My WordPress Site Redirects to Another Site

What's happening

When your WordPress site sends people somewhere else, usually a site selling pills, gambling, fake prizes or "your computer is infected" warnings, the site has been hacked. Someone has added code that quietly forwards visitors away. The redirect might happen on every page, only on the homepage, only on phones, or only for people who arrive from a Google search, which is why you may not see it yourself.

Other signs tend to come with it: strange links in your pages, new pages you never wrote, a drop in search traffic, and visitors or Google telling you the site is unsafe. Chrome may show a red "Dangerous site" warning, and Google may put "This site may be hacked" under your listing.

This is different from a redirect loop, where the browser says "too many redirects" and the page never loads. That's a settings problem. A site that loads but goes somewhere else is a security problem.

Why it happens

The redirect code gets in through a security hole, most often an outdated plugin or theme, a weak password, or a free copy of a paid plugin from an unofficial site. Once in, the attacker hides the code in several places at once: inside plugin files, in the theme, in the site's settings stored in the database, or in a file that runs before WordPress does. That's why fixing one file rarely fixes it. The code in the other places puts it back. For the bigger picture, see My WordPress site was hacked.

What you can safely try

• See it for yourself. Open the site in a private browser window, and on a phone using mobile data. Try arriving through a Google search for your business name, since some redirects only trigger that way.
• Change your WordPress and hosting passwords. It won't remove the code, but it stops a stolen password being used again while the site is cleaned.
• Check Users for an administrator you didn't create. It's a common companion to a redirect hack.
• Tell your host. Many hosts scan for this and some will pause the site to protect visitors. Here's what a malware suspension means.
• Don't delete files or plugins to hunt for it, and don't restore a backup from last week unless you know the hack is older than that. A backup made after the break-in brings the redirect straight back.

When to call us

A redirect hack is one of the most common cleanups we do on business websites. We find every copy of the code, remove it, check for hidden backdoors and unknown accounts, close the hole that let it in, and then ask Google to lift any warning. You keep your site, your content and your search listings. It's a flat rate you approve before any work starts. Start with our Hacked Site Cleanup.