WordPress Redirect Malware: How to Find and Fix Malicious Redirects

Unexpected redirects are one of the clearest signs that a WordPress website may have been compromised. A visitor may click your homepage and suddenly be sent to an unrelated website, a spam page, a fake security alert, or another suspicious destination.

In many cases, these redirects are caused by malicious code injected into WordPress files, the database, a plugin, a theme, or server configuration. Some attacks are simple to identify, while others only redirect specific visitors and can remain hidden during a normal website check.

This guide explains how to identify WordPress redirect malware, investigate the source, remove malicious redirects safely, and strengthen your website so the problem is less likely to return.

What Is WordPress Redirect Malware?

WordPress redirect malware is malicious code or unauthorized configuration that forces website visitors to another URL without the website owner's permission.

The destination may be a spam website, phishing page, malicious download, fake advertisement, adult website, gambling page, or another compromised website.

The redirect can happen immediately when someone visits the site, or only under specific conditions.

For example, an attacker may configure the website to redirect only:

• Mobile visitors
• Visitors coming from Google
• First-time visitors
• Visitors from specific countries
• Visitors using particular browsers
• Visitors arriving through search results

This conditional behavior can make an infection much harder to detect.

How Malicious Redirects Affect a WordPress Website

A hacked redirect is more than an annoying website problem. It can affect security, user trust, search visibility, and the overall reputation of the website.

Visitors may stop trusting the site if they are unexpectedly sent somewhere else. Search engines may also detect suspicious behavior and associate the website with harmful or deceptive content.

Depending on the infection, a compromised website may experience:

• Unexpected redirects
• Google security warnings
• Search ranking problems
• SEO spam
• Phishing content
• Malicious downloads
• Browser security warnings
• Loss of visitor trust
• Repeated reinfection

For this reason, an unexplained redirect should be treated as a potential security incident rather than simply a browser or caching problem.

Common Signs of a Hacked WordPress Redirect

Not every redirect means that a website has malware. However, unexpected behavior should be investigated when there is no legitimate reason for the redirect.

Common warning signs include:

• The homepage redirects to another domain
• Only mobile users are redirected
• Google visitors see a different page
• Some URLs redirect while others work normally
• The website redirects only once per visitor
• Users are sent to spam or suspicious websites
• The website behaves differently in private browsing
• Search results lead visitors to unexpected destinations
• Unknown JavaScript appears in the source code
• Redirect rules appear in server configuration files

These symptoms can indicate malicious code, but they can also be caused by legitimate plugins, CDN settings, hosting configuration, or incorrectly configured redirects. Investigation is important before deleting anything.

Why Do WordPress Websites Get Redirected?

There are several possible entry points for a malicious redirect.

Vulnerable Plugins

Outdated or vulnerable plugins can provide attackers with an entry point into a WordPress installation.

After gaining access, an attacker may modify files, create administrator accounts, inject database content, or add redirect code.

Compromised Themes

Theme files can also be modified after a website is compromised. Malicious code may be inserted into functions, templates, headers, footers, or other theme files.

Stolen Administrator Credentials

If an attacker obtains a WordPress administrator password, they may be able to install malicious plugins, modify website files, or create persistent access.

Compromised Hosting Credentials

FTP, SFTP, SSH, hosting panel, or other credentials can provide direct access to website files.

Malicious Database Content

Attackers can inject scripts, URLs, spam content, or configuration values into the WordPress database.

Server Configuration

Redirects can also be created through server-level configuration such as .htaccess or other hosting configuration files.

Step 1: Confirm the Redirect

Before investigating the website, confirm exactly what is happening.

Test the website from more than one browser and device. Check the homepage as well as several internal pages.

Also compare:

• Desktop vs. mobile
• Logged-in vs. logged-out visitors
• Normal browsing vs. private browsing
• Direct URL access vs. search-engine traffic

Document the destination URL and the circumstances under which the redirect happens.

This information can help identify whether the behavior is coming from the website, a plugin, a CDN, a browser extension, or another source.

Step 2: Check Google Search Console

Google Search Console can provide useful information when a compromised website has security or indexing problems.

Check for security-related notices, unexpected indexed URLs, and other unusual search activity.

If Google has detected harmful or deceptive content, review the reported information carefully and use it to guide the investigation.

Do not assume that the visible homepage is the only affected location. Malware can be hidden on individual URLs or inside files and database records.

Step 3: Scan WordPress Files

A proper malware investigation should include the website's files.

Look for unexpected or modified files in:

• WordPress core directories
• Plugin directories
• Theme directories
• Uploads directories
• Custom application directories
• Server configuration locations

Pay attention to suspicious PHP files, obfuscated code, unfamiliar scripts, recently modified files, and files located in places where they normally should not exist.

Do not delete every unfamiliar file automatically. Some legitimate plugins and themes contain files that may initially look unusual.

