WordPress Redirect Virus Fix: Why Your Visitors Are Being Sent to Spam Pages

If visitors say your WordPress site sends them to casino pages, fake antivirus offers, or strange spam URLs, treat it as an urgent security problem even if you cannot reproduce it on your own browser right away.

A WordPress redirect virus often behaves selectively. It may target only mobile visitors, first-time sessions, search-engine traffic, or users from specific countries. That is why site owners often hear complaints before they see the redirect themselves.

RyoheiYokoyama

I’m Ryohei Yokoyama, founder of SiteFixNow. I’ve worked as an IT engineer for over 20 years and have handled many WordPress malware removal, hacked site repair, and redirect infection cleanup cases. In this article, I’ll show you how to confirm the real cause, remove the redirect safely, and verify it does not come back.

Why your WordPress visitors are being sent to spam pages even if you cannot reproduce it

The most important point is that redirect malware is often conditional. Attackers do not always want administrators to notice the infection immediately. They may hide the redirect from logged-in users, desktop browsers, repeat visitors, or requests from known IP ranges.

That means your site can look normal during your own checks while real visitors still land on casino pages, fake prize sites, browser-warning scams, or ad spam. If customers, analytics, or Search Console suggest redirect behavior, assume the report is credible until you prove otherwise.

If the redirect already looks like part of a broader compromise, review WordPress Hacked Site Repair: What to Do Before It Gets Worse for emergency handling priorities before you start deleting files.

First checks to confirm whether the redirect is malware or a safer configuration mistake

The main recommendation here is to verify the pattern before you change anything. Not every redirect is malware. A bad plugin setting, a CDN rule, an SEO plugin conflict, a hacked ad script, or a hosting cache issue can also send traffic to the wrong location. The difference is that malicious redirects usually include suspicious destinations, targeting logic, or hidden persistence.

Check from a private browser window, a mobile device, and a network outside your normal office or home environment. If possible, test from search-result clicks as well as direct visits. Then compare what different users see.

A quick debug setting that helps separate PHP problems from browser-only symptoms

If you suspect the redirect comes from theme or plugin execution, turn on safe logging so WordPress writes errors without showing them to visitors. This will not expose every redirect infection, but it can reveal which file path or function runs right before suspicious behavior.

define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );
@ini_set( 'display_errors', 0 );

After that, review wp-content/debug.log and your server error log for references to unfamiliar plugin paths, theme files, or injected includes. If the issue looks broader than a redirect alone, also compare your findings with WordPress Malware Infection Recovery.

A redirect that appears only in the browser is still dangerous. The absence of a visible PHP error does not mean the site is clean.

Where WordPress redirect virus code usually hides

The practical way to remove a redirect virus is to inspect the places that load on every request. In real incidents, I start with .htaccess, wp-config.php, active theme files, must-use plugins, suspicious plugin folders, uploads, and database options that can inject scripts or redirect rules.

The reason this order matters is persistence. If you only remove the visible redirect script but miss the loader that recreates it, visitors will be sent back to spam pages again within hours or days.

Compare .htaccess with a clean WordPress rewrite block

Attackers often place redirect logic in .htaccess because Apache can send visitors away before WordPress fully loads. If you see unfamiliar domains, mobile targeting, search-engine conditions, or encoded rewrite rules, investigate immediately.

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Look for suspicious executable files inside uploads and hidden loaders

Uploads should mostly contain images, PDFs, and generated thumbnails. PHP files, oddly named scripts, or recently modified executable files inside dated upload folders are strong warning signs. Must-use plugins also deserve special attention because they load automatically and are easy to miss in a quick plugin review.

find wp-content/uploads -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.php5" \)
find wp-content/mu-plugins -type f
grep -R "http" wp-content/themes wp-content/plugins wp-content/mu-plugins
grep -R "base64_decode\\|gzinflate\\|eval(" wp-content

Check database options and custom HTML for injected script tags

Some redirect viruses live in the database rather than in theme files. That can happen in widget content, theme settings, SEO plugin options, header/footer injection tools, or page-builder custom code. If you only scan files, you may miss the real source.

