Website Redirecting to Spam Sites: How to Find and Fix It

A website that redirects visitors to spam sites is one of the most damaging things that can happen to your online presence. Visitors leave immediately, Google flags your site, and bookings or enquiries dry up. The good news: this is a well-understood attack with a clear fix. Here is how to handle it calmly and thoroughly.

How do you know your site is actually redirecting — and not just your browser?

Before you do anything else, confirm the redirect is happening for real visitors, not just you. Browsers cache redirects aggressively, so what you see may be outdated.

Check these three ways:

1. Open your site in an incognito or private window — this bypasses your browser cache.
2. Use Google's URL inspection tool in Search Console. Paste your homepage URL, click "Test Live URL," and Google will show you exactly what it fetches, including any redirects.
3. Use a redirect checker tool such as httpstatus.io or redirect-checker.org — enter your URL and it will show every hop in the redirect chain.

If any of these confirm a redirect to a domain you do not recognise, you have a confirmed infection. Move to the next step.

What causes a website to redirect to spam sites?

The most common cause is a malicious code injection — an attacker has gained access to your site and inserted code that sends visitors (or only certain visitors, such as those arriving from Google) to another destination.

Typical entry points include:

• Outdated WordPress plugins or themes with known security vulnerabilities
• Weak or reused admin passwords
• Compromised hosting credentials obtained via phishing or data breaches
• Nulled (pirated) themes or plugins that contain backdoors by design

A particularly sneaky variant is a conditional redirect — the code only activates for visitors coming from a search engine, so when you visit your own site directly, everything looks fine. This is why the incognito/Google test above matters.

Where should you look for the malicious code?

The code can be hiding in several places. Work through each one.

1. Your website files

The most common locations are:

• index.php in your root directory
• wp-config.php (WordPress sites)
• .htaccess in your root directory — attackers frequently add RewriteRule or Redirect lines here
• functions.php inside your active theme folder
• Any PHP file that loads on every page request

What to look for: Base64-encoded strings (they look like a long block of random letters and numbers, often preceded by eval(base64_decode(), obfuscated JavaScript with document.location or window.location, or unfamiliar Redirect lines in .htaccess.

Access your files via your hosting control panel's file manager, or connect via FTP/SFTP using a client like FileZilla.

2. Your database

For WordPress sites, attackers sometimes inject redirect code directly into the database — particularly into the wp_options table (look at the siteurl, home, and active_plugins rows) or into post content.

Log into phpMyAdmin via your hosting panel. In the wp_options table, run a search for eval( or the domain name of the spam site you were redirected to. The WordPress plugin Better Search Replace can also scan and clean database content safely.

3. Newly created or modified files

FTP clients and file managers usually show a "last modified" date. Sort your files by modification date. Any PHP file modified on a date you do not recognise — especially if you were not actively working on the site — deserves close inspection.

How do you remove the malicious code?

Once you have found the infected file or database entry, here is a safe approach:

1. Download a backup of everything first — even an infected backup is useful for comparison later.
2. For .htaccess: Delete the entire file, then regenerate a clean one. In WordPress, go to Settings → Permalinks and click Save — this recreates a clean .htaccess automatically.
3. For infected PHP files: If the file is a core WordPress file (e.g., index.php, wp-login.php), replace it with a fresh copy downloaded directly from wordpress.org — do not edit around the bad code, replace the whole file.
4. For theme files: Replace with a clean copy from your theme provider, or restore from a backup you made before the infection.
5. For database injections: Remove only the injected content, not the entire row. Take a careful screenshot before deleting anything.

After cleaning, run the Google URL inspection test again to confirm the redirect is gone.

What should you do immediately after cleaning?

Removing the code is not enough if the attacker's entry point still exists. Take these steps right away:

• Change all passwords immediately: WordPress admin, hosting control panel, FTP, and your email account. Use a password manager to generate strong, unique passwords.
• Update everything: WordPress core, all plugins, all themes. Delete any plugins or themes you are not actively using.
• Remove nulled or pirated software — it almost certainly contains a backdoor and will reinfect your site.
• Check for rogue admin accounts: In WordPress, go to Users → All Users and remove any account you do not recognise.
• Request a Google review: If Google has flagged your site with a "Deceptive Site" warning, go to Search Console → Security Issues, confirm your fixes, and click "Request Review."
• Install a security plugin such as Wordfence or Solid Security (formerly iThemes Security) to add a firewall and monitor for future changes.

Free scan tools vs paid security services: which should you use?

For a one-off cleanup, start with the free options. If your site has been reinfected more than once, or if you simply do not have time to manage this yourself, a paid cleanup service from Sucuri or your hosting provider is worth the cost.

FAQ

My site looks fine when I visit it — can it still be redirecting others? Yes. Conditional redirects are designed to only trigger for visitors arriving from search engines like Google, so the site owner almost never sees the problem directly. Always test using Google Search Console's "Test Live URL" feature or an incognito window with a fresh session.

Will cleaning the files fix the Google warning banner too? Not automatically. Once you have removed all malicious code, you need to go to Google Search Console → Security Issues and submit a review request. Google typically re-crawls your site within a few days and removes the warning if everything is clean.

How did the attacker get in if I had a strong password? Strong passwords help, but they are not the only entry point. Outdated plugins with known vulnerabilities are the most common cause — attackers run automated scans looking for sites running specific old plugin versions. Keeping everything updated is as important as having a strong password.

Should I restore from a backup instead of cleaning manually? Only if you know exactly when the infection happened and your backup predates it. Restoring a backup does not fix the vulnerability that allowed the attack — so you must still update software and change passwords, or the site will be reinfected within days.