How to fix a site redirecting to spam

Visitors report landing on adverts, a strange foreign-language site, or something that looks nothing like your business — sometimes instantly, sometimes only from certain links or search results. Your own front page might look completely normal when you check it. This is one of the more unsettling problems a site owner can run into, and it's worth saying plainly at the outset: it is fixable, it does not mean your content or data is lost, and working through it calmly and in order gets there fastest.

What's almost always happening is that a small piece of code has been added somewhere in the site's files, database, or .htaccess configuration — usually through an outdated plugin, theme, or a weak password — and that code is redirecting some or all visitors elsewhere. The rest of the site is typically untouched.

What to check first, calmly and in order

1. Where the redirect actually happens

Note exactly what triggers it: every visit, only the first visit from a given visitor, only visits arriving from a search engine, or only on a mobile device. Malicious redirects are frequently written to target search engine traffic specifically and leave a direct visit — you typing the address in — completely unaffected, which is precisely why the site "looks fine" when you check it yourself.

2. Your .htaccess file

Open .htaccess in your site's root folder and look for any RewriteRule or RewriteCond you don't recognise adding, particularly anything referencing HTTP_USER_AGENT or HTTP_REFERER — a common technique for redirecting only visitors arriving from search engines while leaving direct visits alone.

3. Recently modified files

If your file manager or FTP client can sort by modification date, sort your site's files that way. Malicious code is often injected into an existing, legitimate-looking file — a rewritten theme header file, a modified plugin file — rather than added as an obviously new file, so look for files that changed recently without you having edited them.

4. Your theme's header and footer files

These are commonly targeted because they load on every single page. Look for a block of unfamiliar code, especially anything that's been base64-encoded — a string of random-looking letters and numbers passed to a decoding function — which is a common way malicious code is disguised from a casual read-through.

5. The database itself

On WordPress specifically, check the wp_options table for the siteurl and home values, and search post content for injected scripts or links to unfamiliar domains. A compromised plugin can write directly into stored content as easily as into a file.

What to preserve before you clean anything up

It's tempting to delete anything suspicious the moment you find it. Slow down slightly first:

• Keep a copy of the suspicious code before removing it — paste it into a text file rather than deleting it outright. If the fix doesn't fully resolve things, having the original injected code available saves starting the investigation from scratch.
• Note the exact file paths and modification dates of anything you find altered.
• Take a full backup of the site as it currently stands, even in its compromised state, before making changes. This preserves your evidence and gives you something to fall back to if a cleanup step goes wrong.

Change your passwords

Use a long, unique password you haven't used anywhere else — our guide on choosing a strong password covers what actually makes one hard to compromise.

Update everything, then check for the actual entry point

Outdated plugins and themes are the most common route in. Update everything to its latest version, remove anything you don't actively use rather than leaving it installed and outdated, and check whether any plugin you're running has a recently disclosed vulnerability matching roughly when the redirect started. Our guide on cleaning a hacked WordPress site goes through this process in full.

Scan properly rather than relying on a manual look

A manual read-through of your files is a reasonable first pass, but malicious code is frequently written to be hard to spot by eye. A proper malware scan checks files against known patterns and flags anything altered from a clean baseline. Our guide on scanning a site for malware covers the tools available and how to interpret what they find.

After the cleanup

• Confirm the redirect is genuinely gone by testing from multiple entry points — direct visit, search engine, mobile — not just the one you originally noticed it from.
• Ask Google, or whichever search engine flagged it, for a review if the site was showing a security warning, once you're confident it's clean.
• Keep the backup taken during cleanup for a while rather than deleting it immediately, in case anything resurfaces.

When to bring in support

If you can't locate the injected code yourself, or you've removed everything you can find and the redirect is still happening, contact support with what you've already found and changed — the modified files, the passwords you've updated, roughly when it started. That saves duplicating work you've already done and lets us focus on what's actually still hiding.