WordPress Site Redirecting to a Spam Site? How to Find and Remove It
Visitors from Google or on phones get sent to a scam page while you see your normal site. That is a hack, and it hides in a few predictable places. Here is where to look.
Short answer: a redirect to a spam or scam site is malware, usually injected JavaScript in the database, a rewrite rule in .htaccess, or PHP code in a plugin, theme or wp-config.php. It often targets only visitors from Google or on mobile, so you may not see it when logged in. Take a backup, then check the places below, remove the code, change every password and fix the way the attacker got in.
Confirm it the way visitors see it
# pretend to be a phone arriving from Google, and show any redirect
curl -sI -A "Mozilla/5.0 (Linux; Android 14) Mobile" -e "https://www.google.com/" https://example.com/Where the redirect hides
| Place | How to check | What it looks like |
|---|---|---|
| siteurl / home options | wp option get siteurl; wp option get home | A domain that is not yours |
| .htaccess (Apache) | Open every .htaccess, not only the root one | RewriteCond on HTTP_REFERER or HTTP_USER_AGENT sending to another domain |
| Posts and widgets | wp db search '<script' --all-tables | Script tags or eval/atob code in post content or widget text |
| wp_options | Look for unfamiliar autoloaded options | Long encoded strings |
| Core files | wp core verify-checksums | Files that do not match the official release |
| Plugins | wp plugin verify-checksums --all | Modified files in plugins from WordPress.org |
| Uploads folder | find wp-content/uploads -name "*.php" | PHP files where only images should be |
Clean up and lock the door
- 1Remove the injected code and any unknown PHP files; reinstall core, plugins and theme from clean copies.
- 2Delete admin users you do not recognise (wp user list --role=administrator).
- 3Change WordPress, hosting, SFTP and database passwords, and replace the salts in wp-config.php.
- 4Update or remove the plugin or theme that let the attacker in; abandoned plugins are the usual way in.
- 5If Google shows a "deceptive site" warning, request a review in Search Console once the site is clean.
If one site on a shared server is redirecting, check the others. When all sites run as the same user, the attacker can usually write to every one of them.
On GHP Cloud
Each site runs as its own Linux user, so an infected site cannot write to the others. A web application firewall filters attacks before they reach PHP, malware scanning finds and quarantines malicious files, and an outbound firewall per site stops a backdoor from downloading more code. WP-CLI and the web terminal are in the panel for the checks above.
Frequently asked questions
Why does the redirect only happen on mobile?
Attackers target visitors who are less likely to be the site owner: mobile users and people arriving from search results.
Will restoring a backup fix it?
Only a backup from before the infection, and only if you also fix how the attacker got in. Otherwise it comes back.
Can a security plugin remove it?
It can find many infections, but malware that runs before plugins load or lives in the database often needs manual checks too.
GHP Team
GHP Cloud
Manage WordPress sites the smart way
GHP Cloud gives you a managed server in India with a firewall, malware scanning and daily backups, billed in INR with a GST invoice — from ₹1,450/month.