Website Redirects to Malicious Sites: How to Fix It

If your website redirects visitors to unknown or malicious sites, your site has most likely been hacked. Take the site offline, change all your passwords, then scan and clean the site. Clean-up is not always a single step, so work through the checks below in order.

This article explains how to find and remove the malicious code, and what to do if the redirect comes back.

Before you start

1. Back up your site and database. Keep this copy for investigation, and do not delete it.
2. Put the site on a maintenance page so visitors are not redirected while you work.
3. Change passwords for your WordPress users, your hosting control panel, FTP or SFTP, SSH (if you use it) and your database.

Your hosting login details are in your welcome email. You can also manage passwords in the client area at my.hostking.host.

Find and remove the malicious code

Redirect code is often hidden in server-level and core files. Check the following places.

• .htaccess: the most common injection point. Extra redirect rules here send visitors elsewhere.
• index.php and wp-blog-header.php: check for code that does not belong in a standard WordPress file.
• Uploads folder and webroot: look for PHP files that should not be there, especially in the uploads folder.
• JavaScript files: look for unfamiliar scripts, particularly in files with jQuery in the name.
• Database: check for injected code in posts, options and widgets.

Note that the redirect may only appear for some visitors, such as those coming from search results or on mobile phones. The site can look normal when you are logged in, so test it in a private browser window and from a mobile device.

Scan with Imunify360 (cPanel)

Imunify360 is the malware scanner on Hostking's servers. In cPanel, go to Security, then Imunify360. The menu label may vary slightly between cPanel builds.

1. Open the Malicious tab and select Start scanning.
2. Review each flagged file before you act on it.
3. Choose Clean to remove the malicious part of a file, or Delete to remove the whole file.
4. Only use Add to Ignore List if you are sure a file is a false positive.

Do not ignore a file unless you are sure it is safe. Ignoring a real infection leaves the redirect in place.

Scan and clean (DirectAdmin)

DirectAdmin plans include malware and virus protection. If you cannot find a scanning option in your panel, contact support using live chat or a support ticket from the client area.

Clean up WordPress

The most reliable fix is to replace WordPress files with clean copies. Where you are comfortable working with code, you can also check individual files by hand. Editing single files is easy to miss, so the infection may return.

1. Update WordPress, all plugins and all themes to the latest versions.
2. Replace the WordPress core files with clean copies of the same version from WordPress.org.
3. Replace plugin and theme files with clean copies from the WordPress plugin or theme directory.
4. Delete any plugins and themes you do not use.
5. Reset the .htaccess file to the standard WordPress rules. A clean WordPress .htaccess file is short.
6. Check the wp-users table in your database for users you do not recognise, and delete them.
7. Regenerate your WordPress security keys.

Install Wordfence Security

Wordfence Security is a free WordPress security plugin. You can install it from Plugins, then Add New in your WordPress dashboard. Run a full scan after installing it.

1. Run a full Wordfence scan.
2. Select the repair option for infected files, and restore clean versions where offered.
3. Delete files that cannot be repaired, but first check that they are not core WordPress files.

Check the redirect is gone

After cleaning, clear all caches, including any caching plugin and browser caches. Then test the site from a private browser window and a mobile device.

If the redirect returns, check the database for hidden code and for scheduled tasks you did not create. Then repeat the scan.

Google warnings and recovery

Browsers and search engines may still show a warning after the site is clean. Chrome can show a "Deceptive Site Ahead" message, and Google Search Console can flag hacked content. After cleaning, you can request a review in Google Search Console. Check Google's current documentation for the steps.

Get help from Hostking support

If you cannot clean the site, or the redirect keeps returning, contact Hostking support. You can use live chat on the website, or open a support ticket from the client area at my.hostking.host.

Prevent future infections

• Keep WordPress, plugins and themes up to date.
• Remove plugins and themes you do not use.
• Use strong, unique passwords for all accounts, and change them if you suspect a breach.
• Keep regular backups. WordPress Hosting plans include daily backups.