A WordPress hacked redirect is malicious code that sends some or all visitors from your site to spam, scam or gambling pages. To fix it, confirm the redirect from a clean device, take a copy of the infected site for evidence, then remove the code from wherever it hides (usually .htaccess, wp-config.php, theme or plugin files, injected JavaScript in the database, or rogue admin users), replace WordPress core with clean files, change every password and key, and only then ask Google to review the site. Restoring an old backup on top of an infected site rarely works on its own, because the hole the attacker used is still open.
This guide is for site owners who want to understand what they are dealing with and what to ask of whoever cleans the site. If the infection runs deep and no clean copy exists, the last section explains how the public pages can be rebuilt from archived captures.
Why a redirect hack is hard to see
Attackers want the redirect to last, so they hide it from the person most likely to remove it: you. Common tricks:
- Logged-in users are skipped. The code checks for a WordPress login cookie and leaves administrators alone.
- Only mobile visitors are redirected. Desktop browsers see the normal site.
- Only visitors from search engines are redirected. Typing the address directly shows nothing wrong; clicking a Google result does.
- Each visitor is redirected once. A cookie or IP log stops repeat redirects, so reloading the page looks fine.
- The redirect fires after a delay or on the first click, so a quick look at the home page misses it.
To confirm the problem, log out, open a private window on a phone using mobile data, search Google for your site name and click the result. Ask someone on a different network to do the same. Note the exact URL you were sent to; it helps whoever searches the files.
Need this done for you?
Wayback Restore rebuilds lost websites by hand from Wayback Machine snapshots. WordPress restoration ($79) starts at a fixed per-site price, with a free archive check before you pay.
Check what can be restored (free) · Request a free archive review
Where the WordPress hacked redirect code usually hides
| Location | What to look for |
|---|---|
.htaccess (site root and wp-content/uploads) |
RewriteCond rules checking HTTP_REFERER or HTTP_USER_AGENT for Google or mobile browsers, followed by a RewriteRule to an unknown domain |
wp-config.php, index.php, wp-settings.php |
Long lines of scrambled text, eval(, base64_decode(, gzinflate( or include of an odd file path |
Theme files, especially functions.php, header.php and footer.php |
Script tags loading from unfamiliar domains, obfuscated PHP at the very top or bottom of the file |
| Plugins | Plugins you do not recognise, nulled (pirated) premium plugins, folders with random names, PHP files inside wp-content/uploads |
Database (wp_options, wp_posts) |
siteurl or home changed to another domain; <script> tags injected into posts, widgets or theme options |
| Users | Administrator accounts nobody created, often with plausible names such as “wpadmin” or “support” |
| Outside WordPress | Changed DNS records at the registrar, or a compromised CDN or hosting account |
Security vendors such as MalCare and Cloudways describe the same set of hiding places in their write-ups of the redirect hack, and the WordPress documentation FAQ on hacked sites gives the official starting checklist.
How to fix a WordPress hacked redirect, step by step
- Take a full copy as it is now. Download the files and export the database before you change anything. It is evidence, and if cleanup goes wrong you will need it.
- Put the site into maintenance mode or ask the host to block public access while you work, so visitors stop being sent to harmful pages.
- Scan. Use a reputable security plugin’s scanner or your host’s malware scan to get a list of suspicious files. Treat the list as a starting point, not a guarantee that everything has been found.
- Replace WordPress core. Download a fresh copy of the same WordPress version from wordpress.org and replace
wp-admin,wp-includesand the root PHP files. Keep yourwp-config.php, but read it line by line and remove anything that does not belong. - Reset
.htaccess. Replace it with the standard WordPress rules, then go to Settings > Permalinks and save. Delete any.htaccessor PHP file insideuploads. - Reinstall plugins and the theme from their official sources. Delete anything you do not use and anything nulled. If your theme has custom edits, compare it against a clean copy before reusing it.
- Clean the database. Check
siteurlandhomeinwp_options, then search posts and options for<scriptand unfamiliar domains. Remove unknown administrator accounts. - Change every credential. WordPress users, hosting panel, SFTP, database password (update
wp-config.phpto match), and generate new security keys and salts. Attackers often leave a back door to get back in. - Update everything and close the entry point. The most common entry points are outdated plugins or themes, weak passwords and pirated software.
- Test from a clean device again, logged out, on mobile, via a search result, for several days.
If this list is beyond your comfort level, hire a malware cleanup specialist or ask your host whether they offer cleanup. Our related guide on whether to choose backup recovery or archive reconstruction after a hack helps you decide what to do with the content once the site is clean.
Should you just restore a backup?
A backup from before the infection can be the fastest route back, with two conditions. First, it must truly predate the hack; redirect code often sits unnoticed for weeks, so a backup from last week may already contain it. Second, after restoring you still have to update everything and change every credential, otherwise the attacker returns through the same hole. Restore into a staging copy, scan it, and compare its files against a clean WordPress download before you make it live. Our guide on how to restore a WordPress database covers the import if you only need the content tables.
Cleaning up search results after the hack
- Search Console: open the Security issues report. If Google flagged the site, fix the problem first, then use Request review and describe what you removed. Google’s Security Issues report help explains the review process.
- Spam pages: some redirect hacks also create thousands of spam URLs on your domain. Once they are deleted they should return 404 or 410; check Pages in Search Console and the sitemap to make sure none remain listed.
- Rankings: it can take weeks for search results to settle. If your site dropped out of Google entirely, our guide on a website that disappeared from Google covers the next checks.
When the site cannot be cleaned and there is no clean backup
Sometimes the files are so heavily modified that nobody trusts them, and every backup is infected or missing. In that case the safest course is often a fresh WordPress install with the content moved across. If the original content is not available in a trustworthy form, the Wayback Machine may hold captures of your public pages from before the hack. Those captures contain the text, layout and many images that visitors saw; they do not contain the database, users, orders, form submissions or anything that was never public.
Our WordPress restoration service rebuilds those pages on a clean WordPress install, so none of the infected code comes along. It does not remove malware from your current server. Use the free restoration check to see which pre-hack captures exist before deciding.
Frequently asked questions
Why does my WordPress site redirect only on mobile?
The injected code checks the browser’s user agent and targets phones, because owners usually check their sites on desktop. Look for rules in .htaccess or PHP and JavaScript that mention mobile, Android or iPhone.
Why can’t I see the redirect when I visit my own site?
Many redirect hacks skip logged-in users, repeat visitors or direct visits. Log out, use a private window on another network and arrive from a search result to reproduce it.
Will changing my WordPress password stop the redirect?
No. The redirect lives in files or the database. Changing passwords matters after cleanup to stop the attacker getting back in, but it does not remove the code.
Can a security plugin remove a WordPress hacked redirect?
Some can remove known infections, and scanners help find modified files. They can miss new or heavily hidden code, so check the locations above and keep testing for several days after cleanup.
