Quick answer: A WordPress site that redirects visitors to spam is almost always infected with malware injected through an outdated plugin, theme or stolen password. To fix it: back up the site, change every password, scan for malware, remove malicious code from files and the database (or restore a clean backup), update everything, delete unknown admin users, then request a review in Google Search Console if your site was flagged.
Redirect hacks are frustrating because they often hide from site owners — logged-in admins may see a normal site while visitors from Google or mobile phones are sent to scam pages. Here’s how to confirm and clean the infection.
Signs your site has a redirect hack
- Visitors from Google or social media land on spam, gambling, pharmacy or fake prize sites.
- The redirect happens only on mobile, only once per visitor, or only for logged-out users.
- Google shows a “This site may be hacked” warning or strange titles in search results.
- Unknown admin users appear in Users.
- New files appear in wp-content or the site root.
- Your host suspends the site for malware.
Step 1: Confirm the hack safely
Open your site in a private browser window on mobile data, or search for your site on Google and click the result. Use a remote scanner to check for known malware. Look in Google Search Console under Security issues.
Step 2: Back up the infected site
It sounds strange, but take a full backup before you change anything. If cleaning goes wrong, you can return to this point. Label it clearly as infected.
Step 3: Change all passwords
- WordPress admin accounts.
- Hosting control panel.
- SFTP/FTP and SSH.
- Database password (update wp-config.php to match).
- Email accounts linked to admin users.
Then regenerate the security keys (salts) in wp-config.php using the official WordPress salt generator. This logs everyone out.
Step 4: Restore a clean backup (fastest option)
If you have a backup from before the infection, restoring it is usually the quickest fix. Then immediately update everything and change passwords again, because the original vulnerability still exists. See our backup guide.
Step 5: Clean the infection manually
If no clean backup exists, clean the site step by step:
- Scan files with a security plugin or your host’s malware scanner.
- Replace WordPress core: delete the wp-admin and wp-includes folders and upload fresh copies from the official download.
- Reinstall plugins and themes from official sources, deleting the old folders.
- Check the root folder for unfamiliar PHP files and inspect .htaccess for redirect rules you didn’t add.
- Check wp-content/uploads for PHP files — uploads should not contain PHP.
- Inspect wp-config.php for injected code at the top or bottom.
Step 6: Clean the database
Redirect malware often hides in the database. In phpMyAdmin or a database tool, search for suspicious script tags or unfamiliar domains in:
- wp_options — especially siteurl, home and widget settings.
- wp_posts — injected scripts inside post content.
- wp_users — unknown admin accounts.
Remove malicious entries carefully. If you’re not comfortable editing the database, use a professional service — see WordPress malware removal services.
Step 7: Remove unknown users and check roles
Delete admin users you didn’t create, and review all roles. Attackers often add a hidden admin to regain access later.
Step 8: Update and harden
- Update WordPress, plugins, themes and PHP.
- Remove unused plugins and themes.
- Enable two-factor authentication.
- Add a firewall — compare options in Wordfence vs Sucuri.
- Disable file editing in the dashboard.
Our security checklist lists every hardening step.
Step 9: Tell Google your site is clean
In Search Console, open Security issues and click Request review, explaining what you fixed. Remove spam URLs that were created, and make sure they return 404 or 410. Reviews usually take a few days.
How did the hackers get in?
| Common cause | Prevention |
|---|---|
| Outdated or vulnerable plugin | Update weekly; follow vulnerability news |
| Nulled (pirated) theme or plugin | Only use official sources |
| Weak or reused password | Unique passwords + 2FA |
| Compromised hosting account | Secure hosting with isolation |
When to call a professional
If the redirect keeps coming back, your host has suspended the site, or the site handles payments or personal data, use a professional clean-up service. Reinfection usually means a backdoor was missed.
Common types of redirect malware
| Type | Where it hides | Typical sign |
|---|---|---|
| JavaScript injection | Posts, widgets, theme files or wp_options | Redirect after the page starts loading |
| .htaccess redirect | The .htaccess file in the root or subfolders | Redirect only for visitors from Google or mobile |
| PHP backdoor | Fake plugin folders, uploads, mu-plugins | Malware returns after you clean it |
| Database injection | siteurl/home options, post content | Whole site points to another domain |
| Fake plugin | wp-content/plugins with a believable name | A plugin you never installed |
Check the wp-content/mu-plugins folder too. “Must-use” plugins load automatically and don’t appear in the normal plugin list, which makes them a favourite hiding place.
A realistic clean-up timeline
- First hour: back up the infected site, change passwords, put a maintenance page up if visitors are being harmed.
- Hours 1–4: restore a clean backup or replace core, plugins and themes; search the database; remove rogue users.
- Same day: update everything, harden settings, add a firewall, test from mobile and Google search results.
- Next 1–3 days: request a Google review and monitor for reinfection.
Don’t forget the server itself
Sometimes WordPress isn’t how attackers got in. In October 2026 the PHP2Shell vulnerabilities let attackers run code on unpatched servers before WordPress even loaded. If your site was hacked around that time, ask your host to confirm PHP was patched and workers restarted. Otherwise your clean-up won’t last. The same applies to old copies of the site in subfolders (like /old or /test). They often run outdated plugins and give attackers a way back in, so delete them or protect them with a password.
How to tell customers
If your site collects customer accounts, orders or personal data, consider whether you need to inform users or authorities under laws like GDPR. Be honest and brief: what happened, what data may have been affected, what you’ve done and what users should do (for example, change their password). Clear communication protects trust far better than silence.
After the clean-up: a seven-day watch list
For a week after cleaning, check your site each day from a private browser window on your phone, search Google for “site:yourdomain.com” to spot new spam pages, and watch your security plugin for file changes. If anything reappears, a backdoor was missed — stop and get professional help rather than cleaning the same files again.
Should you switch hosts after a hack?
Not automatically. Most hacks come through plugins or passwords, not the host. But consider moving if your host was slow to patch server software, offered no help, keeps you on an outdated PHP version or puts many sites on one account without isolation. A good host is part of your defence.
FAQ
Why don’t I see the redirect when I’m logged in?
Malware often targets logged-out or mobile visitors to stay hidden from admins.
Will my rankings recover?
Usually, once the site is clean and Google’s warning is removed.
Can a security plugin remove the malware?
Some can, but manual checks of files and the database are often still needed.
WordPressPrime.com is an independent guide and is not affiliated with the WordPress Foundation, WordPress.org or Automattic. Always back up your website before making changes, and check official sources for the latest details.
