Fix WordPress Redirect Hack: Stop Site Redirecting to Spam

If your WordPress website or admin dashboard is getting redirected to a spam website, your website has been hacked with redirect malware.

So what can you do about the WordPress hacked redirect malware on your site?

First of all, scan your website to confirm if you actually have a hack.

The important thing to remember is that time is your best friend here. Do not waste time agonizing over it. The hack is totally fixable, and your site can be cleaned. But you need to move fast.

We have come across this hack thousands of times. We will tell you the exact steps to help you remove malicious redirects from your site, fix your website, and make sure it doesn’t happen again.

Recovering from a WordPress redirect hack

Understanding the WordPress redirect hack

WordPress hacked redirect happens when malicious code is injected into your website, which then automatically takes your visitors to another website. Usually, the destination website is spammy, with grey market pharmaceutical products, illegal services, or sites designed for phishing attacks aimed at stealing personal information from your visitors.

There are many types of malware that cause this behaviour, so WordPress malware redirect hack is an umbrella term referring to the predominant symptom: malicious redirects.

There are 4 steps to recovering from the redirect hack:

However, the worst part about a hack is that it gets steadily worse. The malware spreads through the files and folders, and even the database of your website, replicating itself, and using your website to infect others.

Your priority is to save your website. You can do that by scanning your site now.

Step 1: Deep scan your site for spam redirects

Use MalCare’s free online scanner to be 100% sure your site has spam redirects.

We recommend MalCare, because we have seen many variants of the WordPress website hacked redirect malware.

A very common one appears only when your website is accessed on a mobile device, which can point to malware in the .htaccess file. Another variant redirects pages automatically because the malware is in the database. The reality is that WordPress hacked redirect malware can be almost anywhere on your website.

On top of that, many scanners will flag it differently—or even outright miss the malware. For instance, Quttera will flag the malware like this: Threat name: Heur.AlienFile.gen

And Wordfence will show an alert for a whole bunch of unknown files, like this:

Unknown file in WordPress core: wp-admin/css/colors/blue/php.ini
Unknown file in WordPress core: wp-admin/css/colors/coffee/php.ini
Unknown file in WordPress core: wp-admin/css/colors/ectoplasm/php.ini

These are good signs that your website has been hacked because, as we will see later, the /wp-admin folder should contain only WordPress core files.

Unfortunately, though, this is not helpful for a scan. Unknown files could be anything, after all. Custom code, anyone?

Overall, there are major issues with the way other WordPress malware scanners work because of their discovery mechanisms: false positives, missed files, and a host of other problems.

Your website is important, so choose wisely.

Other ways to scan your site for malware

Use an online security scanner

There are a few online security scanners, but they are not—cannot be—as thorough as a security plugin.

Take Sucuri SiteCheck, for example. It is simple enough to run a check for the WordPress hacked redirect malware using it. However, an online security scanner, or a frontend scanner, can only scan the code in your pages and posts, looking for malware scripts.

While a lot of hacked redirect malware exists in these pages, there are some variants that exist in core files. A frontend scanner will not show these up at all.

Use an online security scanner as a first-line diagnostic tool. If it returns a positive result, work toward resolving the hack. If it returns a negative result, check the places a frontend scanner cannot reach. This can eliminate some of the manual work involved.

Scan for malware manually

If you are using a malware scanner plugin to scan for the hacked redirect malware, you can skip this section entirely. A good security plugin like MalCare will do exactly what we are suggesting below, but much faster and better.

Scanning your website for malware essentially means looking for junk code in the files and database. We get that ‘junk code’ is not helpful as a direction, but because of the variants, there is no one string that you can quickly locate and declare there is a hack.

However, in the next section, we have listed out some examples of malware we have seen in our customers’ websites. And in the section after that, we will talk about the typical places where malware is inserted, depending on the redirection behaviour seen.

What WordPress redirect malware may look like

There are many variants of the WordPress hacked redirect malware.

So, there is no one standard marker that we can say: “Look for this!” Also, malware changes a lot over time, so as we write this article, it could have changed dramatically.

Keeping in mind these are indicative at best, here are some of the ones we have seen look like:

• Code could be nestled in a page header somewhere, or in all the pages of the wp_posts table. Here are some examples:

• The wp_options tables could have unfamiliar URLs in the site_url. These are some examples we have seen most recently.