Malware identification should consider the file's location, purpose, code behavior, and relationship to the rest of the website.

Step 4: Check the .htaccess File

On Apache-based hosting, the .htaccess file can control redirects and other server behavior.

A compromised .htaccess file may contain unauthorized redirect rules.

Look for rules that:

• Redirect visitors to unknown domains
• Use suspicious conditions
• Reference unfamiliar files
• Contain unexpected rewrite logic
• Were not intentionally added by the website owner

However, do not remove legitimate WordPress rewrite rules simply because they look technical. Make a backup before changing server configuration.

Step 5: Check WordPress Core Files

WordPress core files should normally match the official version of WordPress installed on the website.

Unexpected modifications can indicate that an attacker gained access to the installation.

Pay particular attention to files that contain unexpected PHP code, unfamiliar functions, obfuscated strings, or suspicious external requests.

If core files have been modified, replacing them with clean copies from a trusted WordPress source can be safer than manually editing every suspicious section.

Step 6: Inspect Plugins and Themes

Review every installed plugin and theme.

Remove software that is unused or no longer required, and update legitimate software to supported versions.

Pay special attention to:

• Outdated plugins
• Abandoned plugins
• Unused themes
• Plugins from untrusted sources
• Recently installed software
• Unexpected files inside plugin directories

If a vulnerable plugin was the original entry point, simply cleaning the malware without addressing that vulnerability can lead to reinfection.

Step 7: Check the WordPress Database

Malicious redirects are not always stored inside website files.

Attackers can inject content into the WordPress database and use it to load malicious scripts or redirect visitors.

Review relevant database areas for:

• Suspicious URLs
• Injected JavaScript
• Unknown administrator accounts
• Unexpected options
• Spam content
• Modified website settings
• Suspicious serialized data

Database cleanup should be performed carefully. Always create a reliable backup before making database changes.

Step 8: Look for JavaScript Redirects

Some malicious redirects are created using JavaScript.

Injected scripts may be placed in theme files, plugin files, database fields, widgets, headers, footers, or other locations that load on the website.

Look for unexpected scripts that:

• Change the browser location
• Load unfamiliar external domains
• Use obfuscated code
• Create hidden iframes
• Execute only under certain conditions

Not every external JavaScript file is malicious. Many legitimate WordPress websites load scripts from third-party services. The goal is to identify code that is unauthorized or behaves suspiciously.

Step 9: Check for Conditional Redirects

One of the most difficult types of hacked redirects is a conditional redirect.

The website may appear completely normal when you check it, while another visitor is redirected somewhere else.

Attackers may use conditions based on:

• User agent
• IP address
• Referrer
• Geographic location
• Cookies
• Mobile devices
• Search engine traffic

This is why testing only the homepage once may not be enough to determine whether a website is clean.

Step 10: Check Administrator Accounts

Review the WordPress user list for unauthorized accounts.

If an attacker created a new administrator account, they may be able to reinfect the website even after the visible malware has been removed.

Check for:

• Unknown administrators
• Recently created accounts
• Unexpected usernames
• Former users who no longer need access
• Users with unnecessary privileges

Remove unauthorized accounts and reduce unnecessary privileges.

Step 11: Change Compromised Credentials

If you believe the website was compromised, review all credentials that could have been exposed.

Depending on the incident, this may include:

• WordPress administrator passwords
• Hosting account passwords
• FTP or SFTP credentials
• SSH credentials
• Database credentials
• Control panel credentials
• Cloudflare credentials
• Domain registrar credentials

Use unique passwords and enable two-factor authentication wherever possible.

Step 12: Remove the Malicious Redirect Safely

Once the source of the redirect has been identified, remove the malicious code or configuration.

Depending on the infection, this may involve cleaning:

• WordPress files
• Plugin files
• Theme files
• Database records
• .htaccess
• Server configuration
• Unauthorized user accounts

Do not simply remove the redirect destination and assume the website is clean.

The redirect is often only one visible symptom of a larger compromise.

Step 13: Fix the Original Security Weakness

After cleaning the infection, determine how the attacker gained access.

If the original entry point remains open, the website can be compromised again.

Review:

• Plugin vulnerabilities
• Theme vulnerabilities
• Weak passwords
• Compromised accounts
• Outdated WordPress versions
• Exposed credentials
• Unnecessary administrator access
• Hosting security

Fixing the root cause is one of the most important parts of malware recovery.

Step 14: Clear Website and CDN Caches

After cleaning a redirect infection, clear relevant caches.

Depending on your setup, this may include:

• WordPress caching
• Server cache
• Object cache
• CDN cache
• Cloudflare cache
• Browser cache

Cached content can sometimes make an old redirect appear to remain active even after the underlying problem has been fixed.

After clearing the cache, test the website again.

Step 15: Verify the Website After Cleanup

Do not consider the cleanup complete immediately after deleting suspicious code.

