Redirects

WordPress Spam Redirect Malware

Visitors are redirected to scam, adult, gambling, pharma or malware sites through JavaScript, htaccess or PHP payloads.

Symptoms

These are common signs associated with this type of WordPress compromise. The exact behavior can vary by hosting setup, cache layer, plugins and how the attacker configured the payload.

• Only some users are redirected, often mobile or first-time visitors.
• Redirects happen from Google traffic but not direct visits.
• The WordPress admin may look normal while public pages redirect.

Technical overview

Redirect malware can be injected in .htaccess, theme files, database options, malicious plugins, cache files or external JavaScript loaders.

Important: visible symptoms are rarely the whole incident. A safe recovery should identify both the payload and the persistence mechanism that allowed it to run.

Indicators of compromise

During investigation, these indicators are commonly reviewed. They do not prove compromise alone, but they help map scope and root cause.

Investigation process

WP•FIX treats this as an incident, not a simple file deletion task. The review normally includes WordPress core integrity, theme and plugin files, uploads, database options, users, cron events, redirects, cache layers and the most likely entry point.

Recovery process

• Create a safe recovery point before changing production data.
• Remove malicious files, scripts, database payloads and persistence mechanisms.
• Replace compromised components with clean versions where appropriate.
• Review administrator users, credentials and access paths.
• Harden the site and document the recovery path.

Prevention

Prevention depends on the root cause. Common controls include removing nulled components, updating vulnerable plugins, reducing administrator access, hardening login paths, adding monitoring and keeping verified backups.

FAQ