You type in your own address, and instead of your homepage you land on some sketchy pill store, a fake prize page, or a site you’ve never heard of. If your WordPress site redirects to spam or to another website, it’s alarming — and it’s one of the clearest signs there is that the site has been hacked. Take a breath. This is a common, well-mapped attack, and once you know where the injected redirect hides, you can find it and pull it out. This guide walks through what causes it, exactly where to look, how to remove it, and how to keep it from coming back.
What a hacked redirect actually is
A malicious redirect is a piece of code an attacker plants on your site that sends visitors somewhere else — usually a spam, scam, or malware page they profit from. It’s one of the most common WordPress compromises because it monetizes your traffic directly.
The frustrating part is how sneaky these redirects are. They’re often conditional: they fire only for visitors coming from Google, only on mobile phones, only for people who haven’t visited before, or only once per person. That’s deliberate. It means you, the owner — logged in, on your desktop, visiting directly — may see nothing wrong, while every new visitor from search gets bounced to spam. So the first rule is: believe your visitors and your analytics, not just what you see when you load the site. The other signs of a compromise are in how to tell if your WordPress site has been hacked, and if Google has started labeling you over it, that ties into “this site may be hacked” in the search results.
Where the injected redirect hides
Redirect malware lives in a handful of predictable places. Check them in this order:
- The
.htaccessfile (a server settings file). The classic hiding spot. Attackers add rewrite rules that quietly send traffic elsewhere. Look for redirect or rewrite lines you didn’t write — they’re often buried below a lot of blank lines to push them out of sight. - WordPress’s own files and your theme’s code files. Especially
index.php,wp-config.php(WordPress’s main settings file),functions.php, and the theme header. Look for obfuscated code — long strings of gibberish,base64_decode,eval, and similar — near the top of the file. - The database. Redirects are frequently injected into the
wp_optionstable (thesiteurlandhomevalues, or injected scripts) and intowp_postsas content appended to pages. This is the spot DIY cleanups most often miss. - Rogue plugins or “mu-plugins.” Attackers drop a small malicious plugin, or a file in the
mu-pluginsfolder that loads automatically, to re-inject the redirect after you clean the obvious files. - Injected JavaScript. Some redirects run client-side from a script added to your pages or pulled from an attacker’s server.
How to remove it — and make it stay gone
1. Back up the site as-is first
Before you edit anything, take a full backup of the site in its current state. If a cleanup step breaks something, you can get back. Label it clearly as infected so it’s never restored by accident.
2. Remove the redirect from every place it lives
Work through the list above and strip out the injected code: clean the .htaccess, replace tampered WordPress files with fresh copies from WordPress.org, reinstall the theme from a clean source, remove injected rows from the database, and delete any rogue plugin or mu-plugins file. The single most important thing here is to not stop at the first one you find. Attackers plant the redirect in several places and leave a backdoor so it re-injects itself minutes after you clean up — which is exactly why so many people clean a redirect, celebrate, and watch it return the same day. The full, careful sequence is in how to fix a hacked WordPress site.
3. Close the hole and lock it down
Cleaning the redirect fixes today; closing the hole fixes tomorrow. Update WordPress itself, every plugin, and every theme; delete anything unused; reset all passwords — admin, hosting, database, file access (FTP/SFTP); regenerate your security keys and salts to kill any stolen sessions; and turn on strong login protection. If the redirect keeps coming back after all that, it means a backdoor is still hiding somewhere — and that’s the point where a professional cleanup earns its keep. We weigh that call honestly in WordPress malware removal: DIY vs professional.
How SolutionHippo handles this
We’ll be straight about where we fit. This is the scenario our managed hosting is built to keep you out of in the first place. Malware scanning is part of the care that’s included with every plan — not an upsell, not a separate retainer — so an injected redirect tends to get caught and removed early, before your visitors are the ones who discover it. That’s prevention, not a guarantee: our scanning is designed to catch it before it spreads, backed up well: a strong firewall stops bad traffic early, breached-password login defense keeps stolen logins out, and off-site backups 3 times a day mean even a bad day is just a restore. After any change, we verify the site still looks and works right — for real visitors, not just for a logged-in admin.
And if your site is redirecting to spam right now? That’s work we do for sites we host, so the offer is simple: move your site to us, and we clean it as part of the move and keep it clean. We’ve traced injected redirects through files, databases, and .htaccess, torn out every copy, found the backdoor that kept re-injecting them, and closed the hole the attacker used. We won’t hand you a redirect that comes back tomorrow.
Watching your site bounce visitors to spam right now? It won’t clear on its own. Move your site to us: we clean it as part of the move and keep it clean. Start my move — your move starts as soon as you sign up. We’ll find the redirect, remove every copy, close the door behind it, and verify it’s gone for real visitors. Flat pricing at $29.99 a month for a managed site, or starting at $39.99 for a store, with the protection built in — no metering, no surprises.