A WordPress redirect hack quietly sends visitors from your pages to spam, phishing, fake updates or unwanted advertising. The owner may not see it because attackers often target only search visitors, mobile devices or first-time sessions.
That inconsistent behavior is intentional. Treat the redirect as evidence of a compromise, preserve logs and avoid testing dangerous destinations on your normal computer.
Book a free, no-obligation strategy call and we'll map out your next move.
How malicious redirects are triggered
- Injected JavaScript in a theme, plugin, widget or page.
- Modified PHP that sends an HTTP redirect before the page loads.
- Host or web-server rewrite rules.
- Compromised DNS, CDN, tag manager or advertising scripts.
- Database content that runs only on selected pages.
- Conditional cloaking based on referrer, device, cookie or IP address.
Redirects can accompany search-spam campaigns such as the Japanese keyword hack. Check both visitor behavior and what search engines have indexed.
Step 1: contain the risk
If visitors are being sent to harmful pages, restrict public access or use a controlled maintenance state while you investigate. Preserve a full file and database snapshot and export relevant server, authentication, firewall and analytics logs.
Do not repeatedly open suspicious destinations. Record the redirect chain with trusted diagnostic tools or an isolated environment, including the affected source URL, device, referrer and time.
Step 2: reproduce the conditions
Test representative pages as a direct visitor, a search visitor and a mobile visitor. Use clean sessions because a cookie may suppress repeat redirects. Compare HTTP responses, page source and loaded scripts. Record what changes instead of assuming the browser is at fault.
Step 3: check WordPress files
Compare WordPress core, plugins and themes with trusted packages. Inspect must-use plugins, the uploads directory, wp-config.php, root files and web-server configuration. Review recent modifications, unexpected includes, encoded code and scripts that evaluate referrer or user-agent values.
Step 4: inspect the database and content
Search a safe database copy for the destination domain, suspicious script fragments and recently modified options, widgets, headers, footers and page-builder content. Review administrator activity around the first observed redirect. Back up first and avoid broad replacements against serialized production data.
Step 5: check infrastructure outside WordPress
Review DNS records, nameservers, CDN workers or rules, tag-manager containers, hosting-panel redirects and injected advertising code. Check sibling sites on shared hosting. A clean WordPress directory cannot stop a redirect generated before traffic reaches it.
Step 6: remove persistence and compromised access
Audit every administrator and application password. If anything is unfamiliar, follow the rogue administrator removal process. Inspect scheduled jobs and hidden backdoors that could restore the redirect after deletion.
Quarantine confirmed malware and replace modified software with trusted packages. Remove unused or abandoned components. Clear page, object, server, CDN and browser caches only after the underlying source is clean.
Step 7: rotate credentials and harden
Change WordPress, hosting, database, SFTP, SSH, CDN and deployment credentials from trusted devices. Update security salts, invalidate sessions and enable multi-factor authentication. Patch the vulnerable component and review file permissions and separation between sites.