WordPress Site Redirecting to Spam? Signs, Causes and the Fix

I have cleaned enough redirect infections to recognise the pattern within minutes. The owner opens the site on a laptop and everything looks fine.

Customers, or Google, tell a different story. By the time someone emails us, traffic has dipped and someone has already seen a red browser warning.

This guide covers the symptoms: how to recognise the redirect, why it hides from you, where the code lives and what a proper cleanup looks like.

Signs your site is redirecting to spam

Redirect malware rarely shows up in the dashboard. Look for these patterns instead:

• Redirects only on mobile. Desktop looks normal, but phones jump to a spam page.
• Only when arriving from Google. Typing the URL works; clicking your search result does not.
• Only on the first visit. A refresh shows the real site, so you keep missing it.
• Never when you are logged in. Logged-out visitors get the spam hop.
• Browser or Google warnings. “Deceptive site ahead” or “This site may be hacked”.
• Odd admin users or files. Accounts you did not create, or PHP files inside uploads.

Why only some visitors see it

The redirect is not broken when you cannot reproduce it. It is cloaking. Before it fires, the injected code checks the visitor.

• Referrer: did they come from Google, Bing or another search engine?
• User agent: phone, tablet or desktop?
• Cookies: was this browser already redirected today?
• Login status: is there a WordPress login cookie?
• IP and location: some payloads skip hosting, VPN and bot ranges.

Where the redirect code hides

Something on the site is rewriting the visitor’s destination. These are the places we check first.

Server and config files

Look for conditional rewrite rules above the normal WordPress block in .htaccess, for example:

# Suspicious: redirects only visitors arriving from search engines
RewriteCond %{HTTP_REFERER} (google|bing|yahoo) [NC]
RewriteRule ^(.*)$ https://spam-example.xyz/ [R=302,L]

In wp-config.php, watch for unexpected include, eval() or base64_decode() lines.

Database

Check that siteurl and home in wp_options are still your domain, and look for script tags in posts, widgets and options:

SELECT option_name FROM wp_options
WHERE option_value LIKE '%<script%';

Themes, plugins and uploads

• Obfuscated code in functions.php or header.php of the active theme.
• Fake plugins, or files in wp-content/mu-plugins/ that never appear in the plugin list.
• Any .php file inside wp-content/uploads/, which should only hold media.
• Outdated or nulled plugins and themes, a common entry point.

Quick checks you can do safely

Do these before you delete anything. The goal is confirmation, not surgery on a live infected site.

1. Open the site in a private window on a phone using mobile data.
2. Search your brand on Google and click the result instead of typing the URL.
3. In Google Search Console, open Security issues and Manual actions.
4. Check the domain in Google’s Safe Browsing site status.
5. Review Users → All Users for admins you did not create.
6. Take a full backup (files and database) before changing anything.

What Google shows when it notices

Once Google detects the hack, two warnings usually appear. Both cost you clicks until the site is cleaned and reviewed.

• Search Console lists the issue under Security issues, with sample URLs.
• Browsers show a full-page red “Deceptive site ahead” warning.
• Search results may show “This site may be hacked” under your listing.

How a proper cleanup works

A redirect hack is not fixed by deleting the one script you can see. A proper job follows a sequence.

1. Back up and isolate

   Copy files and database first. Limit damage while you work.

2. Scan files and database

   Core, themes, plugins, uploads, mu-plugins, .htaccess, wp_options, posts and widgets.

3. Remove malware and backdoors

   Strip injected code and every way back in, not just the visible redirect.

4. Replace core, themes and plugins

   Reinstall clean copies from trusted sources.

5. Reset access

   New passwords, fresh salts in wp-config.php, rogue admins removed.

6. Harden and update

   Close the entry point, update everything, remove unused plugins.

7. Request a Google review

   File the review in Search Console once the site is clean.

8. Monitor for reinfection

   Watch files, users and search results for the following weeks.

Risks of fixing it yourself

If you know your stack, you can do a lot of this. The danger is a partial cleanup that looks fine for a day and then comes back.

• Backdoor left behind. The visible script goes, the attacker’s access stays.
• Breaking the site. Blind edits to functions.php or .htaccess can take it offline.
• Longer Google warnings. Remnants make review requests fail.
• Infected backups. Rolling back can restore the same malware.

Related reading

• How to detect and clean a WordPress malware redirect
• Japanese keyword hack: what it is and how to fix it
• How much does WordPress malware removal cost?
• How to recover SEO rankings after a hacked website

Frequently asked questions