Your WordPress site redirects visitors to spam — but looks fine to you

What you're seeing

Visitors click through to your site and land somewhere else — a gambling page, a pharmacy shop, a fake prize draw, an app store listing. Meanwhile the site works fine for you. The usual way business owners find out is one of these:

• A customer or a supplier mentions it, slightly awkwardly, as if it might be their fault.
• It only happens on phones, so you and everyone in the office never see it.
• It only happens when you click through from a Google search result, not when you type the address in.
• Search Console reports pages you have never heard of, or Google shows "This site may be hacked" under your listing.

Enquiries dry up first and analytics follows: sessions look normal but everything bounces in under two seconds, because the visitor never actually saw your site.

Why it happens

Someone has injected a small piece of code that redirects conditionally. That condition is the whole trick. Typical rules are:

• Only visitors from search engines. The code checks where the visitor came from and only fires if it was Google or Bing — which is exactly the traffic worth stealing.
• Only mobile browsers. Checks the browser's user agent and leaves desktop alone.
• Only once per visitor. Drops a cookie so the same person is never redirected twice, which makes it very hard for anyone to reproduce on demand.
• Never for logged-in users. You, the administrator, are excluded by design.

The code itself hides in a small number of predictable places:

• Your theme's functions.php, or the top of index.php
• wp-config.php, usually as a single very long obfuscated line
• .htaccess, above or below the block WordPress manages
• The database — the siteurl and home values in wp_options, or a script injected into post content
• wp-content/mu-plugins/, a folder that loads automatically and that most site owners have never opened

How it got in is almost always mundane: a plugin left out of date long enough for a public vulnerability to be published for it, an abandoned plugin nobody maintains any more, a nulled theme downloaded to save a licence fee, or an administrator password that was also used somewhere that got breached.

Safe first steps you can try

1. Reproduce it properly. Open a private browsing window, search for your business on Google, and click the result rather than typing the address. Try the same on a phone on mobile data. Knowing which condition triggers it tells you a great deal about what you are looking for.
2. Back up files and database before touching anything. The infected copy is evidence, and it is your way back if a cleanup step goes wrong.
3. Check your site address settings. WordPress admin, Settings → General. If the WordPress Address or Site Address is a domain you do not recognise, that is your redirect and it lives in the database.
4. Read your .htaccess. Anything outside the # BEGIN WordPress / # END WordPress markers was put there deliberately by someone. Long strings of random characters and any RewriteRule pointing at another domain are what you are looking for.
5. Open wp-content/mu-plugins/. If the folder exists and you did not create it, everything in it is loading on every page view without appearing in your plugins list.
6. Check users and plugins. An administrator you did not create, or a plugin you never installed — often with a plausible name like "WP Content Cache" — is worth noting before you delete anything.
7. Reinstall WordPress core. Dashboard → Updates → Reinstall Now replaces every core file with a clean copy and does not touch your posts, pages, uploads, themes or plugins. It is one of the safest useful things you can do.
8. Update everything, then rotate every credential. Plugins, themes, core, PHP version. Then all administrator passwords, the database password, FTP and hosting logins, and the security keys and salts in wp-config.php — rotating the salts logs every existing session out, including the attacker's.

What not to do