WordPress Site Redirecting to Spam? How to Find and Fix It

If your WordPress site redirects visitors to spam, gambling, pharmacy or “you’ve won” pages, treat it as a hack until proven otherwise. Hackers often make the redirect conditional, so it fires only for visitors coming from Google, for phones, or for people who are not logged in. That is why the site can look fine to you and still be sending your customers elsewhere.

This guide is for owners and marketing managers who have had a customer say “your website sent me somewhere strange” and need to know what to check, what to leave to an expert and what a fix should cost. It covers the checks in the order we’d run them, why the redirect keeps returning, and what to do about Google afterward. For the wider emergency steps, read our guide on what to do in the first hour after a hack.

Why you can’t see the redirect but your visitors can

A malicious redirect is written to avoid the one person most likely to notice it: you. Hacked-site redirects are commonly written to depend on the visitor’s referrer, device or browser, which is why the same page can behave differently for different people. The typical conditions look like this:

What visitors report	What it usually means	How to test it safely
Redirected only after clicking a Google result	The redirect checks where the visitor came from	Search for your own page on Google and click through, instead of typing the address
Redirected only on a phone	The redirect checks the device type	Open the page on a phone using mobile data, not your office Wi-Fi
Redirected only when logged out	Logged-in admins are skipped on purpose	Use a private window with no WordPress login
Redirected once, then fine	The script sets a cookie after the first run	Clear cookies, or use a fresh private window
Whole site replaced by a spam page	Core settings or the main redirect rules were changed	Check Settings, then General, for the WordPress and Site addresses

Also open Google Search Console and look at the Security issues and Manual actions reports. Google often flags a hacked site there before the owner notices. If you see a hacked-content warning, the problem is confirmed, and you’ll need a review request after the cleanup.

What to do in the first 30 minutes

Move quickly, but don’t start deleting things. Evidence and a clean way back matter more than speed in the first half hour.

1. Take a full backup of the site as it is now, files and database, and store it away from the web server. You may need it to find the way in.
2. Change passwords for every WordPress admin, the hosting account, the database, SFTP or SSH and the email address tied to the site. Do the hosting account first.
3. Check the user list under Users. Any administrator you don’t recognize is a sign of a hack; note it before removing it.
4. Tell your host. Many hosts can scan the account and show which files changed recently.
5. Put the site in maintenance mode if customers are being sent to harmful pages, so nobody else is redirected while you work.

Don’t restore an old backup and call it finished. The hole that let the attacker in is still there, and an old backup may already contain the infection. The WordPress.org guide to a hacked site makes the same point: find the cause, not just the symptom.

Where spam redirects hide in a WordPress site

Redirects live in a handful of places. Checking them in this order finds most of them.

The .htaccess file

On Apache hosting, this file in the site’s root folder controls redirects. A clean WordPress file contains one block between the lines “BEGIN WordPress” and “END WordPress”, plus any rules you added deliberately. Anything unfamiliar outside that block, especially rules that mention search engines, mobile devices or unfamiliar domains, deserves attention.

Theme and plugin files

Malicious script is often added to a theme’s header, footer or functions file, or tucked into a plugin that looks harmless. A plugin that isn’t in your dashboard but exists in the plugins folder is suspicious. So is a plugin or theme that was “nulled” (a pirated copy of a paid product), since these often ship with a backdoor.

The database

Redirect code can sit inside posts, widgets, theme options or site settings, so cleaning files alone won’t remove it. Look for script added to widget areas and for changes to the site address settings. Database cleaning is where DIY attempts go wrong, because removing the wrong row can break the site.

Uploads and hidden files

The uploads folder should hold images and documents, not code. Script files in there, or files with odd names that look like core files, are red flags. They’re often the backdoor that brings the redirect back after a cleanup.

Admin users and scheduled tasks

A new administrator account is a common way back in. Scheduled tasks that re-create deleted files do the same job quietly. If a cleaned site is reinfected within hours, one of these is usually responsible.

From our projects: We start every cleanup by scanning the site and quoting a fixed price before any work begins. A cleanup replaces core files with clean copies, removes malicious code from plugins, uploads and the database, hardens the site and closes the way in, then ends with a written report. Standard cleanups carry a free re-clean within 30 days.

Why the redirect keeps coming back

Reinfection has three common causes, and each one needs a different fix.

Cause	Sign	The fix
A backdoor was missed	The redirect returns within hours or days	Find and remove every hidden file and rogue admin; replace core files from official copies
The entry point is still open	Cleaned site is hacked again weeks later	Update or remove the vulnerable plugin or theme; strengthen passwords and access
Stolen passwords still work	New admin accounts appear again	Reset hosting, database, SFTP and WordPress passwords; review who has access

Prevention is mostly boring maintenance: keep core, plugins and themes updated, delete what you don’t use, use unique passwords with two-factor sign-in, and keep tested backups away from the web server. The WordPress hardening guide lists the settings worth checking. If nobody on your team does this monthly, a WordPress care plan covers updates and backups for $49, $99 or $199 a month depending on the plan.

Clean it yourself or hire a specialist?

You can clean a simple infection yourself if you have a recent clean backup, comfortable access to your files and a quiet afternoon. For most business sites, the risk of leaving a backdoor outweighs the saving. Use this as a guide:

Your situation	Better route
Hobby site, clean backup from before the hack, comfortable with files and the database	DIY, following the WordPress.org guide
Business site, redirect came back once already	Specialist cleanup
Online store or customer data on the site	Specialist cleanup, and think about your notification duties
Site is down, losing sales or flagged by Google	Same-day specialist cleanup
No backup, or you can’t tell when the hack happened	Specialist cleanup

Our WordPress malware removal service starts at $199, with an emergency same-day option from $349. Most cleanups cost between $199 and $499 depending on how big the infection is, and you approve a fixed quote first. For the full cost picture, including lost sales, see our guide to what a hack costs to fix.

Clean up your search results after the fix

Getting rid of the redirect is half the job. Google may have indexed spam pages on your domain, and visitors may have seen a warning. Work through these after the cleanup:

• Check Search Console’s Security issues report and fix anything listed.
• If you have a manual action for hacked content, fix the cause and submit a review request from the Manual actions report. Explain what you cleaned and how you closed the way in.
• Search Google for your domain plus words like casino or pills, to spot spam pages that were indexed.
• Remove spam URLs by returning a proper error for them, then resubmit your sitemap.
• Watch Search Console for a few weeks for new security warnings.

If the hack damaged content or pages were deleted, our guide on restoring a website from the Wayback Machine explains what can be recovered. Preventing the next one belongs in your website maintenance plan.

Get a hacked site cleaned and closed

Attors Technologies is a web development agency that cleans, repairs and maintains WordPress sites for businesses in the US, UK and Europe. Send us the site address and what visitors are seeing. We scan it, quote a fixed price and clean it, then close the way in and send a written report.

Get your hacked WordPress site cleaned