# My website redirects to another site: what's going on

> Why your website redirects visitors to spam or gambling sites but never you, how to reproduce it with curl and where to look: .htaccess, database, JavaScript.

URL: https://webintacta.com/en/guides/website-redirects-to-another-site
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** If your website sends visitors to gambling pages, fake giveaways or fake virus alerts, it almost certainly has malware, and it usually hides from the owner: it only fires on mobile, only for visitors coming from Google, or only on the first visit. You confirm it with curl by imitating those visitors, then look for it in .htaccess, the database and JavaScript files. If it comes back after you remove it, the way in is still open.


By Jose Soriano (WebIntacta) · published 2026-10-24

If someone has told you your website takes them to a gambling page, a fake giveaway or a virus alert, you almost certainly have malware. Malicious redirects are designed to fool the site owner, so the first step is learning how to see them.

## Why it only happens to other people

A malicious redirect usually fires only when certain conditions are met, precisely so the administrator doesn't see it:

- **By device**: only on phones (owners usually check their site from a computer).
- **By referrer**: only when the visitor arrives from Google, Facebook or another search engine; if you type the address yourself, nothing happens.
- **Only the first time**: it sets a cookie and doesn't redirect on later visits.
- **Never when you're logged in**: if you're signed in as an administrator, the site behaves normally.
- **By country or time of day**, in the more elaborate variants.

## First: rule out legitimate redirects

Not every redirect is malware. If the site jumps to another address **of yours** (from `http` to `https`, from `www` to non-`www`, from an old page to the new one), that's configuration. So is a domain change that you or your agency made and nobody remembers. What's suspicious is being sent to a domain you don't recognize, especially if it only happens sometimes.

## How to check

### From your phone

Turn off Wi-Fi, open a private (incognito) window, search for your site on Google and click through from the result. Try several pages, not just the home page. If you have another phone handy that has never visited the site, even better: that gets around the "first visit only" cookie.

### With a command

`curl` comes installed on Windows 10 and 11, macOS and Linux. This command requests your home page as if you were a phone arriving from Google and shows only the response headers:

```
curl -sI -A "Mozilla/5.0 (Linux; Android 14) Mobile" -e "https://www.google.com/" https://your-site.com/
```

If there's a `Location:` line pointing to a domain that isn't yours, the redirect is on the server (usually in `.htaccess` or in PHP). If there isn't, it may be in JavaScript, which `curl` doesn't run: then you need to look at the page's code.

### With the browser's developer tools

In Chrome, press `F12`, go to the **Network** tab, check **Preserve log** and load the site. If there's a redirect, you'll see the chain of requests: the first to your domain and then others to domains you don't know. Click the first external request and look at the **Initiator** column: it tells you which script triggered it.

The [free scan](https://webintacta.com/en/free-website-security-scan) runs these tests for you and also checks the home page scripts and blocklists.

## Where it usually lives

### 1. The .htaccess file

On Apache servers, a few lines are enough to redirect based on the browser or the referrer. Look for them in the `.htaccess` in the root and in subfolders (including `wp-content/uploads/`):

```
RewriteCond %{HTTP_REFERER} (google|bing|facebook) [NC]
RewriteCond %{HTTP_USER_AGENT} (android|iphone|mobile) [NC]
RewriteRule .* https://dominio-desconocido.example/ [R=302,L]
```

If you see something similar with a domain you don't recognize, it's malware.

### 2. The database

In WordPress, the attacker can change the `siteurl` and `home` options in the `wp_options` table, or add a `<script>` to the content of posts, widgets or the site footer. In PrestaShop, in the configuration (the `ps_configuration` table) or in CMS pages. Search the database for strings like `<script`, `eval(`, `atob(` or `String.fromCharCode` where they shouldn't be. In WordPress, a quick query from phpMyAdmin:

```
SELECT option_name, LEFT(option_value, 150) FROM wp_options
WHERE option_name IN ('siteurl', 'home')
   OR option_value LIKE '%<script%'
   OR option_value LIKE '%atob(%';
```

Replace `wp_` with your installation's prefix if it's different (you'll find it in `wp-config.php`).

### 3. A modified PHP file

`index.php`, the theme's `functions.php`, `wp-config.php` or a plugin file with a few lines added at the top. They're usually obfuscated (`base64_decode`, `gzinflate`, very long strings that make no sense).

