Visitors arrive somewhere else when they try to reach your site, but when you check it yourself everything appears normal. Redirect hacks are confusing precisely because they are designed to hide from the people most likely to stop them.
The report often comes from a visitor rather than a dashboard alert. Someone clicks a link to your site and lands somewhere else — a pharmaceutical storefront, a gambling site, an adult page, or a suspicious download prompt.
You check the site immediately and see nothing unusual. Pages load normally and content appears untouched.
This behavior is not accidental. It is intentional.
A redirect hack is not designed to destroy your website. It is designed to quietly use it.
Why You Cannot See What Your Visitors See
Redirect attacks are designed to be selective. Attackers know that if the website owner sees the redirect, the compromise will be discovered quickly. Because of this, redirect logic often excludes administrators entirely.
The redirect may trigger only under certain conditions: when the visitor arrives from a search engine result, when the visitor uses a mobile device, when the visitor has not previously visited the site, or when the referring source is Google or another search engine.
Website owners usually access their own site directly or while logged in. Those conditions often bypass the redirect completely, allowing the compromise to continue unnoticed for weeks or even months.
How Selective Redirect Logic Works
- A visitor clicks your link in search results and is redirected to another destination
- A first-time mobile visitor arrives and is silently redirected elsewhere
- A logged-in administrator visits the site and sees normal behavior
- A repeat visitor returns and no redirect occurs to avoid suspicion
Where Redirect Instructions Are Injected
Redirect code rarely exists in only one location. Attackers often place injection points in several areas so the redirect can survive partial cleanup attempts.
Theme and Plugin Files
Malicious PHP functions injected into theme or plugin code can evaluate visitor conditions and issue redirects during page load.
The WordPress Database
Encoded scripts stored inside database tables can regenerate redirect code even after infected files are replaced.
JavaScript in Pages
Client-side scripts embedded in page content or injected through plugins may execute inside the visitor’s browser before the page fully loads.
.htaccess Configuration
Server-level redirect rules placed in configuration files can execute before WordPress loads, making them harder to detect with standard plugin scans.
What Attackers Gain From Your Traffic
Redirect attacks are designed to exploit your existing domain reputation. Your site may already have search visibility, trusted visitors, and established traffic. Attackers use that trust to redirect visitors toward destinations that benefit them.
Common Uses of Redirect Traffic
- Generating affiliate revenue from redirected visitors
- Delivering malware or unwanted software downloads
- Boosting search rankings for spam websites
- Sending visitors to phishing pages designed to collect information
- Leveraging your site’s reputation to support black-hat SEO strategies
Over time, search engines may begin associating your domain with these destinations. This can result in warnings, ranking losses, or removal from search results entirely.
Why Removing the Redirect Is Not Enough
The most common response to a redirect attack is locating and removing the visible redirect code. While this can temporarily stop the behavior, the redirect often returns if the underlying injection point remains.
A database entry containing encoded code may restore modified theme files. A hidden loader file may recreate redirect rules in configuration files. The redirect appears again, and the owner assumes a new attack has occurred.
Removing a redirect without identifying its source removes the symptom, not the cause.
Effective recovery requires identifying the original injection point and removing every persistence mechanism that supports it. This includes verifying file integrity, examining the database for encoded entries, reviewing configuration files, and ensuring that no unauthorized access paths remain.
Until the injection source is located and removed, the redirect can continue silently — affecting visitors and search engine trust without obvious signs inside the website itself.
Source Identification and Complete Removal
Permanent recovery begins with identifying how the redirect was introduced and ensuring that no mechanism remains capable of restoring it.