My website redirects to another site: what's going on
In short
If your website sends visitors to gambling pages, fake giveaways or fake virus alerts, it almost certainly has malware, and it usually hides from the owner: it only fires on mobile, only for visitors coming from Google, or only on the first visit. You confirm it with curl by imitating those visitors, then look for it in .htaccess, the database and JavaScript files. If it comes back after you remove it, the way in is still open.
If someone has told you your website takes them to a gambling page, a fake giveaway or a virus alert, you almost certainly have malware. Malicious redirects are designed to fool the site owner, so the first step is learning how to see them.
By Jose SorianoLast updated: 5 min read
Why it only happens to other people
A malicious redirect usually fires only when certain conditions are met, precisely so the administrator doesn't see it:
- By device: only on phones (owners usually check their site from a computer).
- By referrer: only when the visitor arrives from Google, Facebook or another search engine; if you type the address yourself, nothing happens.
- Only the first time: it sets a cookie and doesn't redirect on later visits.
- Never when you're logged in: if you're signed in as an administrator, the site behaves normally.
- By country or time of day, in the more elaborate variants.
First: rule out legitimate redirects
Not every redirect is malware. If the site jumps to another address of yours (from http to https, from www to non-www, from an old page to the new one), that's configuration. So is a domain change that you or your agency made and nobody remembers. What's suspicious is being sent to a domain you don't recognize, especially if it only happens sometimes.
How to check
From your phone
Turn off Wi-Fi, open a private (incognito) window, search for your site on Google and click through from the result. Try several pages, not just the home page. If you have another phone handy that has never visited the site, even better: that gets around the "first visit only" cookie.
With a command
curl comes installed on Windows 10 and 11, macOS and Linux. This command requests your home page as if you were a phone arriving from Google and shows only the response headers:
curl -sI -A "Mozilla/5.0 (Linux; Android 14) Mobile" -e "https://www.google.com/" https://your-site.com/If there's a Location: line pointing to a domain that isn't yours, the redirect is on the server (usually in .htaccess or in PHP). If there isn't, it may be in JavaScript, which curl doesn't run: then you need to look at the page's code.
With the browser's developer tools
In Chrome, press F12, go to the Network tab, check Preserve log and load the site. If there's a redirect, you'll see the chain of requests: the first to your domain and then others to domains you don't know. Click the first external request and look at the Initiator column: it tells you which script triggered it.
The free scan runs these tests for you and also checks the home page scripts and blocklists.
Where it usually lives
1. The .htaccess file
On Apache servers, a few lines are enough to redirect based on the browser or the referrer. Look for them in the .htaccess in the root and in subfolders (including wp-content/uploads/):
RewriteCond %{HTTP_REFERER} (google|bing|facebook) [NC]
RewriteCond %{HTTP_USER_AGENT} (android|iphone|mobile) [NC]
RewriteRule .* https://dominio-desconocido.example/ [R=302,L]If you see something similar with a domain you don't recognize, it's malware.
2. The database
In WordPress, the attacker can change the siteurl and home options in the wp_options table, or add a <script> to the content of posts, widgets or the site footer. In PrestaShop, in the configuration (the ps_configuration table) or in CMS pages. Search the database for strings like <script, eval(, atob( or String.fromCharCode where they shouldn't be. In WordPress, a quick query from phpMyAdmin:
SELECT option_name, LEFT(option_value, 150) FROM wp_options
WHERE option_name IN ('siteurl', 'home')
OR option_value LIKE '%<script%'
OR option_value LIKE '%atob(%';Replace wp_ with your installation's prefix if it's different (you'll find it in wp-config.php).
3. A modified PHP file
index.php, the theme's functions.php, wp-config.php or a plugin file with a few lines added at the top. They're usually obfuscated (base64_decode, gzinflate, very long strings that make no sense).
4. Injected JavaScript
A script loaded from another domain or hidden inside a legitimate .js file of the theme or a plugin. It's the hardest variant to spot without tools. The ones that ask you to "allow notifications" to prove you're not a robot belong to this family: if a visitor accepts, they'll keep getting ads even after you clean the site, and they'll have to remove the permission in their browser.
Why it comes back after you remove it
It's what I run into most: the owner (or their host) deletes the rule from .htaccess, the redirect disappears and a few days later it's back. That happens because there's almost always a backdoor (a PHP file that lets the attacker back in) or a scheduled task that reinstalls the infection. And underneath, the flaw they got in through is still open.
- Find every piece: the redirect, backdoors, users and scheduled tasks.
- Replace the core and the plugins or modules with the original versions.
- Close the way in: update the vulnerable component or change the leaked credential.
- Change every password and, in WordPress, regenerate the keys in
wp-config.php. - If Google shows a warning, request the review once the site is clean (how to remove the Google warning).
The full process, including what to save before you touch anything, is in how to recover a hacked website. If the site is WordPress, those five steps are exactly what I do in hacked WordPress cleanup, with a report of where each piece was.
If you want me to fix it
A malicious redirect is handled like any other infection: I find every piece, clean it up, close the way in and check that it doesn't come back. Everything I do goes into a report.
- WordPress: €219 excluding VAT, with a 90-day guarantee. Details in WordPress malware removal.
- PrestaShop or WooCommerce: €349 excluding VAT, with the payment review included (hacked PrestaShop repair).
- Other CMSs or custom PHP: from €390, with a fixed quote before I start.
- If it can't wait, any cleanup can be ordered with priority (+€80 on WordPress, +€100 on a store): your case goes ahead of my other work. All the options are in hacked website repair.
Sources
- Google Search Central: spam policies (sneaky redirects that send only mobile users to a spam domain, and hacked-site redirects that depend on the referrer, browser or device).
- Apache: mod_rewrite documentation (
RewriteCondwithHTTP_REFERERandHTTP_USER_AGENT, and the[NC],[R=302]and[L]flags). - MDN: Location header (tells the browser which address the response redirects to).
- Chrome DevTools: Network panel reference (the Preserve log option and the Initiator column).
- WordPress: security keys in wp-config.php (changing them invalidates existing cookies and forces everyone to log in again).
Frequently asked questions
Could it be my hosting provider or my internet provider?
Very unlikely. If the redirect leads to a spam domain and only happens under certain conditions, it's in your website.
What if the site opens ads in new windows?
It's the same problem in another form: an injected script that opens ads or notifications. It's found and cleaned the same way.
Why does my site redirect to spam only on mobile?
Because the malicious code checks the browser before acting. It's done on purpose: owners usually check their site from a computer and never see it.
Is restoring a backup enough?
Only if the backup predates the infection and you then close the way in. Otherwise the redirect comes back, sometimes within hours.