Your WordPress site redirects to another site. How to fix it.

A redirect hack is the most common WordPress compromise and the most commercially damaging, because it takes your visitors and hands them to somebody else. It is also one of the more reliably fixable, once you know where the code hides.

Why it looks fine to you

Nearly every redirect hack is conditional. The injected code checks the visitor before deciding, and typically skips:

• Logged-in users, so the owner sees a working site
• Direct visits, redirecting only people arriving from Google
• Desktop browsers, targeting mobile where the fake page is more convincing
• Repeat visitors, using a cookie so the same person is only caught once

This is deliberate. The longer you do not notice, the longer the traffic keeps flowing.

To reproduce it: private window, on a phone, on mobile data, arriving via a Google search result rather than by typing the address.

Where the code actually hides

Six places, in the order they are usually found.

1. .htaccess

The classic. Look for RewriteRule or RewriteCond lines you did not add, often near the bottom and sometimes below a large block of blank lines meant to push them out of sight in an editor.

Check every .htaccess on the account, not just the one in the WordPress root.

2. The database, in wp_options

Check siteurl and home first — if either points somewhere unfamiliar, that alone causes a site-wide redirect. Then look for injected <script> tags inside widget content and theme options.

3. Theme files

header.php, footer.php and functions.php, most often functions.php. The injected code is usually a single very long line of base64 or hex, sitting after a lot of whitespace.

4. Core files

index.php, wp-load.php, wp-blog-header.php and wp-settings.php. Comparing against a clean WordPress download makes these obvious.

5. Plugin files, including plugins you did not install

Attackers sometimes add an entire fake plugin, deactivated so it does not appear in the admin list but still present on disk and still reachable.

6. The uploads folder

wp-content/uploads should contain no PHP files whatsoever. Any that exist are malicious, without exception.

Finding it faster

If you have SSH access, this finds most of it in seconds:

grep -rEl "(eval\(|base64_decode\(|gzinflate\(|str_rot13\()" wp-content/ --include=*.php

Those four functions are how obfuscated payloads are almost always executed. Legitimate plugins occasionally use them, so read what you find rather than deleting blindly.

Also useful: list PHP files in uploads, which should return nothing at all:

find wp-content/uploads -name "*.php"

Clean it in this order

1. Back up the infected site before touching anything
2. Replace WordPress core with a fresh download
3. Delete and reinstall every plugin and theme rather than cleaning them
4. Restore .htaccess to the WordPress default, then re-add any rules you genuinely need
5. Clean the database — check siteurl, home, widget content and post content
6. Delete every PHP file in uploads
7. Remove unknown admin users and scheduled tasks
8. Rotate all credentials, including the salts in wp-config.php
9. Clear every cache — plugin, host, and CDN

That last step catches people out. A cleaned site that still serves a cached redirect looks like the cleanup failed.

After it is clean

Check your domain against Google Safe Browsing and Sucuri, and if Google flagged you, request a review in Search Console. Rankings usually recover over a few weeks.

Then close the door: update everything, delete what you do not use, turn on two-factor authentication, and disable the file editor with define( 'DISALLOW_FILE_EDIT', true ); in wp-config.php.

If the site earns you money and it is still redirecting, our cleanup is $249, done within 24 hours, with a 30-day guarantee. The part most people cannot do alone is not the cleaning — it is being certain the entry point is closed.