SELECT option_name
FROM wp_options
WHERE option_value LIKE '%<script%'
   OR option_value LIKE '%iframe%'
   OR option_value LIKE '%window.location%'
   OR option_value LIKE '%document.location%';

For a broader cleanup process after you locate the infected area, see WordPress Malware Removal: How to Clean an Infected Site Safely.

A safe WordPress redirect virus fix workflow

The safest fix is controlled and reversible. Do not start by deleting random files one by one. Preserve the current state first, isolate the likely entry point, replace compromised code with clean copies, and then reset credentials and recheck the site.

How to isolate a plugin conflict or plugin-based redirect quickly

If wp-admin is unavailable or you strongly suspect a plugin, temporarily disable plugins in bulk by renaming the plugins directory. If the redirect stops, restore the directory name and test plugins in smaller groups. This is much safer than editing unfamiliar PHP files blindly.

wp-content/plugins
rename to:
wp-content/plugins.off

If the redirect remains after a bulk plugin disable, focus more heavily on theme files, .htaccess, must-use plugins, and database injections. If the behavior looks business-critical or keeps returning, a structured WordPress Recovery Service may be the faster path.

A redirect that disappears after one file is removed can still come back. That usually means the visible payload was only one piece of the infection.

How to verify the redirect is truly gone and stop reinfection

The main recommendation after cleanup is to verify from multiple angles, not just from your own admin browser. A redirect fix is not complete until visitors, search traffic, and repeated fresh sessions all behave normally. This validation step is where many DIY cleanups fail.

Also harden the site right away. If the attacker still has a valid admin account, stolen hosting password, or working backdoor, the redirect can return even after your visible cleanup looks successful.

define( 'DISALLOW_FILE_EDIT', true );
define( 'FORCE_SSL_ADMIN', true );
define( 'WP_MEMORY_LIMIT', '256M' );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );

Once the redirect is gone, follow a stronger prevention checklist so the same weak point is not abused again. A good next step is WordPress Security Checklist for Beginners.

A redirect fix is successful only when the site stays clean after fresh testing, login review, and credential rotation.

When to stop DIY cleanup and get expert help

The final point is to recognize when the risk is too high for trial-and-error repairs. If customers are being redirected to spam pages, ad traffic is being hijacked, Google snippets look compromised, or the redirect keeps returning after cleanup, the site is already costing you trust and visibility.

Expert cleanup becomes especially important when you cannot confirm whether the infection lives in files, the database, CDN rules, or stolen credentials. Mixed infection points are common in hacked WordPress sites, and partial fixes often waste more time than they save.

Frequently asked questions about WordPress redirect virus fixes

Why do visitors see the spam redirect when I do not?

Many redirect infections are conditional. They may exclude logged-in administrators, desktop browsers, repeat visitors, or your own IP address. That is why testing from private windows, mobile devices, and different networks is so important.

Is a redirect always caused by malware?

No. Some redirects come from plugin settings, CDN rules, redirect managers, or SEO misconfiguration. The danger signs are suspicious destinations, hidden conditions, recurring reinfection, injected scripts, and unfamiliar file or database changes.

What is the biggest mistake during a redirect virus cleanup?

The biggest mistake is deleting one visible payload and assuming the job is done. If you do not remove the underlying backdoor or rotate compromised credentials, the redirect often comes back.

Summary

A WordPress redirect virus fix starts with confirming the pattern, checking the highest-risk locations first, and cleaning the site in a controlled order. If visitors are being sent to spam pages, the problem may be conditional malware, a database injection, a server-side rewrite, or a missed backdoor that recreates the redirect after you think the site is fixed.

The best outcome comes from preserving evidence, replacing compromised code with clean originals, reviewing admin access, rotating credentials, and validating from fresh sessions before you declare success. If the redirect keeps returning or the site is business-critical, expert help is usually cheaper than a longer outage.

If You Can’t Secure or Recover Your WordPress Site Yourself

If your website shows malware warnings, redirects to strange pages, or you are not sure whether it is secure,
SiteFixNow can help clean, repair, and recover your WordPress site.

We help with WordPress malware removal, hacked site repair, security cleanup, and recovery support.