A customer emails to say your website sent them to an online pharmacy. You check immediately. Everything looks normal. You check again on your phone. Still fine. It would be easy to assume they made a mistake.
They did not. This is the WordPress redirect hack, and being invisible to the site owner is the entire point of it.
Why you cannot see it
The malicious code checks who is visiting before it decides what to do. It is designed to stay hidden from the one person who would remove it.
Most versions skip the redirect when any of these are true:
- You are logged in as an administrator
- You typed the address directly instead of arriving from search
- You have visited before, so a cookie marks you as seen
- You are on desktop rather than mobile
- Your IP address is on the attacker's ignore list
So the redirect fires for a first-time mobile visitor arriving from Google, and never for you. That is why owners often dismiss the first few reports.
To test it properly, open a private browsing window on mobile data, search for your business, and click the result. Do not type the address in.
Where the code actually hides
A WordPress redirect hack is usually small. A few lines, dropped somewhere it will run on every page load. These are the places we find it most often.
The .htaccess file
The classic location. Look for RewriteRule lines pointing at a domain you do not own, often with a condition on the referrer or user agent. Check for a second .htaccess inside subfolders too, including uploads.
The database
Two spots matter. In wp_options, the siteurl and home values can be rewritten to point elsewhere. Also check autoloaded options for injected <script> tags — these load on every single page.
In wp_posts, look for script tags inside post content, often at the very end where nobody scrolls.
Theme files
header.php, footer.php and functions.php are common targets. The code is usually obfuscated — long strings of base64_decode, eval, or hex characters that mean nothing on inspection.
Plugins, including inactive ones
An abandoned plugin you deactivated two years ago is still sitting on the server. Its files can still be called directly. Attackers know this.
The uploads folder
wp-content/uploads should contain images and documents. If there is a .php file in there, it is not yours.
How they got in
Almost every case traces back to one of four things. An outdated plugin with a known vulnerability. A nulled theme downloaded from a file-sharing site. A weak administrator password. Or shared hosting where a neighbouring site was compromised first.
Vulnerable plugins are by far the most common. The gap between a security patch being released and the site being updated is the window attackers work in — and it is often measured in months.
Removing it properly
Fixing a WordPress redirect hack takes more than deleting the line you found. Work through the whole sequence.
- Back up first. Files and database, stored off the server, for reference rather than restoration.
- Replace core files. Download WordPress at your version and overwrite
wp-adminandwp-includescompletely. - Reinstall themes and plugins from official sources. Delete anything nulled, abandoned or unused.
- Regenerate .htaccess. Replace it with the default WordPress rules, then re-add only the rules you recognise.
- Clean the database. Fix
siteurlandhome, remove injected scripts from options and posts. - Hunt the backdoor. This decides whether the fix holds.
- Change every password and regenerate the security keys in
wp-config.php. - Update everything, then delete what you do not use.
If the redirect returns within a week, the backdoor was never found. That is almost always the reason.
Clean up the search damage too
Removing the code is only half the job. While the hack was live, Google may have indexed spam pages under your domain and possibly flagged the site.
Open Google Search Console and check the Security Issues report. If there is a warning, request a review once the site is genuinely clean. Then look at your indexed pages and request removal for anything you did not publish.
Rankings usually recover, but the longer the hack ran, the longer that takes. This is a good reason not to wait.
Stopping it happening again
A redirect hack is a symptom. The underlying issue is that nobody was watching the site. Nothing flagged the file change, nothing applied the security update, and the first sign of trouble was a customer complaint.
What actually prevents a repeat: prompt updates, strong passwords with two-factor authentication, a firewall filtering traffic, file-integrity monitoring that alerts on unexpected changes, and removing plugins you no longer need.
That is exactly what our security monitoring service provides — continuous scanning and someone who notices when something changes, rather than finding out from a customer weeks later.
If your site is redirecting right now
Every hour this runs, visitors are being handed to someone else and your search reputation is eroding. Our WordPress security and error fixing service removes the redirect from the files and the database, finds the backdoor behind it, hardens the site, and handles the Google review if you have been flagged.
Send us your web address and we will tell you what we can see, usually the same day.
Get Shielded
We build, host, secure and monitor business websites — cleaning up hacks and keeping sites online for clients across the UK, USA, Australia and the UAE.