### 4. Injected JavaScript

A script loaded from another domain or hidden inside a legitimate `.js` file of the theme or a plugin. It's the hardest variant to spot without tools. The ones that ask you to "allow notifications" to prove you're not a robot belong to this family: if a visitor accepts, they'll keep getting ads even after you clean the site, and they'll have to remove the permission in their browser.

## Why it comes back after you remove it

It's what I run into most: the owner (or their host) deletes the rule from `.htaccess`, the redirect disappears and a few days later it's back. That happens because there's almost always **a backdoor** (a PHP file that lets the attacker back in) or **a scheduled task** that reinstalls the infection. And underneath, the flaw they got in through is still open.

1. Find every piece: the redirect, backdoors, users and scheduled tasks.
2. Replace the core and the plugins or modules with the original versions.
3. Close the way in: update the vulnerable component or change the leaked credential.
4. Change every password and, in WordPress, regenerate the keys in `wp-config.php`.
5. If Google shows a warning, request the review once the site is clean ([how to remove the Google warning](https://webintacta.com/en/guides/google-says-site-is-dangerous)).

The full process, including what to save before you touch anything, is in [how to recover a hacked website](https://webintacta.com/en/guides/recover-hacked-website). If the site is WordPress, those five steps are exactly what I do in [hacked WordPress cleanup](https://webintacta.com/en/wordpress-malware-removal), with a report of where each piece was.

## If you want me to fix it

A malicious redirect is handled like any other infection: I find every piece, clean it up, close the way in and check that it doesn't come back. Everything I do goes into a report.

- **WordPress**: €219 excluding VAT, with a 90-day guarantee. Details in [WordPress malware removal](https://webintacta.com/en/wordpress-malware-removal).
- **PrestaShop or WooCommerce**: €349 excluding VAT, with the payment review included ([hacked PrestaShop repair](https://webintacta.com/en/hacked-prestashop-repair)).
- **Other CMSs or custom PHP**: from €390, with a fixed quote before I start.
- If it can't wait, any cleanup can be ordered with priority (+€80 on WordPress, +€100 on a store): your case goes ahead of my other work. All the options are in [hacked website repair](https://webintacta.com/en/hacked-website-repair).

## Sources

- [Google Search Central: spam policies](https://developers.google.com/search/docs/essentials/spam-policies) (sneaky redirects that send only mobile users to a spam domain, and hacked-site redirects that depend on the referrer, browser or device).
- [Apache: mod_rewrite documentation](https://httpd.apache.org/docs/current/mod/mod_rewrite.html) (`RewriteCond` with `HTTP_REFERER` and `HTTP_USER_AGENT`, and the `[NC]`, `[R=302]` and `[L]` flags).
- [MDN: Location header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Location) (tells the browser which address the response redirects to).
- [Chrome DevTools: Network panel reference](https://developer.chrome.com/docs/devtools/network/reference) (the **Preserve log** option and the **Initiator** column).
- [WordPress: security keys in wp-config.php](https://developer.wordpress.org/apis/wp-config-php/#security-keys) (changing them invalidates existing cookies and forces everyone to log in again).

## Frequently asked questions

### Could it be my hosting provider or my internet provider?

Very unlikely. If the redirect leads to a spam domain and only happens under certain conditions, it's in your website.

### What if the site opens ads in new windows?

It's the same problem in another form: an injected script that opens ads or notifications. It's found and cleaned the same way.

### Why does my site redirect to spam only on mobile?

Because the malicious code checks the browser before acting. It's done on purpose: owners usually check their site from a computer and never see it.

### Is restoring a backup enough?

Only if the backup predates the infection and you then close the way in. Otherwise the redirect comes back, sometimes within hours.

## About the author

[Jose Soriano](https://webintacta.com/en/about): Full-stack developer specialized in PrestaShop, WordPress and WooCommerce, who has passed the official PrestaShop course and exam. He has been building online stores and modules since 2023 and is the founder of WebIntacta, the website security service through which he scans, cleans and maintains small-business websites and online stores himself, remotely from Ibi (Alicante, Spain). WebIntacta facts: https://webintacta.com/en/about#datos