• The scripts can be obfuscated too, which means you have to run it through an online deobfuscator to extract the actual code.

Obfuscated code

And what it actually means

• Fake plugins can have files that look like this when opened up

• Mobile-specific redirects can indicate changes in the .htaccess file. The screenshots below show an injected redirect URL and malicious rewrite rules.

Places to look for redirect malware

WordPress is split into two main parts, its files and database. The trouble with the hacked redirect malware is that it can be anywhere.

If you are familiar with tinkering around in your website code, you can look in the following places for the redirection code we mentioned. Download a backup of your website—both files and database—to look for suspicious additions.

Again, please keep in mind that variants exist, like classic, situational, device-specific, or even chained redirect. The code will be different for each, and so will the location.

Website files

1. Core WordPress files: Starting with the easiest, /wp-admin and /wp-includes should not vary from a fresh WordPress installation. The same applies to index.php, wp-settings.php, and wp-load.php. These are core WordPress files, and customisations do not normally change them. Compare them with a fresh installation to confirm any variations. The .htaccess file is a special case. A mobile redirect hack will often show up in this file. Look for a user-agent rule that changes behaviour based on the device, and check for a redirect script there.
2. Active theme files: If you have more than one theme installed, make sure only one is active. Then look at active theme files such as header.php, footer.php, and functions.php for odd code. A good way to check this is to download pristine installations from developer sites and compare them with those files. Typically, these files follow a predictable format, so junk code stands out. Keep in mind, though, that customisations will also change the code. If you are using nulled themes or plugins, stop the diagnostics here: they are a common source of malware.
3. Fake plugins on your website: Yes, this is a thing. Hackers disguise malware by making it look as legitimate as possible. Go into the wp-content/plugins folder and have a look. Anything that you haven’t installed? Any weird duplicates? Do any of them have just one or two files in their folders? Examples we have seen recently: /wp-content/plugins/mplugin/mplugin.php /wp-content/plugins/wp-zzz/wp-zzz.php /wp-content/plugins/Plugin/plug.php If you have loads of plugins installed, it can be daunting to check through them all. A rule of thumb to identify fake plugins is that, by convention, legitimate plugin names rarely start with a capital letter, and their names don’t have special characters except for hyphens. These are not rules, but conventions. So don’t place too much store on these to definitively identify fakes. If you suspect a plugin is fake, Google it and look for the original version from the WordPress repository. Download it from there, and check if the files match up.

Database

1. wp_posts table: Malicious scripts are often on every single page. Check a good sample of posts before determining that the hack doesn’t exist. Another way to inspect your pages and posts is to check their page source in your browser. Open the page source and inspect the header, footer, and anything between <script> tags for code that looks out of place. The head contains information the browser uses to load the page but does not show to visitors. Malware scripts are often hidden here so they load before the rest of the page.
2. wp_options table: Check the siteurl value. It should normally be your website URL. An unexpected value needs immediate investigation.

This is not the time to remove anything, though. You must be sure that the JavaScript or PHP scripts are malicious. You want to get rid of the malware quickly, but haste can lead to a broken site.

Check for other WordPress hacked redirect symptoms

Hacked WordPress sites have symptoms. And then, once you have identified the symptoms, you can confirm the diagnosis with a few tests.

Automatic redirects are a reliable symptom of a WordPress redirect hack. Spam redirects can occur from search results, on certain pages, or even when you are trying to log in to your website. The problem with these redirects is that they don’t always happen consistently or reliably.

For instance, if you went onto your site and it was redirected, it is possible that it might not happen a second, third or fourth time. Hackers are smart, and they set up a cookie to make sure the issue only happens once.

The upshot of this is that it is easy to get lulled into a false sense of security, where you feel it may be a fluke. There is a tiny chance that it could be an error in code as well, but when we say ‘tiny’, we mean infinitesimal.

Typically, hacks manifest in a variety of ways. Individually, they could be website errors, like old tracking code, but if you see two or more of these symptoms on your website, you can be sure that your website has been hacked.

