A malicious website redirect sends visitors to a domain that the website owner did not choose. Some redirects affect every visit, while others appear only on mobile devices, only for visitors from Google, or only once per browser. This selective behavior makes redirect malware difficult to reproduce and easy to underestimate.
Redirect infections can damage conversions immediately. Customers may land on scams, fake updates, gambling pages or unwanted advertisements instead of the intended page. Search engines and hosting providers may also flag the site if the redirect distributes harmful or deceptive content.
Common symptoms of redirect malware
- Mobile visitors are sent to a different domain.
- Google visitors see a redirect, but direct visitors do not.
- The redirect appears only on the first visit or in a private window.
- Administrators cannot reproduce the problem while logged in.
- Clicking a normal internal link opens an advertisement or fake warning.
- Search results contain unfamiliar titles or destination URLs.
- The redirect disappears temporarily after clearing one file, then returns.
Attackers deliberately add conditions based on device, referrer, cookie, location or user role. A clean-looking homepage does not prove that the website is safe.
Where malicious redirects can hide
Injected JavaScript
Malicious JavaScript may be inserted into theme files, plugin files, cached assets, database widgets or tag-manager code. It can wait for a particular device or referrer before changing the destination.
Server configuration
Redirect rules can be placed in .htaccess, Nginx configuration, PHP configuration or compromised control-panel settings. These redirects may run before the CMS loads, which means changing a WordPress page will not remove them.
Database content
Attackers can inject scripts into posts, options, widgets, templates or serialized data. Database payloads are especially important when the malicious code returns after infected files are replaced. Learn more about our database malware removal process.
Compromised plugins and themes
An abandoned, pirated or vulnerable component may be the original entry point. A fake plugin can also look normal in the dashboard while loading remote redirect instructions.
Backdoors and scheduled reinfection
A hidden PHP backdoor or scheduled task may rewrite the redirect after each cleanup. Removing the visible script without finding the persistence method only produces a temporary fix.
A safe redirect malware removal process
Record the behavior before changing the site
Capture affected URLs, devices, referrers, times and destination domains. Screenshots and screen recordings can help reproduce selective redirects. Preserve a backup before making destructive changes.
Inspect every execution layer
Check DNS and CDN settings, server rules, CMS files, database content, active users and scheduled tasks. Redirects can be introduced outside the visible page editor, so the investigation should not stop after inspecting the homepage source.
Remove malicious code and persistence
Delete or repair confirmed malicious components while preserving legitimate site functionality. Replace compromised core files with trusted copies where appropriate. Remove rogue administrators and revoke unknown access.
Close the entry point
Update vulnerable software, remove abandoned components, rotate credentials and review permissions. If several sites share one hosting account, inspect the neighboring installations as well.
Test as different visitors
Retest mobile and desktop visits, search referrers, private windows and key conversion pages. Continue monitoring server and security logs after the visible redirect is gone.
Can a redirect be caused by something other than malware?
Yes. Misconfigured HTTPS rules, a CDN setting, an old migration rule or a marketing script can create unwanted redirects. The investigation should confirm whether the behavior is malicious before deleting code. A careful diagnosis reduces the risk of breaking legitimate checkout, login or localization rules.
Frequently asked questions
Why does the redirect happen only on phones?
Malware can detect screen size, browser type or mobile user agents. Attackers use selective redirects to avoid detection by desktop administrators and basic scanners.
Why can I not see the redirect while logged in?
Some injected scripts avoid administrators or set a cookie after the first redirect. Test results should include logged-out sessions and more than one device, while keeping the investigation controlled.
Is clearing the cache enough?
No. Clearing caches may remove a copied payload temporarily, but it does not remove the original injected script or backdoor. Cache layers should be purged after the source of the infection is addressed.
How do I request urgent help?
Send the affected URL, the unwanted destination and any device-specific details through WhatsApp. For a broader compromise, review our emergency malware cleanup service.