Short answer
When a WordPress site sends visitors to spam, scam, adult, pharma or fake-prize pages, it is almost never a setting you toggled by mistake. It is malware: injected code that decides who gets redirected and who sees the real site. The fix is a full cleanup of files and the database, not a quick theme change.
I have cleaned enough redirect infections over the years to recognise the pattern within a few minutes of hearing the symptoms. The owner opens the site on their laptop and everything looks fine. Their customers, or Google, tell a different story. By the time someone emails me, traffic has already dipped and someone has seen a red browser warning.
This guide is the symptom side of the problem: how to recognise a WordPress site redirecting to spam, why it hides from you, what usually causes it, and what a proper cleanup looks like. If you want the hands-on technical walkthrough afterwards, use our cleanup guide linked at the end. If you already know you need help, our WordPress malware removal service starts from $149.
Signs you have this
Redirect malware rarely announces itself in the admin dashboard. Look for these patterns instead.
Redirects only on mobile
Desktop looks normal. Phones and tablets jump to a spam or scam page. Attackers often target mobile user agents because owners test on a laptop.
Only when arriving from Google
Typing your URL works. Clicking your result in Google Search does not. The malware checks the referrer and only fires for search traffic.
Only the first visit / once per day
The first load redirects; a refresh does not. A cookie or similar marker stops the redirect repeating so the owner keeps missing it.
Never when logged in as admin
Logged-in users see the real site. Logged-out visitors get the spam hop. That is deliberate cloaking, not a coincidence.
Browser or Google warning
Chrome or Firefox shows “Deceptive site ahead”, or Search shows “This site may be hacked”. Safe Browsing has already flagged the domain.
Unknown admins, strange files, Search Console
New admin users you did not create, odd PHP files in uploads, Security issues in Search Console, or spam URLs in a site: search.
Why it only happens to some visitors
The malware is not broken when you cannot reproduce it. It is cloaking. Before it redirects, the injected code checks conditions such as:
- Referrer — did the visitor come from Google, Bing or another search engine?
- User agent — is this a phone, a tablet, or a desktop browser?
- Device and cookies — has this browser already been redirected today?
- Logged-in status — is there a WordPress login cookie?
- IP / geography — some payloads skip known hosting, VPN or bot ranges.
That is why your office PC shows a clean homepage while a customer on mobile data from Google lands on a fake prize page. The code was written to hide from you.
What causes it
In plain English, something on the site is rewriting the visitor’s destination. Common places we find it:
Injected JavaScript
Hidden scripts in posts, widgets, custom HTML blocks or options that send the browser elsewhere after the page loads.
Site URL / wp_options
Changed siteurl or home, or malicious rows in wp_options that load on every request.
Theme or fake plugin code
Malicious snippets in header.php, functions.php, a drop-in, or a fake plugin / must-use plugin.
.htaccess rewrite rules
Conditional redirects based on referrer or user agent, sitting above your normal WordPress rules.
Stolen admin or FTP passwords
Someone logged in with real credentials and planted the payload. Password reuse makes this common.
Outdated or nulled software
Old plugins/themes with known holes, or nulled packages that ship with their own backdoors.
What a hacked result looks like
These are labelled illustrations, not screenshots from a real client site. They show the two warnings people most often describe to us.
Illustration A — Google search result
https://yoursite.com/
Cheap pharma online – buy pills now | yoursite.com
Best deals on prescription drugs shipped worldwide. Limited stock. Click to claim your discount today…
This site may be hacked
Illustration B — browser redirect warning
Attackers on prize-winner-example.xyz may trick you into doing something dangerous like installing software or revealing personal information. (Example warning layout.)
Illustration, not a real client site.
Quick checks you can do safely
Do these before you start deleting files. The goal is confirmation, not DIY surgery on a live infected site.
- Open the site in a private window on a phone using mobile data (not your office Wi‑Fi).
- Click through to your site from a Google search result, not by typing the URL.
- In Google Search Console, check Security Issues and Manual Actions.
- Check Google Safe Browsing status at transparencyreport.google.com/safe-browsing/search.
- Review Users → All Users for accounts you did not create.
- Do not log into wp-admin from a computer you suspect is infected; use a clean device.
- Take a full backup copy (files + database) before you change anything.
How a proper cleanup works
A redirect hack is not fixed by deleting the one script you can see. A proper job follows a sequence.
