WordPress Redirect Hack on Mobile Only: How to Detect and Fix It

A WordPress redirect hack on mobile only can be real even when the site looks normal on desktop. Attackers may show the malicious destination only to selected visitors so the owner and security scanner are less likely to see it.

RyoheiYokoyama

I’m Ryohei Yokoyama, founder of SiteFixNow. I’ve worked as an IT engineer for over 20 years and have handled many WordPress malware removal, hacked site repair, and redirect hack cleanup cases. In this article, I’ll show you how to investigate a mobile-only redirect without hiding the evidence or making the infection harder to trace.

Why a WordPress Redirect Hack May Appear on Mobile Only

“Mobile only” is usually a condition, not a separate malware type. A compromised site can decide whether to redirect from the request, browser state, or visitor source.

Common conditions include a mobile User-Agent, a Google referrer, a new cookie, a logged-out session, a specific country, one landing page, or a particular time window. Malware may also exclude WordPress administrators and familiar IP addresses.

For the broader symptoms and emergency priorities, review WordPress redirect hack symptoms and first-response steps. The mobile-only investigation below adds the controlled comparisons needed when the behavior is selective.

Reproduce and Record the Mobile-Only Redirect Safely

Build a small test matrix before changing the site. Change one variable at a time so you can identify the trigger instead of producing a collection of contradictory screenshots.

Use an isolated test browser or disposable profile. Do not ask customers to keep visiting a suspected malicious destination. Record the source page, final domain, timestamp and timezone, device, browser, network, login state, referrer, and whether it was the first visit.

You can compare HTTP responses with mobile and desktop User-Agent strings. The command below stops at the first server-side redirect instead of following the unknown destination.

# Replace example.com with your own affected page.
# --max-redirs 0 records the first response without following it.
curl -sS -D mobile-headers.txt -o /dev/null --max-redirs 0 \
  -A "Mozilla/5.0 (Linux; Android 14; Mobile) AppleWebKit/537.36 Chrome/127 Safari/537.36" \
  -e "https://www.google.com/" https://example.com/affected-page/

curl -sS -D desktop-headers.txt -o /dev/null --max-redirs 0 \
  -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/127 Safari/537.36" \
  -e "https://www.google.com/" https://example.com/affected-page/

diff -u desktop-headers.txt mobile-headers.txt

The general WordPress redirect virus troubleshooting workflow helps distinguish malware from a redirect plugin, CDN rule, or ordinary configuration error.

Find Which Layer Creates the Mobile Redirect

Start with the layer indicated by your evidence, but inspect every persistence path before declaring the site clean. A redirect can be injected at more than one layer, and removing the first symptom may leave the attacker’s loader or access route intact.

In developer tools, compare scripts, network requests, cookies, storage, and service workers in a fresh disposable profile and the affected profile. At the edge, review CDN redirects, workers, cache variations, mobile optimization, origin selection, and DNS changes. Preserve the bad response before clearing caches.

Inspect WordPress, server files, and the database

Check .htaccess, Nginx configuration, wp-config.php, must-use plugins, active plugins, the active theme, uploads, cache folders, and modified core files. Search for mobile conditions and redirect functions, but treat a search hit as a lead rather than proof.

# Run from a verified backup or safe server shell.
find wp-content -type f -name '*.php' -mtime -14 -print

grep -RniE 'HTTP_USER_AGENT|wp_is_mobile|window\.location|document\.location|location\.replace|base64_decode|gzinflate|eval[[:space:]]*\(' \
  wp-config.php .htaccess wp-content/mu-plugins wp-content/plugins wp-content/themes 2>/dev/null

# PHP inside uploads is unusual on most sites and deserves review.
find wp-content/uploads -type f \( -name '*.php' -o -name '*.phtml' \) -print

Use a trusted database export for searching rather than running destructive replacements first. Then scan WordPress for malware and hidden backdoors across the entire account, including sibling sites that share credentials or hosting.

Fix the Mobile WordPress Redirect Without Hiding the Root Cause

Contain visitors, preserve the infected state, and clean from a known-good source. Editing one redirect line is not enough if the attacker can regenerate it through a backdoor, stolen password, vulnerable plugin, scheduled task, or compromised hosting account.

Follow a complete WordPress malware cleanup across files, database, and backdoors. If multiple sites share the same account, clean and patch them as one incident or the compromised neighbor may reinfect the repaired site.

Only purge browser, plugin, server, and CDN caches after the malicious source has been removed. Purging is part of deployment and verification; it is not a malware-removal method.

Verify the Mobile Redirect Is Gone Everywhere

Repeat the same pre-cleanup matrix after recovery. A single successful desktop visit proves very little. Use the same reported landing page, referrer, device type, login state, network type, and first-visit condition that originally triggered the redirect.

Finally, secure WordPress after malware removal and stop reinfection with updates, least privilege, multifactor authentication, protected backups, file-change monitoring, and a documented response process.

Frequently Asked Questions About Mobile-Only WordPress Redirects

Why does my WordPress site redirect on a phone but not on a computer?

Malware may check the mobile User-Agent, screen size, referrer, cookie, login state, IP location, or cached version before redirecting. A legitimate CDN or plugin rule can also differ by device, so compare the conditions and inspect the responsible layer.

Can clearing my phone cache fix the redirect?

Clearing browser data may remove a malicious cached script or service worker from that device, but it does not clean the server, database, CDN, or stolen account. Preserve evidence first, remove the source, then clear every cache as part of verification.

Is deleting the suspicious redirect code enough?

No. You must identify the entry path, search for loaders and backdoors, patch vulnerable software, review users and scheduled tasks, rotate exposed credentials, and verify across the original trigger conditions. Otherwise, the code may return.

Summary: Test the Condition, Clean the Source, and Verify Again

A mobile-only redirect report should be treated as credible until controlled testing proves otherwise. Selective malware can hide from logged-in owners, desktop browsers, familiar networks, and repeated visits.

Record the trigger matrix, preserve the infected state, trace the browser, edge, server, WordPress, and database layers, and clean every persistence path. Afterward, repeat the exact mobile tests and monitor for unauthorized changes before considering the incident closed.

If You Can’t Secure or Recover Your WordPress Site Yourself

If your website shows malware warnings, redirects to strange pages, or you are not sure whether it is secure,
SiteFixNow can help clean, repair, and recover your WordPress site.

We help with WordPress malware removal, hacked site repair, security cleanup, and recovery support.