A WordPress redirect hack is malicious code that sends some of your visitors to scam, spam or malware sites. It’s usually picky about who it redirects: often people arriving from Google or on phones, and almost never you, the logged-in owner. That’s why customers report it and you can’t reproduce it. The fix is a full clean-up of files, database and user accounts, then closing the hole the attacker used.
Key takeaways
- If one customer reports a redirect, take it seriously even if the site looks fine to you.
- Test the way a stranger would: on a phone using mobile data, logged out, arriving from a Google search.
- Redirect code hides in theme files, plugins, .htaccess and the database, so deleting one file rarely fixes it.
- Remove backdoors and unknown admin users, update everything and change every password, or it comes back.
Why can’t I see the redirect on my own website?
Because the malware is built to hide from you. Redirect code usually checks who is visiting before it acts. Sucuri analysed one campaign whose script “bypasses execution for logged-in WordPress users”, most likely to avoid alerting site administrators. It also set a cookie so the redirect didn’t fire again in the same session (Sucuri, January 2025).
Other versions only redirect visitors who arrive from a search engine. Sucuri’s malware guide shows rules where “anyone coming from a search engine” is sent to another site (Sucuri docs). Patchstack notes that some attacks send mobile users to malicious app stores while desktop visitors see clean pages (Patchstack).
| The malware checks | Who gets redirected | Why you miss it |
|---|---|---|
| Login status | Logged-out visitors | You’re logged in to WordPress |
| Where the visitor came from | People clicking a Google result | You type your address in directly |
| Device | Phone users | You check on a desktop |
| A cookie | Visitors it hasn’t redirected yet | It fires once, then stays quiet |
How do I check if my site has a redirect hack?
- Use a phone on mobile data. Turn off Wi-Fi, open a private browser tab and make sure you aren’t logged in to WordPress.
- Arrive from Google. Search for your business name and click your own result, rather than typing the address. Try a few different pages.
- Ask the customer for details. Which device, which page, how they found you and where they ended up. A screenshot of the scam page helps.
- Check Google Search Console. The Security Issues report shows if Google has found hacked content. Its “code injection” type includes redirects to a malicious site (Google Search Console Help).
- Look for strangers in your users list. In WordPress, open Users and filter by Administrator. Any admin you don’t recognise is a red flag.
A free website security scan can also help, but scanners visit like a desktop browser and may miss conditional redirects.
How did hackers get into my WordPress site?
Usually through something out of date. Patchstack lists outdated themes, plugins and core files as common entry points. In the January 2025 campaign, Sucuri found the code injected into the theme’s functions.php file. It listed possible causes as outdated or nulled plugins and themes, poor custom code, older backdoors and compromised user accounts.
“Nulled” means pirated premium plugins. They’re a common way malware arrives, because whoever cracked the licence can add anything they like.
Where does redirect malware hide?
In more places than one, which is why quick fixes fail. Patchstack lists the usual spots:
- .htaccess, the server rules file, which can redirect visitors before WordPress even loads
- wp-config.php and index.php, often as scrambled code using functions such as base64_decode
- theme files such as header.php, footer.php and functions.php
- plugin folders, including fake plugins with harmless-sounding names
- the database, where scripts can be stored in settings and spam links added to posts
Most infected sites also have a way back in. Sucuri found at least one backdoor on 49.21% of the compromised sites it cleaned, and malicious admin users in 55.2% of infected WordPress databases (Sucuri, 2023 report). Remove the redirect but leave those, and the hack returns within days.
How do I fix a WordPress redirect hack?
- Take a full backup of the infected site. Keep it as evidence and a fallback. Don’t restore it later.
- Change passwords first. WordPress admins, hosting, database, FTP or SFTP, and the email account that receives password resets.
- Remove unknown users. Delete admin accounts you don’t recognise, and check for unfamiliar plugins.
- Replace core files. Reinstall WordPress, and reinstall plugins and themes from their official sources rather than trying to edit infected copies.
- Clean .htaccess, wp-config.php and the uploads folder. PHP files have no business in uploads.
- Clean the database. Check the site address settings and search for injected scripts and links.
- Update and harden. Update everything, remove unused plugins, add a firewall and turn on two-factor login.
- Ask Google to review. If Search Console flagged the site, request a review. Google says this can take from a few days to a few weeks.
A clean backup can shortcut steps 4 to 6, but only if it predates the infection, and the hole still needs closing. Our step-by-step website hacked recovery guide goes deeper, and WordPress site hacked covers the first hour.
Should I fix it myself or get help?
If you’re comfortable with file managers, databases and WordPress internals, you can work through the steps above. Most owners aren’t, and a half-clean site gets reinfected. A redirect on a shop or booking site also costs sales every hour it stays.
Our hacked website repair service finds and removes the redirect, backdoors and rogue users, then locks the site down. Some redirect hacks also send spam from your server; if customers mention odd emails, see website sending spam emails.
How do I stop it happening again?
Keep WordPress, plugins and themes updated, and delete what you don’t use. Never install nulled plugins. Keep admin accounts to a minimum, with two-factor login. Choose secure web hosting that isolates accounts and runs a firewall. And have someone watching: daily malware scans catch a redirect long before customers do.
That’s what our website maintenance plans do. Sites on Maintain & Protect are covered by our “hack-free or we fix it free” promise.
Frequently asked questions
Why does my website redirect only on mobile?
The malware checks the visitor’s device and only redirects phones. Owners usually test on a desktop, so they never see it, while mobile customers do. Test on a phone using mobile data, logged out and in a private tab. If it happens there, treat the site as hacked.
Is a redirect plugin the same as a redirect hack?
No. Redirect plugins send old page addresses to new ones on your own site, which is normal and useful. A redirect hack sends visitors to someone else’s site without your permission. If redirects lead off your domain to pages you didn’t create, it’s a hack.
Will Google blacklist my site for a redirect hack?
It can. If Google finds the redirect, it may show a warning in search results or a browser warning page, and list the problem in Search Console. Once the site is clean, request a review. Google says reviews take from a few days to a few weeks.
Can I just restore a backup to remove the redirect?
Only if the backup predates the infection, which can be hard to know. Attackers often get in weeks before the redirect starts. Even a clean restore puts back the old plugin with the security hole, so update everything and change all passwords straight away.
Are my customers’ details at risk?
Possibly. Code that can redirect visitors can usually do more, such as read form submissions. If your site collects personal details or payments, have the clean-up check for data theft too, and consider whether you need to notify anyone under the Privacy Act.
Sources
- Malware Redirects WordPress Traffic to Harmful Sites, Sucuri, 23 January 2025
- Conditional redirections, Sucuri Docs, accessed 13 November 2026
- How to Fix the WordPress Redirect Hack, Patchstack, 24 December 2024
- Security Issues report, Google Search Console Help, accessed 13 November 2026
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024