Backup and isolate
Copy files and the database first. Limit further damage while you work (maintenance mode, tighter access if needed).
Scan files and database
Check core, themes, plugins, uploads PHP, mu-plugins, .htaccess, wp_options, posts and widgets — not just the homepage HTML.
Remove malware and backdoors
Strip injected code and replace WordPress core and known plugins/themes with clean copies from trusted sources.
Reset access
Reset all passwords, rotate salts/keys, and remove rogue admin users and leftover drop-ins.
Harden and update
Close the entry point, update everything still in use, and remove unused plugins and themes.
Request review and monitor
File Search Console / Safe Browsing reviews, clear remaining warnings, and watch for reinfection.
Risks of fixing it yourself
I am not against owners who know their stack. I am against partial cleanups that look successful for a day and then return.
Visible script gone, backdoor left
You delete the redirect you found. The attacker still has a way back in, and the spam returns within days.
Breaking the site
Blind edits to functions.php, .htaccess or the database can take the whole site offline.
Google warning lasts longer
If malware remnants keep triggering Safe Browsing, review requests fail and the warning sticks.
Rankings and spam URLs
Spam titles and injected URLs stay indexed until cleanup and cleanup requests are done properly.
Restoring an infected backup
Rolling back to last week’s backup can reintroduce the same malware if that backup was already compromised.
Wasted time under pressure
Every day with an active redirect burns trust with customers and search engines while you trial-and-error.
Malware removal plans
Fixed-price WordPress malware cleanup
Emergency fixes from $149. Every malware plan is cleaned within 24 hours of working access.
Basic Cleanup
$149
30-day reinfection warranty
- Hand cleanup of 1 WordPress site
- Malware & backdoors removed
- Clean report with re-scan proof
- 30-day reinfection warranty
- Cleaned within 24 hours
Full Recovery
$249
60-day reinfection warranty
- Everything in Basic Cleanup
- Google & blacklist warning removal
- Security hardening, entry point closed
- 60-day reinfection warranty
- Cleaned within 24 hours
Emergency
$349
60-day reinfection warranty
- Everything in Full Recovery
- Work starts within 4 hours of access
- Priority chat updates
- 60-day reinfection warranty
- Cleaned within 24 hours
Prefer to chat? Contact us
Related reading
This post is the symptom guide. For the hands-on technical walkthrough, start with how to detect and clean a WordPress malware redirect. Then use these when you need the next step:
- How to detect and clean a WordPress malware redirect (technical cleanup guide)
- Japanese keyword hack: what it is and how to fix it
- How much does WordPress malware removal cost?
- How to recover SEO rankings after a hacked website
Frequently asked questions
Why does my WordPress site redirect to spam only on mobile?
The malware often checks the browser user agent and only redirects phones and tablets. Owners testing on a desktop never see it, which is why the infection can run for weeks before anyone reports it.
Why can’t I see the redirect when I’m logged in?
Many payloads skip logged-in WordPress users on purpose. They look for an absent login cookie, then redirect everyone else. Always test in a private window while logged out.
Will changing my password fix it?
Changing passwords is necessary after a hack, but it does not remove injected code, backdoors or rogue admin users. Reset credentials after the cleanup, not instead of it.
Can a redirect hack hurt my Google rankings?
Yes. Safe Browsing warnings, “This site may be hacked” labels, spam titles in search results and lost trust all suppress clicks and rankings until the site is cleaned and reviewed.
How long does cleanup take?
Every BrandBees malware plan is cleaned within 24 hours of us receiving working access. Emergency is the rush option: work starts within 4 hours of access.
Is my hosting company responsible?
Hosts look after the server. Malware inside WordPress files, the database, themes and plugins is usually the site owner’s responsibility unless your host’s plan explicitly includes cleanup. A care plan or a specialist cleanup team covers the site layer.
If your WordPress site is redirecting to spam and you want it handled end to end, start with a free malware check or pick a plan on the malware removal page. I would rather you get a clean site back than spend another week wondering why only some visitors see the problem.
Free PDF
WordPress Security Checklist
The same checks we run on client sites, written in plain English. Work through it in an afternoon.
- Logins, updates, backups and hosting, step by step
- A 10-minute self-test you can run today
- What to do if you think you’ve been hacked
