Quick answer
A WordPress redirect hack sends your visitors to spam or scam sites, often only on mobile or from Google. Fix it by checking .htaccess, wp-config, theme files, and the database for injected redirect code, removing it and the backdoor, closing the entry point, and confirming the redirect is gone across devices.
Key takeaways
- Redirects often trigger only on mobile or from search, so they're easy for the owner to miss.
- The code hides in .htaccess, theme files, JavaScript, or the database.
- Test across devices and referrers after cleanup to confirm it's really gone.
Few hacks are as maddening as the redirect hack. You visit your site and it's fine. But customers — especially on their phones, or arriving from Google — get bounced to a sketchy site you've never heard of. Here's how to track it down.
Why you can't reproduce it
Redirect malware is usually cloaked: it targets mobile users or search visitors while leaving the owner's direct desktop visits alone. That's by design, so you don't notice.
Where to look
The injected redirect code hides in several common places: the .htaccess file, wp-config.php, your theme's header or footer, injected JavaScript files, or the WordPress database (often in the options table).
Remove it thoroughly
Clean every instance — redirect hacks frequently plant code in multiple files at once. Then find the backdoor and the entry point, because removing only the redirect leaves the door open for it to return.
Verify across devices
After cleanup, test on desktop and mobile, in incognito, and by clicking through from a Google search result. The redirect should be gone in every case.
Harden so it stays gone
Update the vulnerable component, rotate passwords and keys, and add monitoring. Redirect hacks are a strong sign of an unpatched vulnerability, so hardening is essential.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
The malware is cloaked to target mobile users or visitors from Google, while showing the owner (usually on desktop, visiting directly) a normal site. It's deliberate, to stay hidden.
Keep reading
How to Detect and Remove a Credit-Card Skimmer in WooCommerce
A card skimmer quietly steals customer payment details at checkout. Here's how to detect and remove one from WooCommerce.
Website Suspended by Your Host? How to Get It Back Online
If your host suspended your account for malware, here's how to clean the site to their standard and get it reactivated.
How to Request a Google Security Review After a Hack
Cleaned the hack but Google still warns visitors? Here's how to request a security review and get the warning lifted — the right way.