WordPress redirecting to spam sites

The symptom is distinctive: you type your own address and the browser lands somewhere else. Sometimes it happens only on arrivals from Google, sometimes only on a phone, and from your own computer everything looks normal — because the malicious code recognises the administrator and spares them.

This is not a fault. Redirects to unknown addresses mean somebody has access to your site. The target is usually the traffic and the rankings you built, which is why the attacker works hard to keep the infection unnoticed.

Before you start: contain it

1. Take a full copy of files and database. Even an infected one — you will want it for analysis and as a fallback.
2. Change the passwords: WordPress admin, FTP/SSH, database and hosting panel. Skip this and you will clean up only for the code to return the same way.
3. Check the user list in the panel. Delete any administrator accounts you did not create.

Where the malicious code hides

In practice, almost always in several of these places:

• Theme files, most often header.php, footer.php and functions.php — an appended block of JavaScript or a long base64-encoded string.
• The wp_options table, in the siteurl and home fields. A foreign address there is the first thing to correct.
• The wp_posts table — scripts injected into post content.
• The .htaccess file — rules that redirect traffic arriving from search engines.
• Dropped files with innocent names in wp-content/uploads. A directory for images should not contain a single .php file.

With SSH access, it is worth starting from the usual patterns:

grep -rn "base64_decode\|eval(" wp-content/ --include="*.php" | head -50
find wp-content/uploads -name "*.php"

Cleaning up

The most reliable approach is replacing everything replaceable rather than cutting out fragments:

1. Download a clean WordPress package and overwrite wp-admin and wp-includes entirely.
2. Reinstall plugins and the theme from official sources. You do not heal an infected plugin — you replace it.
3. In the database, correct siteurl and home, then review content for injected scripts.
4. Regenerate .htaccess by saving the permalink settings.
5. Remove every PHP file from the uploads directory.

The step that matters most: close the way in

This is the stage most often skipped — which is why the infection comes back within days. The attacker arrived through one of these:

• an outdated plugin or theme with a known vulnerability (by far the most common),
• a weak administrator or FTP password,
• another, neglected site on the same hosting account,
• an abandoned plugin that no longer receives fixes.

Look through the access logs from around the time the redirects started. Watch for POST requests to unusual addresses and hits on files that should not exist. That usually reveals the route.

After the clean-up

Submit the site for review in Google Search Console, under Security issues. Without that, the warning in search results can linger for weeks even though the site is already clean. Keep watching over the following days in case anything returns.

Enable automatic updates at least for security releases, and delete plugins you do not use. A deactivated plugin still sits on the server and can still be a way in.