If your WordPress site is sending visitors to gambling, pharmacy or adult sites, it has been compromised. The redirect is a symptom, not the problem. Deleting the code that does the redirecting without finding how it got there will buy you a day or two before it comes back.
The part that makes this maddening is that the site usually looks perfectly normal to you. You click around, everything is fine, and meanwhile customers are ringing up to say your website sent them somewhere unpleasant. That is not you imagining things, and it is not them doing something wrong. It is deliberate.
Why it works for everyone except you
Redirect malware is written to stay hidden from the site owner for as long as possible, because the longer it survives the more it earns. So it fires selectively. Common conditions:
- Only on mobile. Site owners check on a desktop. Their customers are on phones
- Only for visitors arriving from Google. You type your domain straight into the address bar, so you never trigger it
- Only once per visitor. It sets a cookie, so it redirects a person the first time and then leaves them alone, which makes it almost impossible to reproduce on demand
- Never for logged-in users. You are logged in as an administrator nearly all the time
If you want to see it yourself, open your site on a phone, on mobile data rather than your office wi-fi, in a private window, having arrived from a Google search rather than typing the address. That combination reproduces it more often than not.
Where the redirect is usually hiding
There are a handful of usual homes for this, and they are worth checking in roughly this order:
- Injected JavaScript in the theme header or footer, often a long line of obfuscated code, or an innocuous-looking script tag pointing at a domain you do not recognise
- PHP appended to theme or plugin files, usually right at the top of the file before anything else runs
- Rules added to
.htaccess, which catch visitors before WordPress even starts - A malicious must-use plugin in
wp-content/mu-plugins. These load automatically, do not appear in the normal plugins list, and cannot be deactivated from the dashboard - Rows in the database, typically in the options table, which is why a file-only scan sometimes reports a clean site that is plainly still infected
One detail worth knowing: files in wp-content/uploads should never be PHP. If you find a .php file sitting among your images, you have almost certainly found either the payload or the way back in.
What to do first
Take the site offline or put it behind maintenance mode if you can. It feels drastic. It is less drastic than continuing to redirect your customers to a pharmacy site while you work out what to do, and it stops the damage to your search rankings and your reputation accruing by the hour.
Then change the passwords, all of them: WordPress administrators, hosting control panel, FTP and SFTP, and the database user. Rotate the security keys in wp-config.php as well, which logs out every existing session including the attacker’s.
The bit that actually matters
Finding and removing the redirect is the easy half. The half that decides whether this is over is finding the entry point.
That is almost always an outdated plugin, an outdated theme, or a password that was reused somewhere that got breached. Until you know which, you have not finished, and a site that gets reinfected a week later was never really cleaned in the first place.
Check your file modification dates around the time the problem started, look at whether any administrator accounts appeared that you did not create, and look hard at anything that was running a version behind.
Common questions
Can I just restore a backup?
Only if you know for certain the backup predates the compromise, and even then it restores the vulnerability that let them in. Restoring is a reasonable first move to get a clean site back online quickly, but it is not a fix on its own. Patch everything immediately afterwards.
I deleted the malicious file and it came back. Why?
Because something else on the site put it there again, usually a backdoor elsewhere in the filesystem or a scheduled task. That is the classic sign that the redirect was the symptom and the real problem is still present.
Will this have hurt my Google rankings?
Probably, and the longer it runs the worse it gets. Google may also show a “Deceptive site ahead” warning to anyone trying to visit, which stops traffic almost completely until it is cleaned and reviewed.
How do I stop it happening again?
Keep WordPress, themes and plugins patched, remove anything you are not using, and have somebody actually watching. That is what a care plan is for, and it is a great deal cheaper than the alternative.
If you want it dealt with
Hacked site rescue is a fixed £200. That is the clean, the entry point closed, and the site hardened afterwards, and if I cannot solve it you do not pay.
If you are not certain what you are looking at, send me the details and I will tell you straight, whether or not you end up hiring me.