Your WordPress Site Is Redirecting. Here’s Why.
So your site is sending visitors somewhere they didn’t ask to go — a pharmacy, a betting page, some garbage Russian domain — and you have no idea when it started or how. I get these messages from clients at least twice a month. Sometimes it’s 11 PM their time, sometimes they found out because Google flagged them, sometimes a customer emailed them before they noticed themselves. Either way, the panic is the same. Let me walk you through what’s actually going on and what needs to happen to fix it properly.
What This Infection Actually Is
A WordPress redirect malware fix situation almost always traces back to one of three places: your .htaccess file, a corrupted plugin or theme file, or a rogue PHP snippet dropped somewhere in wp-content/uploads or wp-includes. Sometimes all three at once.
The htaccess redirect hack is the most common variant I clean. An attacker adds a few lines at the top of your .htaccess — usually obfuscated, sometimes base64-encoded — that redirect mobile users or first-time visitors to a spam site while desktop users on repeat visits see the normal site. That’s why you often can’t reproduce it yourself. You visit, everything looks fine. Your customer visits from their phone, they land on a pharma page. Classic.
I’ve also cleaned sites where the redirect was buried inside a legitimate-looking plugin file — wp-content/plugins/contact-form-7/includes/functions.php — with maybe 200 lines of real code followed by 3 lines of encoded garbage at the bottom. Wordfence flags it, but sometimes clients have ignored those scan emails for weeks.
The other thing worth knowing: if your WordPress site redirects to another site and you’re also seeing strange new admin users in your dashboard, that’s a separate entry point that needs to be closed separately. Don’t just clean the redirect and call it done.
How to Actually Fix It — My Process
First step, always: get a clean backup of the current infected state before touching anything. Sounds counterintuitive, but you need that for forensics. Then change every password — WordPress admin, FTP, hosting cPanel, database. All of them. Right now, before anything else.
Then I go looking. Here’s the order I follow:
Check .htaccess immediately. Download it via FTP and open it in a text editor. It should start with # BEGIN WordPress and nothing should appear above that line. If there’s anything unfamiliar above it — especially anything with RewriteCond pointing to an external domain — that’s your culprit. Replace the file with a clean version:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPressThat’s the default WordPress .htaccess. Save it, upload it, test. If the redirect stops, you found the main source. But don’t stop there — there’s almost certainly a backdoor that put it there.
Next I run a Wordfence scan and also a manual search via SSH or a plugin like How to Remove Malware From WordPress Manually that walks through grep commands to find encoded strings. Look for eval(base64_decode in PHP files — that string has no business being in legitimate WordPress core or plugin code. None.
Malicious redirect removal isn’t just deleting the bad lines. You need to find how the attacker got in — outdated plugin, nulled theme, exposed xmlrpc.php, weak password — and close that door. Otherwise you’re cleaning the same site again in two weeks. I’ve done that for clients who came to me after another developer “fixed” it but didn’t patch the entry point.
My Honest Opinion on DIY vs. Hiring Someone
Here’s where I’ll be direct with you.
If you’re comfortable in FTP, you know what a PHP file is supposed to look like, and you’re not running an e-commerce site processing payments — yes, you can probably handle a straightforward htaccess redirect hack yourself using the steps above and a plugin like Wordfence or Sucuri Scanner. Budget a few hours, not twenty minutes.
But if you’re seeing a WordPress redirect malware situation where your site is redirecting to a spam site and you also have WooCommerce active, customer data in the database, or an active Google Ads account pointing at that domain — please don’t DIY this. The cost of getting it wrong is way higher than paying someone $150–$300 USD to clean it properly. I’ve seen sites lose their Google Ads account permanently because the owner tried to fix it themselves, submitted a reconsideration request too early, and Google found the redirect still active on mobile.
There’s also the question of what you might miss. Attackers often leave multiple backdoors. One in the theme. One in an uploads folder disguised as a JPEG. One as a hidden admin user with a randomized username. Cleaning one and missing the others means you’re back to square one within days.
If you want a structured checklist for what to do in the first hour after you discover the hack, I wrote about that in Your WordPress Site Got Hacked. Do This First. — start there before anything else.
After the Cleanup — What Needs to Stay in Place
Getting clean is step one. Staying clean is the actual job.
My rule after every cleanup: Wordfence Premium with real-time firewall rules enabled, auto-updates turned on for plugins and themes (or at minimum, weekly manual checks), and a hosting-level backup running daily. Not a plugin backup — a hosting-level snapshot your server provider controls, so malware can’t touch it.
Disable XML-RPC if you’re not using Jetpack or a mobile app. That endpoint has been abused for brute-force logins for years and most sites have no reason to leave it open. One line in .htaccess blocks it entirely.
I also change the default wp_ database table prefix on cleaned sites when I can — not a silver bullet, but it removes one easy target from automated attack scripts. And two-factor authentication on every admin account. No exceptions.
The reality is that a WordPress redirect malware fix isn’t a one-time event if you don’t change the conditions that allowed it. Security is ongoing maintenance, same as updating plugins or renewing your domain. Treat it that way.
What Actually Works for Malicious Redirect Removal
I’ve done malicious redirect removal enough times to know the scan-and-delete approach only gets you halfway there. You pull the infected file, clear the cache, breathe a sigh of relief — and three days later the redirects are back. That’s because the payload is almost never in just one place. Last year I cleaned a WooCommerce site where the same base64 blob was injected into 47 files across three different directories, plus a rogue admin user sitting quietly in the database nobody noticed. You have to audit wp_users, check file modification timestamps, and pull your server access logs before you declare anything clean.
If this is your situation right now and you’d rather hand it to someone who does this regularly, I take on malware cleanup and security hardening work at swsDreams — just reach out with your hosting details and I’ll tell you what I’m looking at.
