WordPress Redirect Hack: How to Find and Remove Malicious Code

Understanding the WordPress Redirect Hack

The "Redirect Hack" is currently one of the most common and frustrating malware infections hitting WordPress websites. When a visitor tries to access your site, they are abruptly redirected to a malicious page—often a fake tech support scam, an adult site, or a phishing page.

What makes this hack insidious is that it often evades detection by only redirecting users coming from search engines (like Google) or mobile devices, while appearing completely normal to you when you log in as an admin.

Where Does the Redirect Code Hide?

Hackers inject redirect scripts into various parts of your WordPress architecture. The most common hiding spots are:

1. .htaccess File: Hackers modify your server's configuration file to redirect traffic before WordPress even loads.
2. wp-config.php: Malicious PHP code is placed at the very top of your configuration file.
3. Theme Files: header.php or footer.php are prime targets for malicious JavaScript injections.
4. The Database: Injections via vulnerable plugins often place JavaScript payloads directly into the wp_options or wp_posts tables.

How to Fix the Redirect Hack

Step 1: Check your .htaccess file

Access your site via FTP or your host's File Manager. Look at the `.htaccess` file in your root directory. A normal WordPress `.htaccess` looks like this:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

If you see strange, complex rules redirecting to random URLs, delete them and restore the default rules.

Step 2: Automate the Cleanup with Nexura

Manually checking the database and every PHP file is tedious. The best approach is to use Nexura Security.

• Run a full Deep Malware Scan. Nexura's AST engine is specifically designed to find obfuscated JavaScript and PHP redirects that traditional signature scanners miss.
• Remove the flagged files or restore them to their original state using Nexura's Core Restore feature.

Step 3: Patch the Vulnerability

The hacker got in somehow. In 95% of cases, it was through an outdated plugin. Update all plugins immediately and delete any plugins you are no longer using.

Preventing Future Redirect Hacks

The easiest way to stop redirect hacks is to block the initial payload. Ensure the Nexura Web Application Firewall (WAF) is enabled. It will intercept the malicious requests trying to inject the redirect code and block the attacker's IP address instantly.