WordPress Redirect Hack: How to Detect and Fix It

A WordPress redirect hack is one of the most common and frustrating website infections.

The site may look normal when you open it directly, but visitors from Google, mobile users, or first-time guests may be redirected to spam, scam, adult, gambling, fake update, or malware pages. In other cases, every visitor is redirected immediately, making the website unusable.

This guide explains how WordPress redirect hacks work, where the malicious code usually hides, how to detect it, how to clean it safely, and how to prevent it from coming back.

If you want a quick outside check first, run the Securewp Remote Security Scanner. It can help detect public-facing redirects, malware indicators, blacklist status, SEO spam, and exposed security issues. For deeper WordPress-side cleanup and prevention, SiteFort Security Plugin can scan inside WordPress for malware, backdoors, injected scripts, suspicious redirects, vulnerable plugins, modified files, and hardening issues.

What Is a WordPress Redirect Hack?

A WordPress redirect hack is a compromise where attackers modify your website so visitors are sent to another website without your permission.

The destination may be:

• A scam landing page
• A fake browser update page
• A gambling, adult, or pharmaceutical spam site
• A malware download page
• A fake shopping or affiliate page
• A phishing page designed to steal information

Sometimes the redirect affects every visitor. Other times, it is cloaked and only triggers under specific conditions.

For example:

• Only visitors from Google Search are redirected.
• Only mobile users are redirected.
• Only logged-out users are redirected.
• Only first-time visitors are redirected.
• Only visitors from certain countries are redirected.
• Only specific posts or landing pages redirect.

This makes the problem harder to notice because administrators may see a clean site while real visitors are being sent somewhere else.

Why WordPress Redirect Hacks Happen

Attackers usually need an entry point before they can add redirect code.

Common entry points include:

• Outdated vulnerable plugins or themes
• Nulled or pirated plugins and themes
• Weak or reused administrator passwords
• Compromised hosting, FTP, SFTP, or control panel credentials
• Unsafe file upload handling
• Old staging, backup, or test WordPress installs
• Exposed backup files or configuration files
• Unprotected admin accounts without 2FA
• Previously missed backdoors from an older infection

Once attackers have access, they inject redirect logic into files, database rows, rewrite rules, plugin settings, theme templates, or scheduled tasks.

Common Symptoms of a WordPress Redirect Hack

You may be dealing with a redirect hack if you notice:

• Your site redirects to an unknown domain.
• Visitors report redirects, but you cannot reproduce them while logged in.
• The redirect happens only from Google Search results.
• The redirect happens only on mobile.
• Google shows spam titles or descriptions for your pages.
• Google Search Console reports security issues.
• New pages appear in Google that you never created.
• Antivirus tools or browsers warn visitors about the site.
• Unknown JavaScript appears in page source.
• .htaccess, theme files, or database rows change again after cleanup.

Google treats cloaking and sneaky redirects as spam practices that can cause pages or entire sites to rank lower or be omitted from Search.

How to Confirm the Redirect Hack

Before editing files, confirm when and how the redirect happens.

1. Test while logged out

Open your website in a private/incognito browser window. Make sure you are not logged in to WordPress.

2. Test from Google Search

Search your domain in Google:

site:yourdomain.com

Open several results. If the redirect only happens after clicking from Google, the malware may be checking the referrer.

3. Test from mobile

Use a real phone on mobile data, not just your desktop browser’s mobile preview. Some redirect malware targets mobile users only.

4. Test from a different network

If possible, test from another internet connection. Some malware avoids redirecting the site owner’s IP address after the first visit.

5. Check page source

Right-click the page and view source. Search for suspicious external domains, encoded JavaScript, unfamiliar scripts, or redirect patterns.

6. Run a remote scan

Use the Securewp Remote Security Scanner to check the public-facing version of the site. This is helpful because remote scanners see the site from outside your WordPress admin session.

