[{"data":1,"prerenderedAt":322},["ShallowReactive",2],{"blog-wordpress-redirect-hack-fix":3,"blog-others-wordpress-redirect-hack-fix":305},{"id":4,"title":5,"author":6,"body":7,"date":289,"description":290,"extension":291,"image":292,"meta":293,"navigation":294,"path":295,"seo":296,"source":297,"stem":298,"tags":299,"__hash__":304},"blog/blog/wordpress-redirect-hack-fix.md","WordPress Redirecting to Spam Sites? Here Is the Fix","KloudBoy Security Team",{"type":8,"value":9,"toc":273},"minimark",[10,19,25,28,33,38,50,70,74,87,90,115,123,126,145,149,160,174,184,189,193,196,220,224,227,232,240,256,261,265,268],[11,12,13,14,18],"p",{},"If you clicked on your own website and suddenly found yourself on a gambling, pharmacy, or adult site, ",[15,16,17],"strong",{},"panic is the correct first reaction",".",[11,20,21,22,18],{},"Your site has been compromised with the infamous ",[15,23,24],{},"“WordPress Redirect Hack”",[11,26,27],{},"This is not just a glitch. Hackers have injected malicious JavaScript or PHP code into your core files or database to steal your traffic. Google will soon ban your site (the dreaded “Red Screen of Death”).",[11,29,30],{},[15,31,32],{},"You need to act NOW.",[34,35,37],"h2",{"id":36},"step-1-confirm-the-hack","Step 1: Confirm the Hack",[11,39,40,41,45,46,49],{},"Sometimes the redirect only happens for ",[42,43,44],"em",{},"new"," visitors or ",[42,47,48],{},"mobile"," users (smart method to hide from admins).",[51,52,53,57,60],"ol",{},[54,55,56],"li",{},"Open your site in Incognito Mode.",[54,58,59],{},"Check your site on a mobile device (turn off WiFi to use mobile data).",[54,61,62,63,18],{},"Use a tool like ",[64,65,69],"a",{"href":66,"rel":67},"https://sitecheck.sucuri.net",[68],"nofollow","Sucuri SiteCheck",[34,71,73],{"id":72},"step-2-the-cleanup-do-not-skip-anything","Step 2: The Cleanup (Do NOT skip anything)",[75,76,78,79,83,84],"h3",{"id":77},"_1-check-indexphp-and-wp-blog-headerphp","1. Check ",[80,81,82],"code",{},"index.php"," and ",[80,85,86],{},"wp-blog-header.php",[11,88,89],{},"Hackers love these files. Open them via FTP or File Manager.",[91,92,93,103],"ul",{},[54,94,95,98,99,102],{},[15,96,97],{},"Look for",": Obfuscated code that looks like ",[80,100,101],{},"eval(base64_decode(...))"," or long strings of random characters at the very top of the file.",[54,104,105,108,109,114],{},[15,106,107],{},"Fix",": Compare these files with a fresh download of WordPress from ",[64,110,113],{"href":111,"rel":112},"https://wordpress.org",[68],"wordpress.org",". Replace them if they look different.",[75,116,118,119,122],{"id":117},"_2-the-htaccess-trap","2. The ",[80,120,121],{},".htaccess"," Trap",[11,124,125],{},"Often, the redirect happens before WordPress even loads.",[91,127,128,134,137],{},[54,129,130,131,133],{},"Open your ",[80,132,121],{}," file.",[54,135,136],{},"Look for strange rewrite rules involving random domains or IP addresses.",[54,138,139,141,142,144],{},[15,140,107],{},": Delete the ",[80,143,121],{}," file and specify a clean default WordPress one.",[75,146,148],{"id":147},"_3-the-database-injection-the-hard-part","3. The Database Injection (The Hard Part)",[11,150,151,152,155,156,159],{},"Modern hacks hide in your database, specifically in the ",[80,153,154],{},"wp_posts"," or ",[80,157,158],{},"wp_options"," tables.",[91,161,162,169],{},[54,163,164,165,168],{},"They inject ",[80,166,167],{},"\u003Cscript src='malware.js'>\u003C/script>"," into every single post content.",[54,170,171,173],{},[15,172,107],{},": You need to run a SQL search-and-replace