A WordPress redirect hack is one of the most frustrating and damaging attacks your website can face. It diverts your legitimate traffic to spam, phishing, or malware-laden sites, eroding user trust, damaging your SEO, and potentially blacklisting your domain. As senior security engineers at MalwareRemoveExpert.net, we’ve seen countless variations of this attack. This guide will walk you through the process of diagnosing, cleaning, and securing your WordPress site against these insidious redirects.
Understanding the WordPress Redirect Hack Mechanism
Malicious redirects don’t just happen; they are the result of an underlying compromise. Attackers inject code into various parts of your WordPress installation to execute these redirects. Understanding where to look is half the battle.
Common Injection Points for Redirects:
- Core WordPress Files:
wp-config.php,wp-load.php,wp-settings.php, and even theme/plugin files. - Database: The
wp_optionstable (specificallysiteurlorhome), or embedded in post content/comments. .htaccessFile: Highly effective for immediate, comprehensive redirects.- JavaScript Injection: Often found in theme footers (
footer.php), headers (header.php), or within compromised plugin/theme files. - Malicious Plugins/Themes: Backdoors often hide within seemingly legitimate or nulled software.
Step-by-Step Fix: Identifying and Removing the Redirect
Before you begin, backup your entire site (files and database) immediately. This is crucial for recovery if anything goes wrong during the cleanup.
1. Scan for Malicious Files
A comprehensive scan is your first line of defense. Use a reputable security plugin like Wordfence, Sucuri, or MalCare. While these are good starting points, advanced attackers often use obfuscation to evade detection.
# Example WP-CLI command for scanning (if using a security plugin with WP-CLI integration)
wp sucuri scan --full
2. Examine the .htaccess File
This file is a prime target for redirects because it processes requests before WordPress even loads. Look for suspicious RewriteRule or RedirectMatch directives that point to external, unknown URLs.
# Basic .htaccess file content should look like this:
# BEGIN WordPress
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress
# Suspicious examples:
RewriteRule ^(.*)$ http://malicious-site.com/$1 [R=301,L]
RedirectMatch 301 ^/wp-admin/(.*)$ http://spam-site.com/$1
Compare your .htaccess against a fresh WordPress installation’s default file. Remove any lines that don’t belong.
3. Check Core WordPress Files and Common Injection Points
Manually inspect files like wp-config.php, wp-load.php, wp-settings.php for unusual code. Look for PHP header() redirects, obfuscated JavaScript (e.g., base64 encoded strings), or unexpected eval() or str_rot13() functions.
Pay close attention to compromised theme and plugin files. Often, attackers modify functions.php in themes or inject code into common plugin files. A common tactic is to add a call to an external script that handles the redirect:
// Example of malicious code in functions.php
// DO NOT ADD THIS TO YOUR SITE
require_once(ABSPATH . 'wp-includes/pomo/streams.php'); // Malicious file
eval(base64_decode('aHR0cHM6Ly9tYWxpY2lvdXNkb21haW4uY29t'));
Replace core WordPress files, themes, and plugins with fresh, legitimate copies. This is often the most effective way to eliminate hidden backdoors. Ensure you download themes and plugins from official repositories.
4. Investigate Your WordPress Database
Malicious redirects can be stored directly in your database. Use phpMyAdmin or a similar tool to inspect these tables:
wp_options: Checksiteurlandhomeoptions. If they point to a suspicious domain, correct them.wp_posts: Look for embedded JavaScript redirects in post content or revision history.wp_comments: Spam comments sometimes contain malicious links.
# SQL command to check siteurl and home options
SELECT option_name, option_value FROM wp_options WHERE option_name = 'siteurl' OR option_name = 'home';
# SQL command to search for malicious redirects in post content (adjust 'malicious_domain.com')
SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%malicious_domain.com%' AND post_status = 'publish';
5. Check for Malicious JavaScript
Attackers often inject JavaScript into theme files (header.php, footer.php) or directly into the database. Look for <script> tags that link to external domains or contain obfuscated code designed to redirect.
<script type='text/javascript'>window.location.replace("http://malicious-site.com/");</script>
Post-Cleanup Hardening and Prevention
Cleaning the hack is only half the battle. You must harden your site to prevent reinfection.
- Change All Passwords: For WordPress admin, hosting, FTP, and database. Use strong, unique passwords.
- Update Everything: Keep WordPress core, themes, and plugins updated to the latest versions.
- Remove Unused Themes/Plugins: Minimize your attack surface.
- Implement a Web Application Firewall (WAF): Cloud-based WAFs like Cloudflare or Sucuri WAF can block malicious requests before they reach your server.
- Regular Backups: Maintain a consistent backup schedule.
- Scan Regularly: Use a reputable security scanner to monitor your site for new infections.
- Monitor File Integrity: Tools like Wordfence can alert you to changes in core WordPress files.
- Restrict File Permissions: Set appropriate file and folder permissions (e.g., 755 for folders, 644 for files).
Frequently Asked Questions About WordPress Redirect Hacks
How did my WordPress site get hacked with a redirect?
Typically, a WordPress redirect hack results from vulnerabilities in outdated themes or plugins, weak admin passwords, or compromised hosting environments. Backdoors are then installed, allowing attackers to inject malicious redirect code.
Will merely deleting the injected code fully fix the redirect hack?
No, simply deleting the visible redirect code is often insufficient. The underlying backdoor that allowed the injection might still exist, leading to reinfection. You must identify and remove the root cause (malicious files, backdoors, compromised accounts) and harden your security.
How can I prevent a WordPress redirect hack in the future?
Prevention involves a multi-layered approach: regularly update WordPress, themes, and plugins; use strong, unique passwords; employ a robust security plugin and WAF; restrict user permissions; and maintain daily backups. Consistent vigilance is key.
Dealing with a WordPress redirect hack can be complex and time-consuming, especially if you’re not experienced with server-level diagnostics. If you’ve followed these steps and are still facing issues, or if you prefer professional assistance to ensure a thorough cleanup and hardening, consider reaching out to the experts. Our team at MalwareRemoveExpert.net specializes in WordPress malware removal and can help restore your site’s integrity and security effectively.