7. Check Google Search Console

Go to Security & Manual Actions → Security Issues. Google’s Security Issues report lists signs that a site may have been hacked or may harm visitors, including malware, unwanted software, phishing, and deceptive content.

Where WordPress Redirect Malware Usually Hides

Redirect malware can hide in many places. Do not stop after checking only one file.

1. .htaccess Redirect Rules

On Apache or LiteSpeed hosting, attackers often modify .htaccess because it can control redirects before WordPress loads.

Look for suspicious rules such as:

RewriteCond %{HTTP_REFERER}
RewriteCond %{HTTP_USER_AGENT}
RewriteRule
Redirect 301
RedirectMatch

Not every rewrite rule is malicious. WordPress, caching plugins, and security tools may add legitimate rules. But unknown redirects to external domains should be removed and investigated.

2. Theme Files

Redirect scripts are often injected into active theme files because those files load on the frontend.

Check:

• functions.php
• header.php
• footer.php
• index.php
• Template parts used across the site

Look for unfamiliar JavaScript, obfuscated PHP, external script tags, or code added near the top or bottom of the file.

3. Plugin Files or Fake Plugins

Attackers may modify a real plugin or create a fake plugin with a normal-looking name.

Check for:

• Plugins you do not recognize
• Recently modified plugin files
• Plugins with only one PHP file and no clear purpose
• Disabled plugins that still contain suspicious files
• Nulled or abandoned plugins

4. WordPress Core Files

Core files should match the official WordPress release. Modified core files can load malware on every request.

Check files such as:

• index.php
• wp-load.php
• wp-settings.php
• wp-blog-header.php
• Files inside wp-includes/

When possible, replace WordPress core files with a clean copy instead of manually editing suspicious core files.

5. Database Injections

Redirect malware can live in the database, not just files.

Common locations include:

• wp_posts content
• wp_postmeta
• wp_options
• Widgets
• Navigation menus
• Page builder content
• Code snippet plugins
• Custom HTML blocks

In some cases, attackers change siteurl or home in wp_options, causing the whole site to redirect to another domain.

6. PHP Files in Uploads

The uploads directory should not contain executable PHP files. A PHP file in wp-content/uploads may be a web shell or backdoor used to restore redirects after cleanup.

Look for files ending in:

.php
.phtml
.phar
.php5
.php7
.jpg.php

7. mu-plugins, Cron Jobs, and Hidden Persistence

Redirects can return after cleanup if a persistence layer is still active.

Check:

• wp-content/mu-plugins/
• WordPress cron events
• Server cron jobs
• Auto-prepend PHP settings
• Unknown admin users
• Compromised SFTP/FTP credentials

If the redirect comes back after you remove it, a backdoor or scheduled task is probably still active.

Suspicious Code Patterns to Look For

Instead of publishing a full malicious payload, it is safer and more useful to know the patterns commonly seen in redirect malware.

Look for unexpected use of:

eval
base64_decode
gzinflate
str_rot13
String.fromCharCode
document.write
atob
window.location
location.href
setTimeout
file_get_contents
curl_exec
preg_replace /e

These functions are not always malicious. Some legitimate plugins may use encoding, remote requests, or redirects. But if you find these patterns in unexpected files, theme templates, uploads, widgets, or unknown plugins, review them carefully.

How to Clean a WordPress Redirect Hack

Follow a careful cleanup order. Removing the visible redirect without fixing the entry point can lead to reinfection.

1. Take a backup of the infected site

Before deleting files, take a full backup of the files and database. This gives you a rollback point and helps with investigation.

2. Put the site in maintenance mode if needed

If visitors are being sent to harmful pages, temporarily limit public access while you clean the site.

3. Scan from outside and inside

Use the Securewp Remote Security Scanner to check public-facing redirects, blacklist status, and visible malware indicators.

Then scan inside WordPress with SiteFort for malware, backdoors, injected scripts, suspicious redirects, modified core files, vulnerable plugins and themes, exposed sensitive files, and file changes.

