Injected JavaScript in the database
Script tags appended to posts, widgets, or theme options — often autoloaded on every page and pointing at a rotating chain of throwaway domains.
Guide · Redirect infections
WordPress site redirecting to spam: what it means and what actually fixes it.
Visitors report landing on ads, fake giveaways, adult content, or “your device is infected” pages — but when you open the site, everything looks normal. That mismatch is the signature of a WordPress redirect hack, and it is the most common way owners discover a compromise.
Published Last reviewed
- Symptom
- Visitors land on spam, ads, or scam pages instead of your content
- Typical trick
- Cloaking — the redirect fires only for some visitors
- Common carriers
- Injected JavaScript, database records, .htaccess, rogue plugins
- Risk
- Traffic loss, blocklisting, and “Deceptive site ahead” warnings
Why you cannot see it
The redirect is deliberately hidden from you
Redirect malware almost always cloaks. It commonly fires only for visitors arriving from Google or social links, only on mobile devices, only once per visitor (a cookie suppresses repeats), or never for logged-in administrators. The owner types the domain directly, sees a healthy site, and assumes the reports are mistaken.
That behavior is intentional: the longer the owner stays convinced nothing is wrong, the longer the redirect earns for whoever installed it. Treat repeated visitor reports as evidence, not noise.
Where it lives
The usual carriers of a WordPress redirect hack
Modified theme or plugin files
A few obfuscated lines added to functions.php or a plugin file, executing on every request and easy to miss in a casual review.
.htaccess rewrite rules
Server-level rules that redirect specific user agents or referrers before WordPress runs at all — invisible to plugin scanners.
Rogue or fake plugins
A plugin or mu-plugin you never installed, sometimes named to look official, reinstating the redirect whenever other copies are cleaned.
Malicious administrator accounts
An account you did not create, used to reinstall the redirect after each cleanup attempt.
Compromised ad or third-party scripts
Occasionally the redirect rides in through an injected third-party embed rather than the site itself — worth ruling out before a full cleanup.
First steps
What to do when the reports start
- 01
Confirm with a clean profile
Reproduce the redirect using a private window, a mobile device, and a Google-search entry point. Capture the destination URL and the time.
- 02
Preserve evidence
Do not start deleting files. Note timestamps, keep existing backups untouched, and export the database before changing anything.
- 03
Rotate access from a clean device
Hosting panel, WordPress administrators, and database credentials — and remove any administrator account you cannot vouch for.
- 04
Check Search Console
Security Issues and the URL Inspection tool show what Google sees, including cloaked spam pages you cannot see in a browser.
- 05
Avoid the quick restore
Restoring last week’s backup often restores last week’s infection, and never closes the entry path that let it in.
Fixing it properly
A durable fix removes the carrier, the access, and the cause
A redirect hack that is “fixed” by deleting one script line usually returns, because the injection point — a vulnerable plugin, a stolen credential, a rogue admin, or persistence elsewhere in the account — was never addressed. A proper cleanup rebuilds files from trusted sources, cleans the database, verifies .htaccess and PHP configuration, reviews every account, and closes the most likely entry path before declaring the site recovered.
If Chrome already shows “Deceptive site ahead” or Google flags the site, the warning is removed by requesting review after the cleanup — not before, since a failed review lengthens the process.
Common questions
Common questions about redirect hacks
Why does the redirect only happen on mobile or from Google?
Cloaking. The malware checks the referrer, device, and cookies before firing, so casual checks by the owner show a normal site while search visitors are monetized. Reproduce it under the victim’s conditions, not your own.
Will Google penalize my site for the redirects?
Google reacts to what the site serves: spam pages get indexed, cloaking violates policy, and Safe Browsing can flag the domain. Rankings usually recover after a verified cleanup and review request, but the longer the redirect runs, the slower the recovery.
I removed a suspicious script and the redirect stopped. Am I done?
Treat that as symptom relief, not recovery. If the entry path and any remaining persistence were not addressed, the same infection commonly returns within days — often slightly better hidden.
How did the redirect get in?
Most commonly through a vulnerable plugin or theme, a reused or stolen password, or a neighboring compromised site on the same hosting account. Identifying the likely path is part of the cleanup, because it decides what must change to stay clean.