command.",[175,176,181],"pre",{"className":177,"code":179,"language":180},[178],"language-text","UPDATE wp_posts SET post_content = REPLACE(post_content, '\u003Cscript src=\"http://malicious-domain.com/bad.js\">\u003C/script>', '');\n","text",[80,182,179],{"__ignoreMap":183},"",[11,185,186],{},[42,187,188],{},"(Warning: Backup your DB before running SQL commands!)",[34,190,192],{"id":191},"step-3-close-the-backdoor","Step 3: Close the Backdoor",[11,194,195],{},"Cleaning the hack is useless if you don’t close the hole.",[51,197,198,204,210],{},[54,199,200,203],{},[15,201,202],{},"Change all passwords",": WP Admin, FTP, and Database.",[54,205,206,209],{},[15,207,208],{},"Update Plugins",": The #1 cause of this hack is an outdated plugin (often Elementor or Slider Revolution).",[54,211,212,215,216,219],{},[15,213,214],{},"Check for “Ghost Admins”",": Go to ",[15,217,218],{},"Users > All Users",". Delete any admin user you don’t recognize.",[34,221,223],{"id":222},"the-i-cant-fix-it-option","The “I Can’t Fix It” Option",[11,225,226],{},"If this sounds too technical, or if the malware keeps coming back (it often hides in multiple places), do not waste time. Every hour your site is down costs you SEO ranking.",[11,228,229],{},[15,230,231],{},"We can fix this in \u003C 2 hours.",[11,233,234,235,239],{},"Our ",[64,236,238],{"href":237},"/wordpress-malware-removal/","Emergency Malware Removal Service"," includes:",[91,241,242,245,248,251],{},[54,243,244],{},"Complete file & database scanning.",[54,246,247],{},"Backdoor removal.",[54,249,250],{},"Google Blacklist removal request.",[54,252,253,18],{},[15,254,255],{},"30-day guarantee",[11,257,258],{},[64,259,260],{"href":237},"Get Help Now →",[75,262,264],{"id":263},"website-hacked-or-dealing-with-malware","Website hacked or dealing with malware?",[11,266,267],{},"Our 24/7 security engineers clean malware, harden servers, and restore uptime in under 2 hours.",[11,269,270],{},[64,271,272],{"href":237},"Get Emergency Security Help",{"title":183,"searchDepth":274,"depth":274,"links":275},2,[276,277,285,286],{"id":36,"depth":274,"text":37},{"id":72,"depth":274,"text":73,"children":278},[279,282,284],{"id":77,"depth":280,"text":281},3,"1. Check index.php and wp-blog-header.php",{"id":117,"depth":280,"text":283},"2. The .htaccess Trap",{"id":147,"depth":280,"text":148},{"id":191,"depth":274,"text":192},{"id":222,"depth":274,"text":223,"children":287},[288],{"id":263,"depth":280,"text":264},"2024-01-15","Is your WordPress site redirecting to Japanese spam or pharmacy sites? You are hacked. Follow this urgent guide to clean the malware and secure your DB.","md",null,{},true,"/blog/wordpress-redirect-hack-fix",{"title":5,"description":290},"https://kloudboy.com/blog/wordpress-redirect-hack-fix/","blog/wordpress-redirect-hack-fix",[300,301,302,303],"Security","Malware Removal","WordPress","Hacking","vS4E2KAYzf_Fc1tVboASJv7sSnb2fT2vT4QmTcSXZS0",[306,310,314,318],{"path":307,"title":308,"date":309},"/blog/the-100tb-stealth-botnet-postmortem","The 100-Terabyte Ghost: Unmasking a Stealth Linux DDoS Botnet Using Kernel Bind Mounts","2026-09-28",{"path":311,"title":312,"date":313},"/blog/openlitespeed-vs-nginx-wordpress","OpenLiteSpeed vs Nginx vs Apache: The Ultimate WordPress Benchmark","2024-01-16",{"path":315,"title":316,"date":317},"/blog/data-sovereignty-hosting","Data Sovereignty: Why Indian & GCC Startups Must Host Locally","2024-01-14",{"path":319,"title":320,"date":321},"/blog/remote-work-story","We Ditched the Office Completely — KloudBoy's Remote Work Story","2021-06-01",1792120524828]