If your WordPress site is redirecting visitors to spam, adult content, gambling sites, or unfamiliar retail pages, the site has almost certainly been compromised. Redirect hacks are one of the most common forms of WordPress malware and are often installed through vulnerable plugins, outdated themes, or compromised hosting credentials. This guide explains where attackers typically hide redirect code and how to approach cleanup safely.
Common redirect injection points
Redirect code can be injected into multiple locations simultaneously, which is why simply checking one file is rarely enough. The most common injection points are the wp-config.php file (where a line of obfuscated code is added to the top), the functions.php file in your active theme (where a redirect function is added), and the WordPress database (where the siteurl or home options are modified, or where posts have malicious JavaScript embedded in their content).
Attackers also create hidden PHP files in the /wp-content/uploads/ directory — a location that is typically writable and sometimes overlooked during cleanup. These files act as backdoors, allowing the attacker to re-inject redirect code even after a cleanup. If you remove the redirect without removing the backdoor file, the site will be re-infected quickly.
Some redirect hacks use JavaScript injection in the database rather than PHP files. The malicious script is stored in a post, page, or widget, and executes when a visitor loads the page. This is why a database-level search for suspicious script patterns is part of a thorough cleanup.
Why clearing cache is not a fix
Clearing your website cache may temporarily stop the redirect from appearing, which can be misleading. If the malicious code is still in a PHP file or the database, the cache will repopulate with the same content the next time a page is generated. Clearing cache is a useful diagnostic step — it removes the possibility that you are seeing a cached version of old content — but it should not be treated as a cleanup step.
Similarly, deactivating and reactivating plugins or switching themes does not remove malicious code that has already been injected into the database or core files. These steps are useful for isolation testing but are not a substitute for a file-level and database-level review.
How to avoid breaking the site during cleanup
The safest cleanup approach starts with a verified backup from before the infection — ideally from your hosting provider's automated backup system rather than a manually created backup that may already be infected. If you are not confident identifying and removing malicious code manually, a staging clone of the site lets you test cleanup steps without risking the live site.
When reviewing files, look for recently modified PHP files (your hosting file manager usually shows modification dates) and for obfuscated code — long strings of random-looking characters, base64 encoding, or eval() statements with encoded content inside. These are strong indicators of malicious injection.
- Check
wp-config.phpandfunctions.phpfor any code added near the top of the file. - Search the database
wp_optionstable for unexpected changes tositeurlandhome. - Look for PHP files in
/wp-content/uploads/— there should be none. - Run a database search for
eval(base64_decode— this is a common obfuscation pattern. - After cleanup, change all credentials: WordPress admin, hosting, FTP, and database passwords.
- Update all plugins, themes, and WordPress core before relaunching the cleaned site.
Unexpected redirects are one of the clearest signs that a website needs careful review.
Check hacked website symptoms