Perform another investigation and test the website from different environments.

Check:

• Homepage
• Important internal pages
• Mobile devices
• Desktop browsers
• Private browsing
• Logged-out sessions
• Search-engine traffic
• Website source code
• Server configuration
• Database content

Also run a reputable malware and security scan where appropriate.

Step 16: Check Google Search Results

After cleaning the website, search for your domain in Google and review the indexed results.

Look for unexpected pages, spam titles, strange descriptions, or URLs that you did not create.

If you discover large numbers of unwanted indexed pages, investigate the underlying infection rather than treating each URL as an isolated SEO problem.

If Google has reported a security issue, review Google Search Console for the latest information available for the property.

How to Prevent Redirect Malware From Returning

Removing malware is only one part of website security. Prevention requires ongoing maintenance and access control.

Keep WordPress Updated

Keep WordPress core, plugins, and themes updated to supported versions.

Remove Unused Plugins and Themes

Every unnecessary component increases the website's attack surface. Remove software that you do not need.

Use Strong Authentication

Use unique passwords and enable two-factor authentication for important accounts.

Limit Administrator Access

Only trusted users should have administrator privileges.

Maintain Reliable Backups

Maintain backups that can actually be restored. A backup is useful only if it is available and reliable when you need it.

Monitor Website Changes

Security monitoring can help identify unexpected changes to important files, users, settings, and website content.

Consider Security Hardening

A properly hardened WordPress website can reduce unnecessary attack surfaces and strengthen authentication, access control, and other security layers.

For a structured hardening process, see my WordPress Security Hardening service.

When Should You Get Professional Malware Removal Help?

Professional investigation can be useful when the redirect keeps returning or you cannot identify its source.

Consider getting help when:

• The redirect returns after cleanup
• Only certain visitors are redirected
• The website has multiple infected files
• Unknown administrator accounts appear
• The database contains injected content
• Google reports a security problem
• You find evidence of a backdoor
• The hosting environment may be compromised

A deeper investigation is especially important when a basic malware scan does not explain the behavior.

WordPress Redirect Malware Checklist

Area	What to Check
Redirect behavior	Test the website across browsers, devices, and visitor conditions
Search Console	Review security issues and unexpected indexed URLs
WordPress files	Look for modified or suspicious files
.htaccess	Check for unauthorized redirect rules
Plugins	Update, review, and remove unnecessary software
Themes	Check for modified or unauthorized code
Database	Search for injected URLs, scripts, and suspicious content
Users	Remove unauthorized administrator accounts
Credentials	Change potentially compromised passwords
Cache	Clear WordPress, server, CDN, and browser caches
Security	Fix the original vulnerability and harden the website
Verification	Retest the website after cleanup

Frequently Asked Questions

Why is my WordPress website redirecting to another website?

An unexpected redirect can be caused by malware, a compromised plugin or theme, modified server configuration, injected database content, or another unauthorized change. It can also have legitimate causes, so the source should be investigated before removing anything.

How do I know if a WordPress redirect is caused by malware?

Look for unexpected redirect behavior, suspicious files, unauthorized code, unknown administrator accounts, malicious database content, or server configuration changes. Conditional redirects can be harder to detect and may require deeper investigation.

Can a WordPress redirect malware infection affect Google rankings?

It can. Malicious redirects, spam pages, deceptive content, and security warnings can negatively affect how users and search engines interact with a website.

Why does my website redirect only on mobile?

Some malicious redirects use conditions such as device type, browser, referrer, or user agent. However, legitimate plugins, redirects, CDN rules, and responsive systems can also create different behavior, so the cause should be verified.

Can I fix a malicious redirect by editing .htaccess?

Sometimes a malicious redirect is stored in .htaccess, but removing the rule alone may not solve the infection. If an attacker has left a backdoor or modified other files, the redirect can return.

How can I prevent WordPress redirects from coming back?

Clean the complete infection, fix the original vulnerability, update WordPress and its components, remove unnecessary software, secure administrator accounts, change compromised credentials, maintain reliable backups, and monitor the website for unexpected changes.

Final Thoughts

An unexpected redirect should never be ignored, especially when it sends visitors to an unrelated or suspicious website.

The visible redirect may be only one symptom of a larger compromise. A proper investigation should examine WordPress files, plugins, themes, the database, server configuration, user accounts, and access credentials.

After removing the malicious code, fix the original security weakness and verify that the website remains clean.

If your website has been compromised and needs professional cleanup, see my WordPress Malware Removal service.

If the website has been hacked and needs complete recovery, see my Hacked WordPress Recovery service.

For a deeper security assessment, see my WordPress Security Audit service.

If Cloudflare is part of your website security setup, you can also explore my Cloudflare Security service.

Need help securing a compromised WordPress website? Contact Sefat Hossain for a professional website security assessment.