WordPress site redirecting to a spam site

If your WordPress site sends people to a spam, casino, or unrelated page, something on the site is issuing that redirect. It is often a changed .htaccess file, injected code in the theme, or a script that only fires for some visitors. The site can look normal to you while search traffic and phones are sent elsewhere.

What you are seeing

You open your address and the right page loads. Someone else lands on gambling, pharmacy offers, loans, or a page of unrelated keywords. The address bar may change immediately, or your real page may flash and then jump. It may happen only from Google, only on a phone, or only on the first visit.

The jump is a server redirect, usually from .htaccess or PHP, or a browser redirect from a script or a meta refresh tag. HTTPS or a caching plugin can also send people elsewhere. If the destination is spam you did not set up, treat the rule as untrusted. If Google is labeling the result, see the search warning and Deceptive site ahead.

Why it happens

WordPress redirects on purpose for permalinks, HTTPS, and the www choice. A spam redirect uses that same feature and points it at someone else's site.

Look in the root .htaccess, above or inside # BEGIN WordPress and # END WordPress, in header.php, footer.php, or functions.php, in a changed plugin, and in PHP under wp-content/uploads or wp-content/mu-plugins. A post or widget can hold the script when those files look clean. The table prefix is not always wp_.

Old passwords, outdated plugins, and packages from outside WordPress.org are the usual way in. The rule returns if that door stays open. See how a WordPress site gets compromised. Some rules skip logged-in administrators or desktop browsers. Phone-only cases are under redirects on mobile only.

How to check if you are affected

The check below is Laskyr's read-only scanner. It does not log in or change files. It can miss a rule that runs only on phones, only for search traffic, or only on one URL.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds

1. Logged out, in a private window, search Google for site:yourdomain.com and open several results. Note any that leave your domain.
2. On a phone, using mobile data, open the homepage and one inner page.
3. View source on a page that jumps. Look for a meta refresh, or a script pointing at a domain you do not own.
4. Open the root .htaccess. Rules above the WordPress block that name another website are not part of a default install. Check .htaccess in wp-content and uploads too.
5. Under Settings, then General, confirm both addresses. They are siteurl and home in the options table.
6. Under Users, confirm every administrator. See unknown administrator if one is unfamiliar.

How to fix it yourself

1. Isolate the site with a maintenance message, or ask the host to take it offline.
2. Back up files and the database. Label the copy as still containing the redirect. Restore only a backup from before the problem, and only after passwords change.
3. Remove the redirect you found. One deleted line comes back if a plugin or unknown admin can rewrite it.
4. Replace WordPress core from wordpress.org: wp-admin, wp-includes, and root PHP files including index.php and wp-login.php. Keep wp-config.php. Do not delete wp-content.
5. Remove administrators you do not recognize. Ask your developer or host before deleting an account they still use.
6. Reinstall plugins and the active theme from WordPress.org or the vendor you paid. Remove anything from a random download.
7. Reset administrator, SFTP, hosting, and database passwords. Update DB_PASSWORD in wp-config.php if the database password changes. Replace salts from the WordPress salt service.
8. Remove PHP you did not put in wp-content/uploads, and disable PHP execution there. On Nginx, ask the host. Apache can use .htaccess.

DIY is a bad idea if you have no backup, if the redirect returns, or if the host has already suspended the account. See how to clean a hacked WordPress site.

When to get help

Get help when the destination keeps changing, when you cannot reproduce the jump customers see, or when you are not sure which files belong. Guessing in .htaccess can take the real site down while the spam rule sits in a second file.

Emergency Cleanup is a flat $499. The 30-day reinfection guarantee means we clean the site again, or we refund the fee if we cannot clean it. Work starts only after you confirm you own the site. There is no countdown. Write to daniel@daniellasek.com or use the next step.

Fix it now — $499 Talk to us by email

FAQ

Why does my WordPress site redirect only some visitors?

Some rules look at the phone, the search referrer, or whether you are logged in, and leave everyone else alone. Test logged out, in a private window, and on a phone, not only from the browser where you are an administrator.

Can a plugin or the site URL setting cause a redirect without a compromise?

Yes. An SSL plugin, a move to a new host, or the WordPress Address and Site Address under Settings, General can send people to the wrong host. If the destination is spam you never configured, keep looking in .htaccess and the theme.

Will deleting one line in .htaccess fix a spam redirect for good?

Only if that line was the whole problem. A changed plugin or an unknown administrator can write the rule back. Replace core from wordpress.org, reinstall themes and plugins from clean copies, and reset passwords.

Should I restore my most recent backup to stop the redirect?

Not until you know that backup is clean. The redirect was often already in yesterday's files. Keep the copy, label it as suspect, and restore only a backup from before the problem started, after you change passwords.