WordPress Site Redirecting to Another Website? How to Clean a Hack and Lock It Down

A customer tells you your website sent them to a gambling page, a fake prize or a scam store. You open the site and it looks normal. That mismatch is typical: a WordPress site redirecting visitors elsewhere has almost always been hacked, and the malicious code is often written to hide from logged-in owners.

This guide shows how to confirm the hack, clean it safely, close the hole the attackers used and lock the site down so it does not happen again.

Step 1: Confirm the redirect

• Open your site in a private window, logged out, on your phone, preferably by clicking your site in a Google search result. Many redirect hacks only fire for visitors from search engines or on mobile.
• Check Google Search Console under Security & Manual Actions > Security issues.
• Use a free online website malware scanner to check your homepage from outside.
• Look for unknown administrator accounts under Users.

Step 2: Contain the damage

1. Change every password: WordPress administrators, hosting account, FTP/SFTP, database and the email account linked to the site. Assume all of them are known to the attacker.
2. Remove unknown admin users, reassigning their content to your account.
3. Tell your host. Many hosts scan for and help clean malware, and they need to know if a shared account was compromised.
4. If the site handles payments or personal data, consider putting it into maintenance mode while you clean.

Step 3: Clean the site

Best option: restore a clean backup

If you have a backup from before the hack, restoring it is the fastest, most reliable cleanup. Then update everything immediately (Step 4), because the original weakness is still there.

No clean backup? Clean in this order

1. Back up the hacked site anyway, so you can recover content if something goes wrong.
2. Reinstall WordPress core from Dashboard > Updates > Re-install, which replaces core files with clean copies.
3. Reinstall every plugin and theme from the official source. Delete the plugin folders and install fresh copies. Delete anything you do not recognize or do not use.
4. Check the usual hiding places in File Manager: .htaccess (unexpected redirect rules), wp-config.php (strange code at the top), unfamiliar PHP files in wp-content/uploads (the uploads folder should only contain media), and recently modified files.
5. Check the database for injected scripts in posts, widgets and the siteurl/home options, ideally with a security scanner.

Important: if the infection keeps returning after cleaning, there is still a backdoor. That is the point to use your host's malware service or a professional cleanup service.

Step 4: Close the hole they used

• Update WordPress, every plugin and every theme.
• Remove nulled or pirated plugins and themes completely. They are one of the most common sources of malware.
• Delete abandoned plugins that have not been updated in a long time.
• Switch to a supported PHP version.

Step 5: Lock it down with four settings

The free SWS Site Fixer plugin (download below) has these on its Security tab:

1. Limit login attempts: blocks an IP address after a few wrong passwords, which stops brute-force bots.
2. Disable XML-RPC: turns off an old remote-publishing feature bots use to guess passwords at scale. Leave it on only if you use the WordPress mobile app or Jetpack features that need it.
3. Hide the WordPress version so bots cannot easily match your site to known vulnerabilities.
4. Disable the theme and plugin file editor, so a stolen admin login cannot be used to inject code from the dashboard.

Then add two-factor authentication for every administrator and set up automatic off-site backups.

Step 6: Tell Google the site is clean

1. In Search Console, open Security issues.
2. Confirm you have fixed the problems, then click Request review and briefly describe what you did.
3. Reviews for malware usually take a few days; warnings disappear once Google confirms the site is clean.

Signs to watch for afterwards

• New admin users you did not create.
• Strange new pages or posts (often spam in other languages) appearing in Search Console.
• Sudden drops in traffic or a spike in outgoing links.
• Modified .htaccess or wp-config.php files.

Prevention is far cheaper than cleanup. Work through the 20-step WordPress security checklist (the PDF is included below) and repeat its monthly routine. Seeing a critical error after cleaning? Follow the critical error guide.