WordPress redirect hack: when only some visitors get sent to spam

Updated 2026-10-16 · 7 min read · by the IsHacked team

A customer tells you your site sent them to a lottery or a "your phone is infected" page. You open it and everything is fine. Redirect malware is built to behave exactly like that.

Test redirects for phones and Google visitors

Why you can't reproduce it

• It skips administrators. The code checks for a logged-in cookie or is_user_logged_in() and stays quiet.
• It targets phones. It looks for a mobile user agent, because mobile visitors are less likely to notice the address bar.
• It targets search traffic. It checks the referrer for google.com or bing.com, so direct visits are left alone.
• It fires once. A cookie or localStorage flag makes sure each visitor is redirected only on the first visit.
• It may target countries. Some campaigns only redirect visitors from certain regions, which is why we check from several countries.

Reproduce it

curl -sI -A 'Mozilla/5.0 (Linux; Android 14; Pixel 8) Mobile Safari/537.36' \
  -e 'https://www.google.com/' https://example.com/

Look at the status and Location header. If the redirect is done in JavaScript, fetch the page body instead and search for location.href, window.location.replace or document.referrer near a foreign URL. On a real phone, use a private tab on mobile data and arrive from a Google search result.

Where the code hides in WordPress

• The database. Scripts injected into posts, widgets or theme options, or a changed siteurl or home value in wp_options. Search the database for <script and for unfamiliar domains.
• Theme files. Code added at the top of functions.php, header.php or footer.php.
• Must-use plugins. Files in wp-content/mu-plugins run on every request and don't appear in the normal plugin list. Recent infections used names like wp-cache-handler-1a2b3c4d.php.
• Fake plugins with plausible names and a random suffix, which can also hide themselves from the plugin list.
• .htaccess rules with RewriteCond %{HTTP_REFERER} or %{HTTP_USER_AGENT} conditions sending traffic elsewhere.
• A loaded script. A <script src> pointing at a .php file inside wp-content, or at a domain you don't use, that only redirects under the right conditions.

Fix it

Remove the redirect code, then find how it got in, because these infections reinstall themselves from cron jobs and hidden copies. The cleanup checklist covers every place we have found persistence. Afterwards, keep checking as a phone visitor from Google every day: that is the only way to notice the next one before your visitors do.

FAQ

Why does the redirect not happen to me?

Redirect malware deliberately skips logged-in users and administrators, often skips desktop browsers and direct visits, and usually fires only once per visitor using a cookie. Test from a private window on a phone, arriving from a Google search.

Can a plugin cause a redirect without being hacked?

Yes: a misconfigured redirect or security plugin, a wrong site URL in Settings, or a CDN rule. Malicious redirects go to unrelated domains (lotteries, fake updates, adult or betting sites), not to another page of your own site.