Moatline

WordPress site redirecting to spam? How to find and fix it

Customers say your site sends them to a scam or casino page, but it looks fine when you open it. That is how these redirects are designed. Here is how to see what visitors see, where the code hides and how to remove it.

By the Moatline team at Next Nova Technologies · Published 15 October 2026 · 4 min read

Why you can’t see it

Redirect malware is built to hide from the site owner. Most versions only redirect some visitors:

  • Visitors from Google, not people who type your address.
  • Phones, not computers.
  • First visits only. A cookie stops it from redirecting the same person twice.
  • Never logged-in users. Anyone who has logged in to WordPress is skipped.

So “it works for me” proves nothing. If customers report it, believe them.

See what visitors see

  1. On a phone using mobile data (not your Wi-Fi), open a private tab.
  2. Search Google for your business name and tap your result.
  3. Note the address you end up on. Screenshot it: it helps you search for the code later.

With SSH or a terminal, this shows whether the server itself redirects visitors from Google on a phone. Look for a location: line pointing to another domain:

curl -sI -e "https://www.google.com/" \
  -A "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 Mobile/15E148" \
  https://yourdomain.com/

If this shows no redirect but the phone test does, the redirect happens in JavaScript in the page, not on the server.

Where redirect code hides

  • The database: a <script> tag injected into posts, widgets or page-builder content, or your site address changed in Settings.
  • .htaccess: rewrite rules that send visitors from Google or on phones to another site.
  • Theme files: code added to header.php, footer.php or functions.php.
  • Fake or must-use plugins: a plugin you never installed, often hidden from the Plugins list, that adds the script to every page.
  • JavaScript files: a few lines appended to the end of a real plugin’s or theme’s .js file.

Check each place

1. Run a full scan

The free Moatline Malware Scanner checks posts, widgets and page-builder content in the database, compares every plugin with its official copy, finds fake and must-use plugins, and loads your live home page the way a logged-out visitor does to catch scripts added while the page is built. It does not imitate a visitor arriving from Google on a phone, and it does not read .htaccess rules, so also do steps 2 and 3.

2. Check your site address and posts

In Settings → General, both addresses must be your own domain. With SSH:

wp option get siteurl
wp option get home
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%' AND post_status='publish'"

Change wp_ if your table prefix is different. Some posts legitimately contain scripts (embeds, forms), so look at what each one loads.

3. Check every .htaccess file

find . -name ".htaccess" -type f

Open each one. Lines mentioning HTTP_REFERER with google, bing or yahoo, or HTTP_USER_AGENT with android or iphone, followed by a rule sending visitors to another domain, are malicious. A normal WordPress .htaccess has only the short # BEGIN WordPress block plus rules from plugins you know.

4. Check core files

wp core verify-checksums
wp plugin verify-checksums --all

These compare your files with the official copies. Premium plugins and themes can’t be checked this way, so reinstall them from a fresh download.

After you remove it

  1. Clear every cache: your caching plugin, your host’s cache and any CDN such as Cloudflare. Otherwise visitors keep getting the old, infected pages.
  2. Change all passwords and generate new security keys in wp-config.php.
  3. Find the way in. Update every plugin and theme, remove ones you don’t use, and check for admin users you don’t recognise.
  4. Repeat the phone test the next day. If Google labelled your site, follow removing “This site may be hacked”.

Frequently asked questions

Why does my site redirect only on mobile?
Redirect malware often checks the visitor’s device and only redirects phones, because phone users are less likely to spot the scam and site owners usually check from a computer. Test on a phone using mobile data, in a private tab, from a Google search.
Why does it only happen when I click from Google?
The malware checks where the visitor came from. Redirecting only people who arrive from a search keeps the owner, who types the address directly, from noticing. Some versions also skip anyone who has ever logged in to WordPress.
Can a WordPress plugin cause a redirect without being hacked?
Yes. Redirect plugins, cookie banners and badly set up caching can send people to the wrong page. The difference is the destination: a legitimate redirect goes to a page on your own site, a malicious one goes to an unknown domain selling something or asking visitors to click “Allow”.
I removed the code but the redirect is back. Why?
Something is putting it back: a hidden admin account, a backdoor file, a scheduled task or a fake plugin. Check all of those, change every password, and look at how the attacker got in, usually an outdated plugin or a stolen password.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →