Someone just told you your website sent them to a sketchy pharmacy page, a fake giveaway, or a “your computer is infected” scam. You open the site yourself and maybe it looks fine, or maybe it throws you to the same junk. Either way, your stomach drops.
Take a breath. Your WordPress site redirecting to spam means one thing: it has been hacked with a redirect infection, one of the most common WordPress attacks there is. I have cleaned this exact hack many times over 8+ years, and it is fixable, usually within a day. But the order you do things in matters a lot, so treat this page like first aid. Do these steps in this order.
First, understand what happened (60 seconds)
Attackers injected code into your site, usually through an outdated plugin, a weak password, or a nulled theme. That code sends your visitors to scam pages. Some versions only redirect mobile visitors, some only redirect people coming from Google, and some hide from you completely because you are logged in as admin. That is why “it looks fine to me” means nothing right now. The hack decides who sees it.
Every hour it stays live costs you: visitors lose trust instantly, Google starts flagging the site, and your email can land in spam. So move.
Step 1: Stop the bleeding
Do these immediately, in any order, they take ten minutes total:
- Change every password. WordPress admin, hosting/cPanel, FTP, and database. Use long, unique passwords. The hacker may be logged in right now.
- Check for rogue admin users. Go to Users in your dashboard and look for accounts you did not create. Delete any stranger with admin rights.
- Take a backup, even now. A backup of the infected site sounds odd, but if a cleanup step goes wrong, you want a copy of your content to fall back on.
Step 2: Find the infection
Run a scan with a reputable security plugin (Wordfence, Sucuri, or MalCare all work). The scan will usually point to infected files. The most common hiding spots I find during cleanups:
- Injected code at the top of theme files, especially header.php and functions.php
- Fake plugins with random names in your plugins folder
- Modified core files, or extra files sitting in wp-content/uploads that end in .php
- Malicious code inside the database, often in the site URL settings or inside posts
- A tampered .htaccess file quietly redirecting specific visitors
If the scanner finds nothing but the redirect continues, do not relax. Some infections hide from plugin scanners. That is the point where I would bring in a professional, because a half-cleaned hack comes back within days.
Step 3: Remove it properly
Cleaning means removing every injected line and every backdoor, not just the obvious one. The reliable order:
- Replace WordPress core files with fresh copies from wordpress.org
- Reinstall every plugin and theme from the official source, and delete anything you do not use, especially anything nulled
- Clean the database entries the scanner flagged
- Reset the .htaccess file and check wp-config.php line by line
- Search the whole site again for base64 and eval-style encoded code
Here is the part most DIY cleanups miss: hackers almost always leave a backdoor, a tiny innocent-looking file that lets them walk back in after you clean up. If you remove the redirect but miss the backdoor, you will be redoing all of this next week. This is exactly the deep-clean work I do in my malware removal and bug fix service, and the backdoor hunt is the reason it stays fixed.
Step 4: Repair your reputation with Google
Maybe Google already emailed you a warning, or your domain got blacklisted and visitors now see a red “Deceptive site ahead” screen. That flag does not lift on its own. Once the site is clean, tell Google. Open Google Search Console and check the Security Issues section, then request a review from there. For a genuinely clean site, the blacklist warning usually clears within a few days.
While you are there, use URL inspection on your key pages to make sure Google sees the clean versions. If spammy pages were created by the hack (sometimes thousands of them), make sure they now return proper 404s.
Step 5: Make sure it never happens again
The cleanup is half the job. The other half is closing the door the attacker used:
- Update WordPress core, themes and plugins, and keep them updated weekly
- Delete unused plugins and themes entirely, deactivated is not enough
- Add a firewall (Cloudflare or a security plugin’s WAF)
- Turn on two-factor authentication for every admin account
- Set up automated off-server backups, daily if the site changes often
- Put monitoring in place so the next problem is caught in hours, not weeks
If nobody on your team has time to own this checklist, that is what a maintenance retainer is for. Most of my long-term clients came to me exactly one hack too late.
And if you are not sure where your site stands right now, whether anything is quietly wrong under the surface, run my free site audit. It takes a minute, and it is exactly how several of my clients caught problems before they turned into a page like this one.
Common questions
Why is my WordPress site redirecting but looks fine to me?
Many redirect hacks deliberately hide from logged-in admins and direct visitors, and only trigger for mobile users or people arriving from Google. Test in an incognito window, from a phone, via a Google search click.
Can I just restore a backup to remove the redirect hack?
Only if the backup is from before the infection, and you still need to close the security hole afterwards. Restoring a clean copy into the same vulnerable setup gets rehacked fast.
How long does WordPress malware removal take?
Most redirect infections can be cleaned within a day once access is available. The Google warning, if there is one, usually clears within a few days after the site is verified clean.
Will the hack hurt my Google rankings permanently?
Usually not, if you act fast. Rankings often dip while the site is flagged and recover after cleanup and review. The real damage comes from leaving it live for weeks.
The honest bottom line
A redirect hack feels like a catastrophe, but it is a solvable, well-understood problem: stop the access, find every injected file, remove the backdoor, clear your name with Google, and lock the door properly this time. Do the steps in order and do not stop halfway, because a 90% cleanup is a 100% reinfection.
Need urgent help right now? Tell me what is happening or hire me directly and I will tell you honestly what it will take. Most sites like this are clean and safe again within a day. And if you just want a health check before anything goes wrong, start with the free site audit.
