users, search visitors, mobile users, or crawler-like requests.

Start by confirming the redirect as a logged-out visitor and from search results. Use the Securewp Remote Security Scanner to check the public-facing version of the site. Then scan inside WordPress with SiteFort, review files and database content, update vulnerable plugins such as WPBakery, remove backdoors, reset credentials, and check Google Search Console.

If the redirect keeps coming back, the cleanup is not complete. A hidden backdoor, compromised user, vulnerable plugin, or malicious database entry may still be active.

For ongoing protection, SiteFort helps secure WordPress with malware scanning, firewall protection, bot blocking, login security, 2FA, vulnerability alerts, hardening, audit logs, and Cloudflare Sync.