WordPress hacked redirect: find, fix, and prevent spam redirects

A WordPress hacked redirect sends visitors (or only some of them) to spam, phishing, or malware sites instead of your content. Sometimes every request bounces before your theme loads. Sometimes only mobile users, search traffic, or a single injected link is affected. Either way, treat it as an active malware incident, not a “SEO tweak.”

Act quickly. Redirects burn trust, trigger Safe Browsing warnings, and can get the host to suspend the account so neighbors on the server stay clean.

How redirect infections get in

Attackers look for the usual openings: outdated plugins and themes, weak or reused admin passwords, nulled packages, and exposed file upload bugs. After they get in they may:

• Inject redirect code into files or the database
• Change the WordPress Address / Site Address options
• Add a hidden administrator so they can put the redirect back
• Drop a webshell or other backdoor for later access

Redirects do not always hit the homepage only. They can sit on a landing page link, in a footer script, or in conditional code that fires for Googlebot or phones only. That is why “it looks fine when I visit” is a weak all-clear.

Background reading: why small sites get attacked and signs your WordPress site is hacked.

What a hacked redirect costs you

Attack. Source: Giphy.

• Visitors land on scams or drive-by downloads and blame your brand
• Analytics traffic collapses while bounce and “external referrer” noise rises
• Search engines may flag or demote the site; recovery takes cleanup plus Search Console work
• Hosts may take the site offline to protect the server
• Revenue and support load both get worse the longer the redirect stays live

Where to look first (concrete infection points)

Check these locations in order. Many incidents use more than one.

1. .htaccess

Look for unexpected RewriteRule / RewriteCond blocks, redirects to unknown domains, or auto_prepend_file / auto_append_file tricks. Compare with a clean default for your permalink setup. Malicious rules often sit at the top or bottom of the file.

2. index.php (web root and theme)

WordPress root index.php should be short and standard. Extra header('Location:...'), eval, or remote includes are red flags. Theme header.php, footer.php, and functions.php get the same treatment.

3. siteurl and home options

In Settings → General, confirm WordPress Address and Site Address. Attackers also change siteurl / home directly in the database (wp_options). Wrong values send the whole admin or front end to another host.

You can inspect with WP-CLI when you have shell access:

wp option get siteurl
wp option get home

Reset them to your real HTTPS URLs if they were altered.

4. JavaScript and content in posts, widgets, and builders

Search posts, pages, widgets, and theme options for <script> tags, window.location, or obfuscated base64 blobs you did not add. Page builders and “custom HTML” widgets are frequent plant points.

5. Uploads and stray PHP

Scan wp-content/uploads/ for .php files and recently modified assets that load remote scripts. A single webshell can reinject redirects after you clean the theme.

6. Database options and cron

Malicious code in wp_options, unexpected cron events, and unknown admin users keep redirects alive after a partial cleanup. Pair file cleanup with a user audit.

What to do when you confirm a redirect

1. Contain: maintenance mode or temporary offline so fewer visitors hit the scam destination.
2. Back up files and database before mass deletes (forensics and rollback).
3. Scan with a malware scanner and core / integrity checks. Update the security plugin first so signatures are current.
4. Clean known paths above. Prefer restoring clean WordPress core, theme, and plugin packages over surgical edits of obfuscated code.
5. Remove backdoors and unknown admins. A redirect that returns overnight almost always means leftover access.
6. Rotate passwords for all privileged users, hosting, FTP/SFTP, and database. Turn on 2FA.
7. Follow the full hacked site and malware removal guides. Ask your host or hire cleanup if you cannot get a clean scan.

Manual file review is possible if you know the tree well. It is slow and easy to miss conditional redirects. Use scanners, then verify the high-risk paths by hand.

Keep redirects from coming back

• Update WordPress core, themes, and plugins; delete unused ones
• Unique admin passwords plus two-factor authentication
• Harden logins with the login security guide
• Put exploit and bot traffic behind a firewall
• Keep offsite backups you can restore to a known-good date
• Watch file integrity so silent file edits show up early

Do not leave a “mostly cleaned” site public. Finish persistence removal, then reopen. That is how you stop WordPress hacked redirects from owning your traffic and your reputation.