Injected JavaScript
Malicious scripts can be added to theme files, plugins, widgets, database options, tag managers, or cached HTML.
Malicious redirect cleanup
WordPress redirecting visitors?Find and remove the real cause.
Cleanup for WordPress sites sending visitors to spam, gambling, pharmaceutical, scam, or unfamiliar domains—especially redirects that appear only on mobile, from Google, or for first-time visitors.
What is happening
Conditional redirects are designed to hide
Attackers often avoid redirecting administrators and repeat visitors, making the infection difficult to reproduce during a normal logged-in check.
Server rewrite rules
Compromised .htaccess, web-server configuration, or PHP bootstrap files can redirect traffic before WordPress loads.
Conditional malware
Redirects may inspect referrer, device, cookies, IP address, country, or login state before activating.
Reinfection mechanisms
Backdoors, cron jobs, rogue administrators, vulnerable plugins, or compromised credentials can restore deleted code.
The service
Redirect removal with reinfection checks
The cleanup examines multiple layers because the redirect visible in the browser may be only the final symptom.
01
Reproduce the redirect
Test logged-out, private, mobile, and search-referral scenarios and review reported destination URLs.
02
Trace the source
Inspect server rules, PHP files, database content, plugins, themes, scripts, users, and scheduled tasks.
03
Clean and restore
Remove malicious payloads, restore legitimate files and rules, and preserve required site functionality.
04
Harden and test
Close the likely entry point, rotate relevant credentials, clear caches, and verify multiple visitor scenarios.
Important
Cleanup has to address the cause
Replacing .htaccess may only hide the symptom temporarily
If another malicious process can rewrite the file, the redirect will return. A reliable cleanup must check who or what created the redirect and whether other persistence mechanisms remain.
Request help
Describe what you are seeing
Include the website URL, visible symptoms, messages from your host or browser, and whether the problem returned after an earlier cleanup. Do not send passwords through this form.