• WordPress site redirecting to spam site: The classic symptom of a WordPress redirection hack. Depending on the variant of the malware, the redirect can occur in different ways or places on your website.
• Automatic redirects: Malware redirects take your visitors automatically to spammy websites when someone visits your website. This also happens if someone clicks through to your website from Google. You will typically also get redirected if you try to log into your website.
• Link redirects: Someone clicks on a link, and then they are redirected to another website. This is especially clever because visitors click on links expecting to be taken elsewhere anyway.
• Mobile-only redirects: Only if your website is accessed via a mobile device, does it get redirected.
• Google results show a ‘Site may be hacked’ message: When listing your website in search results, a small message: ‘Site may be hacked’; will appear just underneath the title. This is Google’s way of cautioning visitors about a potentially hacked site.
• Google blacklist: The biggest of all red flags—quite literally—Google’s blacklist is a sure-fire sign that your website has been hacked. Even if your visitors use another search engine, they too use Google’s blacklist to flag hacked sites.
• Google Ads flags scripts on your website: If you try running ads on your website, Google Ads will run a scan on your website, and alert you for redirection scripts on your posts or pages.
• Web host has suspended your account: Web hosts suspend websites for several reasons, and malware is one of the big ones. If you are seeing this message when you try to access your website, check your email for a reason. Alternatively, reach out to their support team.
• People are complaining: The terrible part of hacks is that website administrators are usually the last to find out, unless they have a good security plugin installed. Many people learn about a hack only after visitors complain about redirects to spam or even receiving spam emails.

If you see any of the symptoms above, it is a good practice to record information about it. What browser were you using? What device were you using? This information can help narrow down the type of WordPress hack redirect malware you are experiencing, and therefore resolve it faster.

Other ways to check for redirect malware

You may not see all of the symptoms listed above as a website admin. Hackers cleverly exclude your IP and account from seeing the results of a hack, because they want to remain undetected for as long as possible.

Alternatively, you may see the symptom once, and then not be able to recreate it. It is all very confusing, and many of our customers have left hacks unattended because of this reason.

There are a few other ways to check for symptoms, if you can’t see them directly on your website.

The next section deals exclusively with removal. Take a deep breath, and grab a coffee. We’ll take you through the entire process carefully.

Step 2: Fix the WordPress redirect hack

Use a security plugin to remove the redirect malware.

We strongly recommend MalCare. It is by far the best WordPress security plugin, and uses an intelligent system to surgically remove only malware, while keeping your website entirely intact.

To use MalCare for redirect hack cleanup, all you need to do is:

1. Install MalCare on your site
2. Run the scan, and wait for the results
3. If the scan results show a hack, upgrade to auto-clean the malware

Remember, hacks get exponentially worse as time goes on, because the malware spreads into more files and folders of your website. This not only causes increased damage, but makes recovery significantly harder.

If you cannot access wp-admin to install the plugin, get help from our emergency malware removal service. A dedicated security expert will clean your website quickly, and make sure it is up and running again in the shortest possible time.

Why we recommend MalCare

Thousands of people have used MalCare’s auto-clean feature to remove WordPress hacked redirect malware in minutes.

The reason why MalCare works so much better than other security plugins is because it finds even the most well-hidden malware on your website.

Plus, MalCare:

Alternative: Remove WordPress redirect malware manually

It is possible to remove the redirect malware manually from your website, but there are prerequisites to doing so.

Step 1: Take a backup of your website

Before doing anything at all, definitely take a backup. Even if the website is hacked, it is still functional.

Therefore, if anything at all goes wrong in the malware removal process, you have a backup to fall back on. A hacked website is difficult to clean. A crashed website is even harder to clean; and is sometimes impossible to recover.

Secondly, a web host can suspend your website or even go as far as to delete it. Then, gaining access to your website even to clean it is a major hassle.

You would need to contact web host support in order to get access to a suspended site, but with a deleted site there is no recourse without a backup.

Step 2: Get clean installs of everything

Download fresh installs of WordPress, and all the plugins and themes you use. The versions should match what is on your website.

Once you have them downloaded, you can use the clean files as a comparison against your website files. You can use an online diffchecker to find differences, because we certainly don’t recommend trawling through these manually.

This is essentially signature matching, which is what most security scanners do anyway. However, at least you now know what files and folders are required for your website to function properly.

At this point, don’t delete anything. You are just setting up a baseline to understand which files are necessary.

