---
title: "WordPress Hacked Redirect: Find and Fix It"
canonical: https://wpsecurityninja.com/take-care-of-wordpress-hacked-redirect-issues/
---
A WordPress hacked redirect sends visitors (or only some of them) to spam, [phishing](https://wpsecurityninja.com/dictionary/phishing/), or malware sites instead of your content. Sometimes every request bounces before your theme loads. Sometimes only mobile users, search traffic, or a single injected link is affected. Either way, treat it as an active [malware](https://wpsecurityninja.com/dictionary/malware/) incident, not a “SEO tweak.”

Act quickly. Redirects burn trust, trigger Safe Browsing warnings, and can get the host to suspend the account so neighbors on the server stay clean.

## How redirect infections get in

Attackers look for the usual openings: outdated plugins and themes, weak or reused admin passwords, nulled packages, and exposed file upload bugs. After they get in they may:

- Inject redirect code into files or the database
- Change the WordPress Address / Site Address options
- Add a hidden administrator so they can put the redirect back
- Drop a [webshell](https://wpsecurityninja.com/dictionary/webshell/) or other [backdoor](https://wpsecurityninja.com/dictionary/backdoor/) for later access

Redirects do not always hit the homepage only. They can sit on a landing page link, in a footer script, or in conditional code that fires for Googlebot or phones only. That is why “it looks fine when I visit” is a weak all-clear.

Background reading: [why small sites get attacked](https://wpsecurityninja.com/why-is-insignificant-small-site-attacked-by-hackers/) and [signs your WordPress site is hacked](https://wpsecurityninja.com/signs-wordpress-site-is-hacked/).

## What a hacked redirect costs you

![Attack](https://wpsecurityninja.com/media/2019/10/giphy-downsized.webp)

Attack. Source: Giphy.

- Visitors land on scams or drive-by downloads and blame your brand
- Analytics traffic collapses while bounce and “external referrer” noise rises
- Search engines may flag or demote the site; recovery takes cleanup plus [Search Console work](https://wpsecurityninja.com/recover-wordpress-websites-seo-after-hacker-attack/)
- Hosts may take the site offline to protect the server
- Revenue and support load both get worse the longer the redirect stays live

## Where to look first (concrete infection points)

Check these locations in order. Many incidents use more than one.

### 1. `.htaccess`

Look for unexpected `RewriteRule` / `RewriteCond` blocks, redirects to unknown domains, or `auto_prepend_file` / `auto_append_file` tricks. Compare with a clean default for your permalink setup. Malicious rules often sit at the top or bottom of the file.

### 2. `index.php` (web root and theme)

WordPress root `index.php` should be short and standard. Extra `header('Location:...')`, `eval`, or remote includes are red flags. Theme `header.php`, `footer.php`, and `functions.php` get the same treatment.

### 3. `siteurl` and `home` options

In **Settings → General**, confirm WordPress Address and Site Address. Attackers also change `siteurl` / `home` directly in the database (`wp_options`). Wrong values send the whole admin or front end to another host.

You can inspect with WP-CLI when you have shell access:

```bash
wp option get siteurl
wp option get home
```

Reset them to your real HTTPS URLs if they were altered.

### 4. JavaScript and content in posts, widgets, and builders

Search posts, pages, widgets, and theme options for `<script>` tags, `window.location`, or obfuscated base64 blobs you did not add. Page builders and “custom HTML” widgets are frequent plant points.

### 5. Uploads and stray PHP

Scan `wp-content/uploads/` for `.php` files and recently modified assets that load remote scripts. A single [webshell](https://wpsecurityninja.com/dictionary/webshell/) can reinject redirects after you clean the theme.

### 6. Database options and cron

Malicious code in `wp_options`, unexpected cron events, and unknown admin users keep redirects alive after a partial cleanup. Pair file cleanup with a user audit.

## What to do when you confirm a redirect

1. **Contain:** maintenance mode or temporary offline so fewer visitors hit the scam destination.
2. **Back up** files and database before mass deletes (forensics and rollback).
3. **Scan** with a [malware scanner](https://wpsecurityninja.com/malware-scanner/) and [core / integrity checks](https://wpsecurityninja.com/core-scanner/). Update the security plugin first so signatures are current.
4. **Clean known paths above.** Prefer restoring clean WordPress core, theme, and plugin packages over surgical edits of obfuscated code.
5. **Remove backdoors and unknown admins.** A redirect that returns overnight almost always means leftover access.
6. **Rotate passwords** for all privileged users, hosting, FTP/SFTP, and database. Turn on [2FA](https://wpsecurityninja.com/two-factor-authentication-2fa/).
7. Follow the full [hacked site](https://wpsecurityninja.com/what-should-you-do-if-your-wordpress-site-is-hacked/) and [malware removal](https://wpsecurityninja.com/wordpress-malware-removal/) guides. Ask your host or [hire cleanup](https://wpsecurityninja.com/consultation/) if you cannot get a clean scan.

Manual file review is possible if you know the tree well. It is slow and easy to miss conditional redirects. Use scanners, then verify the high-risk paths by hand.

## Keep redirects from coming back

- Update WordPress core, themes, and plugins; delete unused ones
- Unique admin passwords plus [two-factor authentication](https://wpsecurityninja.com/two-factor-authentication-2fa/)
- [Login protection](https://wpsecurityninja.com/login-protection/) so bots cannot keep guessing
- Put exploit and bot traffic behind [Cloud Firewall](https://wpsecurityninja.com/cloud-firewall/)
- Keep offsite backups you can restore to a known-good date
- Watch [file integrity](https://wpsecurityninja.com/dictionary/file-integrity-monitoring/) with the [Core Scanner](https://wpsecurityninja.com/core-scanner/) so silent file edits show up early
- Re-run the [malware scanner](https://wpsecurityninja.com/malware-scanner/) after cleanup, then watch the [events log](https://wpsecurityninja.com/events-logger/)

Do not leave a “mostly cleaned” site public. Finish persistence removal, then reopen. That is how you stop WordPress hacked redirects from owning your traffic and your reputation.