A WordPress redirect hack sends your visitors, or just your mobile visitors, to spam, fake-prize or pharmacy sites instead of your homepage. The hack usually hides in more than one place, so removing one bad line and calling it done is the most common reason it comes straight back. This guide walks through finding every copy and closing the door it came through.
Attackers plant this kind of redirect because it is profitable and hard to spot. Many versions only fire for visitors coming from Google, or only on phones, so the site looks completely normal when you check it yourself from a laptop while logged in.
Check it from outside first
Open your site in a private browser window, or ask a friend on a phone with mobile data to open it. Also run your URL through Google Safe Browsing site status, which flags sites serving malicious redirects even before you see the symptom yourself.
How to tell you have a wordpress redirect hack
The classic pattern is a “cloaked” redirect: it only triggers for visitors who arrive from a search engine, and only sometimes, so logged-in admins rarely see it. Watch for these signs:
- Customers or friends report your site sending them to a strange domain, a fake CAPTCHA, or an app-store page.
- Google Search Console shows a Security Issues warning under Security & Manual Actions.
- Your organic traffic drops sharply while direct traffic stays normal.
- New, unfamiliar admin users, plugins or scheduled tasks appear in wp-admin.
If any of these match, treat it as a wordpress redirect hack and work through the checks below before doing anything else on the site.
Where the redirect code usually hides
A redirect hack rarely lives in just one file. Attackers spread copies around so that cleaning one does not remove the rest.
| Location | What to look for |
|---|---|
.htaccess | Extra RewriteCond/RewriteRule blocks, often testing HTTP_USER_AGENT or HTTP_REFERER |
Theme functions.php | A wp_head or init hook that calls header('Location: ...') or prints a JavaScript redirect |
wp-config.php | Injected PHP above the “stop editing” line |
Database wp_options table | The siteurl or home values changed, or a rogue option storing malicious script |
Database wp_posts table | Base64-encoded JavaScript appended to post or widget content |
mu-plugins folder | An unfamiliar file here always loads, even if every normal plugin is deactivated |
Step 1: Confirm the wordpress redirect hack and take the site offline briefly
Put the site in maintenance mode or switch on “under construction” at the hosting level so visitors are not exposed while you work. Take a full backup of files and database even though they are infected; you need something to compare against once you have cleaned it.
Then check Settings → General in wp-admin. If WordPress Address (URL) or Site Address (URL) point somewhere you do not recognise, that alone can cause a full-site redirect and is often the fastest clue.
Step 2: Check .htaccess and wp-config.php by hand
Open .htaccess in the site root through SFTP or your host’s file manager. The default WordPress block looks like this:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>Anything else, especially lines mentioning HTTP_USER_AGENT, HTTP_REFERER, or a domain you do not own, should be removed. Do the same for wp-config.php: everything above <?php or after the closing tag, and any block you cannot explain, is suspect.
Step 3: Compare WordPress core files against a clean copy
Download a fresh copy of your exact WordPress version from wordpress.org and compare it file by file against your wp-admin and wp-includes folders. Any file that differs, or any extra file that should not be there, is worth inspecting closely. A security plugin such as Wordfence or Sucuri Scanner can run this comparison for you and flag altered core files automatically.
Step 4: Check themes, plugins and the database
Deactivate and delete any plugin or theme you do not recognise or no longer use; unused code is extra surface for attackers to reinfect through. In active theme files, search for base64_decode, eval(, gzinflate and str_rot13, which are common ways malicious redirect code is disguised.
In phpMyAdmin, search the wp_posts and wp_options tables for <script> tags or long encoded strings that do not belong in ordinary post content. Our guide on how to remove malware from WordPress covers this database cleanup step in more depth.
Step 5: Check for hidden admin users and scheduled tasks
Go to Users and confirm every administrator account belongs to someone you trust. Attackers commonly create a second admin account as a backdoor so they can walk back in even after the redirect code is removed.
Also check for fake cron jobs added through WP-Cron or the hosting panel’s cron scheduler, since some redirect hacks re-add their own files on a timer. WP-CLI’s wp cron event list shows every scheduled event if you have command-line access.
Step 6: Lock the site down afterwards
Cleaning the code is only half the job; the same weak point will let the attacker back in if you skip this part.
- Update WordPress core, every theme and every plugin to the latest version.
- Change the WordPress admin password, the database password, and your hosting/SFTP password.
- Regenerate the security keys in
wp-config.phpusing the WordPress secret key generator, which instantly logs out every session. - Request a review in Search Console once the site is clean, so the Security Issues warning and any Safe Browsing block are lifted.
Stopping a wordpress redirect hack from coming back
Most redirect hacks start with an outdated plugin, a stolen FTP password, or a weak admin login rather than a flaw in WordPress core itself. Keep everything updated, use unique strong passwords with a password manager, and add two-factor authentication to every admin account. A security plugin that scans files for changes on a schedule will catch a reinfection long before your customers do.
Rather have it fixed for you?
We remove wordpress redirect hacks and other malware from $120, with an emergency lane on WhatsApp (+880 1722 859059) when a client-facing site is actively redirecting. Get it cleaned up, or ask about our ongoing maintenance plan so it does not happen again.
WordPress redirect hack: quick answers
Why does my wordpress redirect hack only happen on mobile?
Attackers deliberately target mobile visitors and search-engine traffic because that is where ad and affiliate fraud pays best, and because it hides the hack from an admin browsing normally on a desktop. Always test from a phone or a private window before assuming a site is clean.
Will a plugin alone remove a wordpress redirect hack?
A security plugin will find most of it, especially altered core files and known malware signatures, but injected database content and custom backdoors sometimes need a manual check. Run a scan first, then work through the manual steps above for anything it misses.
Can a wordpress redirect hack hurt my Google rankings?
Yes. Google can flag the site with a Security Issues warning in Search Console, show a browser interstitial warning to visitors, and drop rankings until the issue is fixed and reviewed. Request a review as soon as the site is confirmed clean.
How do I stop the redirect from coming back after I remove it?
Change every password, update all software, remove unused plugins and themes, and add two-factor authentication. Most reinfections happen through the same stolen credential or outdated plugin that let the attacker in the first time.