Step 3: Look for and remove redirect malware

This is arguably the hardest step of the process. As we said before, you need to be able to identify good code from bad, and then delete or replace it as required.

Clean WordPress core files

It is critical to get the same version of WordPress as the one on your website, otherwise you could end up with a crashed website.

Once downloaded, use cPanel or FTP to access your website files, and replace the following folders:

• /wp-admin
• /wp-includes

These folders are used by WordPress to run and load your website, and are not meant to contain user content at all. That was the easy part. Now, check the following files for strange code:

• index.php
• wp-config.php
• wp-settings.php
• wp-load.php
• .htaccess

Also, the /wp-content/uploads folder shouldn’t have any PHP scripts.

We realise that “strange code” is very vague, but as we have said before: the WordPress hacked redirect malware has many, many variants.

So we can’t actually pinpoint what code you will see in any of these files. If you understand how code works, you can refer to a list of WordPress files to understand what each does, and figure out if any of the code does something different. Once you are sure you have found that code, delete it.

If you feel overwhelmed at this point, please stop and use MalCare. Save yourself all this hassle and stress.

Clean themes and plugins of malware

All theme and plugin related files and folders are stored in the /wp-content folder. You can check each of your website files to see where there is a difference in the code.

A word of caution here: Not all changes are bad. If you have customised any of your plugins or themes—which you probably have—then there are going to be differences from the clean installs. If you don’t mind losing these customisations, then you can go ahead and replace the files en masse.

More likely than not, you want to retain the work that you have done, so start examining each of the differences carefully. If you are able to follow code logic, you can figure out how the files interact with each other, and with the rest of your website. This should enable you to find malware and delete it.

If you have a significant number of themes and plugins, this can be a daunting task. Here are some good places to start:

• Active theme files
  • header.php
  • footer.php
  • functions.php
• Vulnerable plugins
  • Have any been hacked recently
  • Are any not updated
• Fake plugins
  • Very few files
  • Obvious duplicates

Some malware files are designed to look benign, and will often mimic real file names. This is where the clean installs will come in handy, but also reach out to plugin and theme developers for support if you aren’t entirely sure.

Clean malware from database

Use phpMyAdmin to get a download of your database for cleaning. Then, check the tables for any suspicious content, like spam URLs or keywords. Remove that content carefully, making sure that it is bad code, and not modified good code.

Check the following tables especially:

• wp_options
• wp_posts

Depending on the size of your website, this can take a considerable amount of time. Typically, if the malware is in your wp_posts table, it will be in every single post. If you have hundreds of posts, with a lot of content, then this is a monumental undertaking to clean manually.

However, once you have identified the malware script, you can use SQL (or get someone with SQL expertise) to remove the script from every post. The caveat here is that you can’t be sure that that is the only malware in the table.

Additionally, with e-commerce sites especially, double-check that you aren’t deleting important user or order information.

Step 4: Remove backdoors

Now that you have purged your website of malware and restored any defaced WordPress elements, check for backdoors. These are entry points a hacker leaves so they can reinfect your website if their initial hack is detected.

Backdoors can be in multiple places. Some of the code to look for is:

• eval
• base64_decode
• gzinflate
• preg_replace
• str_rot13

A word of caution: These are not necessarily all bad. They are legitimate PHP scripts that can be altered subtly to serve as backdoors. Be wary of deleting any without proper analysis.

Step 5: Reupload your cleaned files

Now that you have cleaned the hack, you need to put your website together again. Use File Manager to reupload the files and phpMyAdmin on cPanel to replace your website.

This is very similar to how you would restore a backup manually, and means that you have to delete the existing files and database first.

If, by any chance you skipped the backup step at the beginning, please do it now. Backing up your website, even the hacked one, will save you a ton of grief if anything goes wrong.

Step 6: Clear the cache

Now that your cleaned website has been uploaded, clear your cache. The cache stores previous versions of your pages and content, and will show that to your site visitors. In order for your newly cleaned site to behave as expected, you need to clean the cache. Follow the steps in this article to do so.

Step 7: Verify each of the plugins and themes

The sad fact of malware is that it can hide just about anywhere. Because you have spent all this time and energy cleaning out your website manually, it is worth spending a few extra minutes making sure that your effort has been successful.