4. Restore clean WordPress core files

Replace WordPress core files with a clean copy from WordPress.org. Do not overwrite wp-config.php or wp-content without a plan.

5. Replace infected plugins and themes

If a plugin or theme is modified, replace it with a clean copy from the official vendor or WordPress.org.

Remove abandoned, unused, or nulled plugins and themes completely.

6. Clean the database

Search for suspicious scripts, external domains, iframe injections, encoded JavaScript, and modified siteurl or home values.

Review posts, pages, widgets, options, snippets, and page builder content.

7. Remove backdoors and persistence

Check uploads, mu-plugins, cron jobs, unknown admin users, fake plugins, and suspicious recently modified files.

If malware returns after cleanup, this step was not complete.

8. Reset credentials

Reset passwords for:

• WordPress administrators
• Hosting control panel
• SFTP/FTP accounts
• Database users
• Cloudflare or DNS accounts
• Email accounts used for password resets

9. Update and patch everything

Update WordPress core, plugins, and themes. Remove anything abandoned or unsafe.

WordPress’ wp-config.php file contains sensitive site configuration such as database connection details, so it should be protected carefully during cleanup and hardening.

10. Verify the redirect is gone

Test again:

• Logged out
• From mobile
• From Google Search
• From another network
• With the Securewp Remote Security Scanner
• With SiteFort scan results and logs

Check Google Search Console After Cleanup

If the redirect affected search visitors, check Google Search Console after the site is clean.

Review:

• Security Issues: Look for malware, phishing, or deceptive content reports.
• Manual Actions: Check whether Google applied a penalty.
• Pages: Look for strange indexed URLs.
• Sitemaps: Remove unknown or spam sitemaps.
• Users and permissions: Remove unauthorized Search Console users.
• URL Inspection: Request recrawling for important cleaned pages.

If Google shows a security issue, request review only after the malware, backdoors, vulnerabilities, and redirects are fully removed.

How to Prevent WordPress Redirect Hacks

Prevention requires layered security. No single setting is enough.

• Keep WordPress core, plugins, and themes updated.
• Remove unused or abandoned plugins and themes.
• Never use nulled plugins or themes.
• Use strong, unique passwords for every account.
• Enable two-factor authentication for administrators.
• Limit login attempts and bot abuse.
• Disable file editing in the WordPress dashboard.
• Block PHP execution in uploads where possible.
• Protect wp-config.php, backup files, logs, and Git directories.
• Restrict XML-RPC if unused.
• Use a firewall and bot protection.
• Monitor vulnerabilities in plugins and themes.
• Scan for malware regularly.
• Review audit logs for suspicious changes.
• Keep clean off-site backups.

SiteFort helps with many of these layers, including malware scanning, vulnerability alerts, firewall rules, bot blocking, login security, 2FA, hardening, audit logs, and Cloudflare Sync.

When to Get Professional Help

Consider professional cleanup if:

• The redirect returns after you remove it.
• The redirect happens only for Google or mobile users.
• You cannot find where the redirect is coming from.
• Google has flagged the site with a security warning.
• Thousands of spam URLs are indexed.
• Unknown admin users or backdoors keep appearing.
• The site is suspended by the host.
• The site is business-critical and downtime is costly.

If you need help cleaning the site, our WordPress malware removal service can remove the infection and help reduce reinfection risk.

Final Thoughts

A WordPress redirect hack is not just an annoying redirect. It is a sign that someone changed your site’s files, database, settings, or server rules without permission.

Start by confirming the redirect from multiple views: logged out, mobile, Google Search, and a different network. Use the Securewp Remote Security Scanner to check what outsiders may see. Then use SiteFort inside WordPress to scan files, detect suspicious redirects, find backdoors, monitor vulnerabilities, and apply hardening.

Clean the visible redirect, but do not stop there. Remove the backdoor, patch the entry point, reset credentials, check Search Console, and monitor the site after cleanup. If the redirect returns, the root cause is still active.