My WordPress Site Redirects Visitors to Spam: The Complete Rescue Path

Step 1: Confirm it (and understand why you can't see it)

Redirect malware is built to hide from the one person who could remove it: you. The malicious code frequently checks who is visiting before firing. Logged-in administrators, repeat visitors with a marker cookie, and sometimes visitors typing the address directly are shown the normal site; a first-time visitor arriving from a Google search gets bounced to the spam page. This trick is called cloaking, and it's why "it works fine for me" proves nothing.

To see what your visitors see:

• Open your site in a private/incognito window, ideally on a different device, on mobile data instead of your home connection.
• Search for your site on Google and click the search result instead of typing the address. Much of this malware only triggers on search traffic.
• Try it a second time in a fresh private window. Some variants fire only once per visitor.

If any of those bounce you somewhere you didn't build, you've confirmed it. And even if you can't reproduce it but visitors keep reporting it: believe the visitors.

Step 2: Contain the damage

Before hunting for the code, close the doors the attacker may still be using:

1. Change every password that touches the site: WordPress admin accounts, your hosting control panel, FTP/SFTP, and the database password if you know how. Use a password manager; make them long and unique.
2. Review your admin users. In the dashboard, open Users and look for administrators you didn't create. Attackers routinely add their own. Don't just delete them yet if you're unsure; note them for the cleanup.
3. Take a full backup now, infected as it is. It preserves evidence, and if a cleanup step goes wrong you can always get back to a known state. Download it off the server.

Step 3: Know the hiding places

Redirect malware is rarely in one place. In real cleanups we find it living in some combination of:

• Theme files. Injected script blocks in header.php, footer.php, or functions.php, often at the very top or bottom of the file where nobody scrolls.
• The database. Script tags injected into posts and pages themselves, into widgets, or into theme settings stored in the options table. File-only cleanups miss these entirely, which is why the redirect "comes back" after replacing all files.
• The two address settings. WordPress stores your site's own address in its settings (siteurl and home). Some attacks simply point them at a malicious domain, redirecting everything at once.
• .htaccess rules. The .htaccess file in your site's root can redirect traffic at the server level, before WordPress even runs, and attackers often add rules that only target search-engine visitors.
• Fake plugins. A plugin folder the attacker created to keep re-injecting all of the above after you clean it. We wrote a complete field guide to spotting these.

Step 4: Clean it, completely

You have two honest options.

The manual route

Replace WordPress core files with fresh copies, replace every plugin and theme with fresh downloads from official sources, manually inspect the database for injected scripts, reset siteurl/home, rebuild .htaccess, and delete anything you can't account for. It's doable for a technical owner with time, and plenty of people have done it. The two failure modes we see: missing the database side (the redirect returns), and missing the persistence mechanism, the backdoor or fake plugin that let the attacker back in (everything returns).

The automated route

This is the job Kornet was built for: it scans every file on the site and the WordPress database, identifies injected code including the cloaked variants you can't reproduce in your own browser, removes it, and gives you a full report of what it found and changed, with a downloadable copy of your files from before the cleanup in case you ever want to compare or restore. The scan itself is free and tells you what's there; you only pay if malware is found and you approve the cleanup.

Step 5: After the cleanup

Written by the Kornet team, based on the redirect infections we see and clean in real customer sites.