We recommend you use FTP for this, since it will take you a ton of work to change website files.

1. Disable all your plugins and themes by renaming the wp-content folder temporarily
2. Then, activate them one by one, checking your website for redirect behaviour each time
3. If there are no issues, you know that the plugins and themes are malware-free

Step 8: Use a security scanner to confirm

Great job, you’re on the other side of this pernicious hack. This was not easy to accomplish, especially because it is hard to find malware in website files. So take a minute to enjoy that you made it through that.

Then, use MalCare to confirm that your website is free of malware. It takes 2 minutes, and you can rest assured that your work was successful.

Why we strongly advise against manual redirect hack removal

You may be wondering why we advise against removing hacks this way. Think about hacks like you would do an illness, like cancer or a broken bone.

You would rather leave the care of these illnesses to doctors, who are trained professionals with great expertise in handling them. Untrained people cause more harm than good. Ask any doctor who has had to deal with a poorly set broken bone.

There are several things that can go wrong with manual hack removal:

Quite simply, with a hacked website, there is a huge margin of error. There is a very real danger of coming out of this process worse off than you started. The best option is to use a good security plugin, like MalCare, to remove the hack scripts.

Step 3: Prevent future WordPress redirect hacks

Hacks recur all the time. Primarily, this is because the reason your website got hacked in the first place wasn’t addressed.

Now that you have a clean website, the next steps are all about preventing your WordPress website from redirecting to spam.

To prevent recurrence, here are the steps to take:

1. Install a security plugin: Choose a good security plugin like MalCare, which can scan, clean and prevent hacks. MalCare has an integrated firewall that proactively blocks bad traffic from reaching your website altogether.
2. Implement strong password security: Compromised user accounts and easy-to-guess passwords are the number two reason why sites are hacked.
3. Reset and review user accounts: Check user accounts with unnecessary admin access, and remove them.
4. Change salts and security keys: Salts and security keys are long strings that WordPress attaches to login data in cookies, to help users stay logged in safely.
5. Make sure to use trusted plugins and themes only: We’ve said this before, but it bears repeating. Use plugins and themes from trusted developers only. These developers will provide support and updates, which are incredibly important for security. Do not use nulled themes and plugins under any circumstances. Whatever you save, you will lose many times over with the inevitable hack that will occur.
6. Make sure you have SSL in place: HTTPS should already be enabled on your website, but we’re including it for completeness. It encrypts communication between your site and its visitors and is the standard expected by browsers and search engines.
7. Harden WordPress: There are measures to toughen up security, commonly known as WordPress hardening. Be cautious with advice found online: some recommendations can harm your website or your visitors’ experience.
8. You should also keep WordPress, plugins, and themes updated.
9. Take regular backups: The insurance policy for your site. It is better to have a hacked site than no site at all.

Effects of malicious redirects

Any hack has a terrible impact on a website, and the WordPress redirection malware is no different. Here are just some of the ways that malware can impact your website and business adversely:

There are many more ways that a hack can cause material damage. The critical factor is to act quickly and get rid of the malware as soon as possible.

Why your website is redirecting to spam

Websites are essentially software, and inherently no software is 100% hack-proof. That is the reality with any software: right from the 8-bit games of yesteryear to huge management information systems used by banks.

WordPress websites are no different. WordPress core is maintained carefully, but plugins and themes add more code and can introduce vulnerabilities. They also provide much of a site’s functionality and design, so the practical goal is to choose trusted software and keep it updated.

Here are common reasons WordPress websites get hacked:

As stated before, website security cannot be taken lightly. You now have firsthand experience of how difficult a hack is to clean, so you ideally want to have a strategy in place to ensure that it doesn’t happen again.

Conclusion

The WordPress hacked redirect malware crops up every so often in a new avatar. Hackers, and therefore their malware, are getting smarter and smarter. WordPress websites are a treasure trove for them, and the only way to beat them is to stay ahead of their game.

The best way to protect your WordPress website is to install a good security plugin, like MalCare, which comes with an integrated firewall as well. We clean thousands of sites with the redirect hack, and our plugin is able to detect the cleverest of malware instantly. It is without a doubt the best investment you can make in your website security.

Have questions? Write to us here. We’re always happy to help!

FAQs