Your site looks completely normal when you visit it. Your customers say they land on spam sites instead. This is the redirect hack's defining trick — conditional targeting that hides the problem from you specifically while it actively damages your traffic and reputation.
Free diagnostic · Multi-location code review · Reinfection-proof cleanup
Modern redirect malware uses conditional targeting — checking who a visitor is before deciding whether to redirect them. Most variants combine at least two of these evasion techniques simultaneously:
WordPress admin users never see the redirect. Only logged-out visitors — your actual audience — get sent elsewhere. You cannot see the problem while logged into your own dashboard.
The malware checks where the visitor came from. Arrive from Google, Bing or Yahoo and you get redirected. Type the URL directly and you see the normal site.
A common variant only triggers on mobile devices, which often points specifically to injected code in the .htaccess file.
Server-side and .htaccess-based redirects are frequently invisible to remote security scanners, since the scanner's request does not match the conditions the malware checks for.
Redirect hacks are specifically built to avoid detection by both site owners and automated scanners. If customers are reporting redirects but every tool says you are clean, that is not a contradiction — it is exactly how this attack is designed to behave.
Most commonly the .htaccess file, but also wp-config.php, theme files like header.php and footer.php, plugin files, and directly in the database — particularly the wp_options table and site URL settings. Sophisticated infections hide in more than one location simultaneously, which is why cleaning only the obvious .htaccess entry often does not hold.
Some variants go further: they include code elsewhere on the server that detects when .htaccess is modified and automatically reverts it back to the infected version. Clean the file, and it reinfects itself within moments. Finding and removing that reversion mechanism — not just the visible redirect code — is what makes a fix actually stick.
We test as a logged-out visitor arriving from search, since that is usually the only way to actually see the problem.
.htaccess, wp-config.php, theme files, plugin files and the database are all checked — not just the most obvious spot.
If the malware reverts your fixes automatically, we find and remove that mechanism first.
Every instance of the conditional redirect logic is removed across every location it was found.
We identify and fix the vulnerability that allowed the original compromise.
We test as logged-out, from a search referrer, and from mobile — the same conditions the malware checks for.
A clear report of every location the code was found, plus hardening recommendations to prevent recurrence.
If customers are reporting redirects, trust them over a clean scan result. Get a real diagnostic that tests the exact conditions the malware is checking for.
🚀 Ready to grow with data-driven digital marketing?