Website redirects on mobile only

A mobile-only redirect sends phones to a different page while a desktop browser still shows your normal WordPress site. If that destination is spam, gambling, or any domain you did not choose, the site is carrying a rule aimed at mobile visitors. A healthy desktop view is why owners hear about it from a customer first.

What you are seeing

On a laptop, the homepage is yours. On a phone, the same address jumps. The phone may land on spam, a casino, an install pitch, or a wall of ads. It may happen only on mobile data, only the first visit, or only when the person came from Google. A phone on office Wi-Fi can disagree with a phone on cellular data if a cache is involved.

Some rules skip logged-in users. Test in a private window, logged out, before you call the phone clean.

This is a narrower case of a WordPress site redirecting to spam. A desktop-only test is useless here. If Chrome on the phone shows Deceptive site ahead and the desktop does not, believe the phone.

Not every mobile redirect is unwanted. A plugin that sends phones to a mobile URL on your own domain, or an AMP setup you installed, can be configuration you chose. Your domain, on purpose, is a setting. Someone else's domain is not.

Why it happens

The rule checks the browser and redirects only the ones that look like phones. It can live in the root .htaccess, another .htaccess under wp-content, JavaScript in the theme, or PHP in a plugin or wp-content/mu-plugins. A cache can keep serving the mobile jump after you delete the rule.

WordPress does not send mobile users to another company. A theme option for a mobile URL on your own domain is different. Unwanted rules arrive through a password, an old plugin, or a theme file that is not the author's. See how those changes get in. Search engines crawl as phones, so this can be the version Google evaluates.

How to check if you are affected

The read-only scanner below requests the public site without logging in. It may or may not send a phone-like request. Do not treat a clean result as a pass if a real phone still jumps.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds

1. On a phone that is not logged into WordPress, open a private tab over mobile data, not only your usual Wi-Fi. Repeat for one inner page. Ask a second person if you only have one phone.
2. A desktop device preview is a hint. If it jumps, start looking. If it does not, still trust a real phone over the preview.
3. Write down the destination address. You will search your files for that domain. Do not keep visiting it.
4. Open the root .htaccess. A normal permalink block sits between # BEGIN WordPress and # END WordPress. Look for conditions that mention phones and for a destination that is not your domain. Check wp-content and wp-content/uploads for more .htaccess files.
5. View source, and compare header.php, footer.php, and functions.php with a clean theme. Look for a script you did not add.
6. Purge or bypass any cache and CDN, then retest the phone. If the jump exists only in the cached copy, you still have to find what created it. Clearing the cache without finding the rule means the next visit rebuilds it.

While you are in the admin, confirm Settings, then General, shows your real Site Address. A wrong siteurl is usually an all-device problem, but it is a short check.

How to fix it yourself

1. Isolate the site if phones are sent to spam. Take the whole site offline if you are not sure the rule is mobile-only.
2. Back up files and the database. Do not restore that copy over a later cleanup.
3. Remove the rule you found, and search for the destination domain in case a second copy exists.
4. Replace WordPress core from wordpress.org: wp-admin, wp-includes, and root PHP files including index.php and wp-login.php. Keep wp-config.php. Do not delete wp-content.
5. Remove unknown administrators after you ask whether a developer still needs one.
6. Reinstall the theme and plugins from clean copies, including any mobile, AMP, or redirect plugin whose files do not match the vendor zip.
7. Reset administrator, SFTP, hosting, and database passwords. Update DB_PASSWORD in wp-config.php. Replace salts from the WordPress salt service.
8. Remove PHP from wp-content/uploads, disable PHP execution there, purge caches, and retest on a phone using mobile data, logged out.

DIY is a bad idea with no backup, if the phone redirect returns, or if the host has suspended the site. See the jump on a real phone before you edit .htaccess from a screenshot. More detail is in how to clean a hacked WordPress site.

When to get help

Get help when every phone you try is redirected and the destination domain is not in the files, when the rule returns after a cache purge, or when you cannot reproduce the difference on purpose. Also get help before you remove a mobile plugin the site depends on and you cannot reinstall.

Emergency Cleanup is a flat $499. The 30-day reinfection guarantee means we clean the site again, or we refund the fee if we cannot clean it. Work starts only after you confirm you own the site. Nothing here is on a timer. Email daniel@daniellasek.com or continue below.

Fix it now — $499 Talk to us by email

FAQ

The redirect only happens on my phone. Is the phone the problem?

Unlikely, if another phone does it too. Ask someone else to open the site on mobile data. If theirs jumps and a computer does not, the site is sending mobile browsers elsewhere.

The browser phone preview looks fine. Does that mean there is no mobile redirect?

Not always. Preview is a useful hint. Some rules look at the full browser identity and ignore a desktop preview. Confirm with a real phone, logged out, on mobile data.

Could a mobile theme or an AMP plugin redirect phones on purpose?

Yes. Check those settings before you treat it as a compromise. A legitimate mobile address should still be your domain. A jump to an unrelated site is not a theme feature to keep.

I removed a rule in .htaccess and the phone still redirects. Why?

Purge any caching plugin and the CDN, then test again on mobile data in a private window. If it continues, look for a second .htaccess or a script in the theme. One file is often not the only copy.